joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410730
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x18]
jbe 0x410a17
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4109fc
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x4109a1
lea rdx, [rcx - 1]
test rcx, rdx
jne 0x4109e1
cmp rcx, 0x2000
ja 0x4109c6
cmp rax, 0x10000
jae 0x41097a
mov qword [rsp + 0x18], rcx
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rbx, qword [rdx + 0x30]
inc dword [rbx + 0xd0]
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x41094f
mov rbx, qword [rdx + 0xa0]
test rbx, rbx
je 0x41094f
test byte [rbx], al
add rbx, 0x1238
mov qword [rsp + 0x20], rbx
mov rsi, qword [rbx + 8]
lea rsi, [rcx + rsi - 1]
dec rcx
not rcx
and rcx, rsi
mov qword [rbx + 8], rcx
add rcx, rax
cmp rcx, 0x40000
jbe 0x41093b
mov qword [rsp], 0x40000
lea rax, [0x0163d160]
mov qword [rsp + 8], rax
call fcn.004144c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
test rax, rax
je 0x410919
mov qword [rcx + 8], 0
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov rbx, qword [rsp + 0x48]
lea rsi, [rbx + rdx]
mov qword [rcx + 8], rsi
mov rsi, qword gs:[0x28]
mov rsi, qword [rsi]
mov rdi, qword [rsp + 0x28]
mov r8d, dword [rdi + 0xd0]
lea r9d, [r8 - 1]
mov dword [rdi + 0xd0], r9d
add rax, rdx
cmp r8d, 1
jne 0x41089d
movzx edx, byte [rsi + 0xc0]
test dl, dl
je 0x41089d
mov qword [rsi + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rax
lea rdx, [0x010f00d8]
cmp rcx, rdx
je 0x4108fd
mov rcx, qword [rsp + 0x58]
lea rdx, [0x0163d160]
cmp rcx, rdx
jne 0x4108ce
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
call fcn.00425130
lea rax, [0x0163d160]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.004251e0
mov rax, qword [rsp + 0x30]
jmp 0x4108bf
lea rax, [0x010f00d0]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
jmp 0x4108ae
lea rax, [0x010f00d8]
cmp rcx, rax
jne 0x4109ab
lea rax, [0x010f00d0]
mov qword [rsp], rax
call fcn.0040e630
jmp 0x4109ab
mov rcx, qword [rbx]
test rcx, rcx
je 0x41080f
mov rcx, rbx
jmp 0x410846
lea rax, [0x010f00d0]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x28]
lea rbx, [0x010f00d8]
jmp 0x4107e4
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.004144c0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov ecx, 8
jmp 0x41078e
lea rax, [0x008b0598]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042ab20
ud2
lea rax, [0x008b2f7f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042ab20
ud2
lea rax, [0x008b65bc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0042ab20
ud2
lea rax, [0x008ac971]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0042ab20
ud2
call fcn.00440dc0
jmp fcn.00410730
Function at 0x411730
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41186b
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x0110c308]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jb 0x4117ac
mov rdx, qword [0x0110c310]
cmp rcx, rdx
jae 0x4117ac
sub rcx, rax
mov rax, qword [0x0110c2f8]
mov rdx, rcx
shr rcx, 5
sub rax, rcx
dec rax
mov qword [rsp + 0x38], rax
shr rdx, 3
and rdx, 3
mov dword [rsp + 0x40], edx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x0110c310]
mov qword [rsp + 0x10], rax
call fcn.0042b400
lea rax, [0x008a0fdc]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x008a1821]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088ae5a]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088aeba]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008b2426]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00411730
Function at 0x412300
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x412532
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jne 0x41245f
movzx ecx, byte [rax + 0x17]
test cl, 0x40
jne 0x4123d3
movzx ecx, byte [0x01636824]
test cl, cl
je 0x4123c9
mov rcx, qword [rax + 0x20]
xor edx, edx
xor ebx, ebx
jmp 0x412357
add rdx, 8
mov rsi, qword [rax + 8]
cmp rdx, rsi
jae 0x4123bf
test rdx, 0x3f
jne 0x4123bb
movzx ebx, byte [rcx]
inc rcx
bt ebx, 0
jae 0x412353
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x1c], ebx
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x68]
lea rcx, [rdx + rax]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdx + rbx]
mov rcx, qword [rcