joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e90
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41918d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x01636a40]
test eax, eax
jg 0x419117
mov eax, dword [0x01635f38]
cmp eax, 2
jne 0x419172
mov rax, qword [rsp + 0x28]
mov qword [0x010f10b8], rax
call fcn.0041a250
mov qword [0x010f10c0], 0
call fcn.0042dbc0
mov eax, dword [rsp]
mov dword [0x010f10b0], eax
mov rax, qword [0x010f1020]
test rax, rax
jne 0x41910b
mov rax, qword [0x010f10e0]
add rax, qword [0x010f10e8]
add rax, qword [0x010f10f0]
add rax, qword [0x010f10f8]
test rax, rax
jne 0x41910b
mov byte [0x010f10d0], 0
mov eax, dword [0x010f10b0]
cmp eax, 1
ja 0x4190e4
call fcn.00419700
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0xa0]
test byte [rcx], al
test byte [rax], al
lea rax, [rcx + 0x1270]
mov qword [rsp + 0x10], rax
movzx ecx, byte [0x010f10d0]
test cl, cl
je 0x4190cd
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0041c3d0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0041f880
mov eax, dword [0x01636a4c]
test eax, eax
jg 0x4190c3
mov rax, qword [0x010f1020]
test rax, rax
jne 0x419157
mov eax, dword [0x010f10b0]
cmp eax, 1
ja 0x4190ae
mov byte [0x010f1100], 1
mov rax, qword [0x010f0070]
mov rcx, qword [0x010f0078]
xor edx, edx
jmp 0x418ff2
inc rdx
cmp rdx, rcx
jge 0x419063
mov rbx, qword [rax + rdx*8]
test byte [rbx], al
lea rsi, [rbx + 0x1270]
test byte [rsi], al
mov rsi, qword [rbx + 0x1270]
test rsi, rsi
je 0x41905c
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x419058
mov rsi, qword [rbx + 0x1278]
mov rsi, qword [rsi + 0x10]
test rsi, rsi
sete sil
test sil, sil
je 0x41913c
mov rsi, qword [rbx + 0x1288]
test rsi, rsi
jne 0x419121
mov rbx, qword [rbx + 0x1280]
test rbx, rbx
jne 0x419121
jmp 0x418fef
xor esi, esi
jmp 0x41902d
mov esi, 1
jmp 0x41902d
call fcn.00424f30
mov rax, qword [0x010f10a0]
mov qword [0x0163e810], rax
mov rax, qword [0x010f10a0]
mov qword [0x0163e800], rax
mov rax, qword [0x01636d40]
mov qword [0x0163e808], rax
movzx eax, byte [0x01112510]
test al, al
jne 0x4190a7
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00448640
jmp 0x41909d
lea rax, [0x010f10c8]
mov qword [rsp], rax
call fcn.0040e7b0
jmp 0x418fd6
call fcn.0041a3f0
jmp 0x418fb7
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0041c3d0
jmp 0x418f9b
lea rax, [0x010f10c8]
test byte [rax], al
mov qword [0x010f10c8], 0
mov eax, dword [0x010f10b0]
mov dword [rsp], eax
call fcn.0042dd00
jmp 0x418f4a
mov byte [0x010f10d0], 1
jmp 0x418f3b
call fcn.00424d60
jmp 0x418ec6
lea rax, [0x008b8711]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042ab20
ud2
lea rax, [0x008b8099]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0042ab20
ud2
lea rax, [0x008a1714]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042ab20
ud2
lea rax, [0x008bb1e7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x38
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00418e90
Function at 0x4191a0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41933e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x01635f38]
test eax, eax
jne 0x419323
lea rax, [0x0110afe0]
mov qword [rsp], rax
call fcn.0040e440
add dword [0x0110c000], 2
mov dword [0x0110c004], 0
mov eax, dword [0x0110c000]
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
lea rcx, [0x0110c040]
mov eax, dword [rcx + rax*8 + 0x20]
test eax, eax
jne 0x419308
mov qword [0x0110c0a0], 0
lea rax, [0x0110afe0]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x28]
cmp rax, 2
jne 0x4192ac
lea rax, [0x0110afe0]
mov qword [rsp], rax
call fcn.0040e440
xorps xmm0, xmm0
movsd qword [0x0110c0b8], xmm0
lea rax, [0x0110afe0]
mov qword [rsp], rax
call fcn.0040e630
jmp 0x419272
inc dword [0x010f01b8]
call fcn.0041e060
mov rax, qword [rsp]
cmp rax, 0xffffffffffffffff
jne 0x41926c
call fcn.00420220
mov byte [rsp], 0
call fcn.004202d0
movzx eax, byte [rsp + 8]
test al, al
jne 0x419286
call fcn.00424030
call fcn.004240b0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x010f01a0]
mov qword [rsp], rax
call fcn.0040e440
movzx eax, byte [0x010f01b0]
test al, al
jne 0x4192e1
lea rax, [0x010f01a0]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov byte [0x010f01b0], 0
mov rax, qword [0x010f01a8]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0042d920
jmp 0x4192c7
lea rax, [0x008a745f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042ab20
ud2
lea rax, [0x008b5c82]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004191a0

Function at 0x419700
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41978b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xe0]
cmp edx, 0x20
jae 0x419770
mov rcx, qword [rcx]
cmp rax, rcx
jne 0x419755
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008b0ce6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042ab20
ud2
lea rax, [0x008adf34]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00419700
Function at 0x419d10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419e43
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rax + 0x18]
cmp rcx, rdx
jne 0x419e28
jmp 0x419d59
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
test rcx, rcx
je 0x419da0
je 0x419d76
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419d8b
mov edx, dword [rdx + 0x28]
mov ecx, dword [rcx + 0x28]
cmp edx, ecx
jae 0x419d8b
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0041a180
jmp 0x419d54
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0041a0b0
jmp 0x419d54
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419dae
test rcx, rcx
jmp 0x419d61
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x419e1a
mov rdx, qword [rcx + 8]
cmp rdx, rax
jne 0x419e11
mov qword [rcx + 8], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x18], 0
lea rcx, [0x0110e540]
test byte [rcx], al
mov rcx, qword [0x0110e570]
sub rcx, qword [0x0110e540]
mov qword [0x0110e570], rcx
mov rcx, qword [0x0110e558]
mov qword [rax], rcx
mov qword [0x0110e558], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rcx], 0
jmp 0x419dc8
mov rcx, qword [rsp + 0x20]
mov qword [rcx], 0
jmp 0x419dc8
lea rax, [0x008b4f5e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00419d10

Function at 0x419e50
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419f0d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x30]
test rcx, rcx
je 0x419edf
mov rbx, qword [rcx + 0x20]
test rbx, rbx
je 0x419ef2
mov rsi, qword [rcx + 0x18]
cmp rsi, rdx
jae 0x419ea1
mov rcx, qword [rcx]
jmp 0x419e85
mov qword [rsp + 0x10], rbx
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x419ebd
mov rdi, qword [rsi + 0x18]
cmp rdi, rdx
jb 0x419ebd
mov rcx, rsi
jmp 0x419e85
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00419d10
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008b1e75]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00419e50
Function at 0x41ac10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41ae49
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movzx eax, byte [0x010f1100]
test al, al
jne 0x41ae2e
mov eax, dword [0x0110c000]
mov dword [rsp + 0x28], eax
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
lea rdx, [0x0110c040]
lea rax, [rdx + rax*8]
mov qword [rsp], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 8], rax
call fcn.0041f230
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rcx
xor edx, edx
jmp 0x41ac93
inc rdx
cmp rdx, rax
jge 0x41adb7
mov rbx, qword [rcx + rdx*8]
movzx esi, byte [rbx + 0x64]
cmp sil, 1
jne 0x41ac90
movzx esi, byte [0x01635eee]
test sil, sil
je 0x41ada7
mov rsi, qword [rbx + 0x90]
test rsi, rsi
je 0x41ac90
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rbx
lea rax, [rbx + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x90]
jmp 0x41acf6
mov rcx, qword [rcx]
test rcx, rcx
je 0x41ad85
movzx edx, byte [rcx + 0xa]
cmp dl, 1
jne 0x41acf3
movzx edx, word [rcx + 8]
mov rbx, qword [rax + 0x68]
mov rsi, qword [rax + 0x18]
test rbx, rbx
je 0x41adc1
mov qword [rsp + 0x50], rcx
mov rax, rdx
xor edx, edx
div rbx
imul rax, rbx
lea rcx, [rsi + rax]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 8], rcx
call fcn.0041cc00
mov rcx, qword [rsp + 0x50]
lea rdx, [rcx + 0x10]
lea rbx, [0x00b01129]
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdx
mov qword [rsp + 8], 8
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rdx
call fcn.0041ca60
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
jmp 0x41acf3
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41ac90
mov esi, dword [rbx + 0x58]
mov edi, dword [rsp + 0x28]
cmp esi, edi
jne 0x41adc8
jmp 0x41acba
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004293b0
ud2
mov dword [rsp + 0x2c], esi
call fcn.0042b400
lea rax, [0x0088fa2b]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov eax, dword [rsp + 0x2c]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b660
mov eax, dword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008a36bc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042ab20
ud2
lea rax, [0x008b378e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0041ac10
Function at 0x41daa0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635eee]
test al, al
je 0x41dac8
movzx eax, byte [0x01635ed7]
test al, al
je 0x41db51
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00411620
movzx eax, byte [rsp + 0x10]
mov rcx, qword [rsp + 8]
lock or byte [rcx], al
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0xa0]
test byte [rcx], al
test byte [rax], al
lea rax, [rcx + 0x1270]
test byte [rax], al
mov rdx, qword [rsp + 0x38]
add rdx, qword [rcx + 0x1280]
mov qword [rcx + 0x1280], rdx
mov rdx, qword [rsp + 0x40]
add rdx, qword [rcx + 0x1288]
mov qword [rcx + 0x1288], rdx
movzx ecx, byte [0x01635ed7]
test cl, cl
jne 0x41db46
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
call fcn.0041f880
jmp 0x41db3c
lea rax, [0x008b6fa0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0042ab20
ud2
Function at 0x41e490
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41e56e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rdx + 0xd0]
test ebx, ebx
jne 0x41e4e8
mov ebx, dword [rdx + 0xb8]
test ebx, ebx
jne 0x41e4e8
mov rdx, qword [rdx]
cmp rcx, rdx
jne 0x41e553
mov ecx, dword [0x0110c000]
mov rdx, qword [rsp + 0x30]
mov ebx, dword [rdx + 0x58]
cmp ebx, ecx
je 0x41e549
lea eax, [rcx - 2]
lea ebx, [rcx - 1]
lock cmpxchg dword [rdx + 0x58], ebx
sete bl
test bl, bl
jne 0x41e531
mov dword [rsp + 0x1c], ecx
jmp 0x41e520
call fcn.00429020
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + 0x58]
cmp eax, ecx
jne 0x41e512
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rdx
mov byte [rsp + 8], 0
call fcn.0041e580
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008b21e4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0041e490
Function at 0x420220
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4202c0
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x010f1070]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [0x010f1020]
test rax, rax
jne 0x4202a5
mov qword [0x010f1028], 0
lea rax, [0x010f1078]
mov qword [rsp], rax
lea rax, [0x010f1088]
mov qword [rsp + 8], rax
call fcn.00422b30
lea rax, [0x010f1070]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008b53ff]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00420220
Function at 0x421880
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x421ae0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x60]
add rax, 7
and rax, 0xfffffffffffffff8
shl rax, 0xd
mov qword [rsp + 0x38], rax
cmp rax, 0x100000
jae 0x421ad1
mov ecx, 0x100000
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040f200
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x421a02
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x58]
test byte [rdx], al
lea rbx, [rdx + 0x34d0]
mov qword [rsp], rbx
call fcn.00415d00
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
shr rcx, 0xd
mov qword [rax + 0x20], rcx
mov dword [rax + 0x60], 0
mov qword [rax + 0x68], 0
mov byte [rax + 0x64], 0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x88], xmm0
mov byte [rax + 0x65], 0
mov qword [rax + 0x30], 0
movups xmmword [rax + 0x48], xmm0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x58]
sub rcx, qword [rdx + 0x1328]
shr rcx, 0xd
mov rbx, rcx
jmp 0x421992
mov qword [rdi + rcx*8], rax
inc rcx
mov rsi, qword [rax + 0x20]
add rsi, rbx
cmp rcx, rsi
jae 0x4219b6
mov rsi, qword [rdx + 0x1050]
mov rdi, qword [rdx + 0x1048]
cmp rcx, rsi
jb 0x42198b
jmp 0x421ad9
mov ecx, dword [rdx + 0x1020]
xchg dword [rax + 0x58], ecx
mov byte [rax + 0x64], 1
mov rcx, qword [rdx + 0x10b8]
add rcx, qword [rax + 0x20]
mov qword [rdx + 0x10b8], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov word [rsp + 0x10], 0x100
mov qword [rsp + 0x18], 0
call fcn.00421c20
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
ja 0x421aaf
test rax, rax
jne 0x4218fa
mov qword [rsp + 0x30], rcx
mov rax, qword [0x0163d0f8]
mov qword [rsp + 0x28], rax
call fcn.0042b400
lea rax, [0x008b576f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0089cd26]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00894349]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042bdc0
call fcn.0042b490
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.0040f200
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x38]
jmp 0x421a15
mov rcx, rax
jmp 0x4218cf
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00421880
Function at 0x422740
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4228cf
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jne 0x4227cb
mov rcx, qword [rdx]
cmp rcx, rax
jne 0x4227bf
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rcx, qword [rdx + 8]
cmp rax, rcx
jne 0x4227b2
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rcx + 8], rdx
jmp 0x42279a
mov rcx, qword [rax + 8]
mov rbx, qword [rax]
mov qword [rcx], rbx
jmp 0x422789
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x18], rdx
call fcn.0042b400
lea rax, [0x008b760a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0042bdc0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088e07b]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088e075]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0089883b]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088e063]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008a305c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00422740
Function at 0x4228e0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4229f6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x42295a
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x42295a
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x42295a
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx]
test rdx, rdx
je 0x422954
mov qword [rdx + 8], rax
mov qword [rcx], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx + 8], rax
jmp 0x422943
mov rcx, qword [rax + 8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x10], rdx
call fcn.0042b400
lea rax, [0x008b1c44]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008a304c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004228e0

Function at 0x422a00
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x422b18
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x422a7c
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x422a7c
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x422a7c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x422a77
mov qword [rdx], rax
mov qword [rcx + 8], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx], rax
jmp 0x422a65
mov rcx, qword [rax + 8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x10], rdx
call fcn.0042b400
lea rax, [0x008b3ffd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b660
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008a6d43]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00422a00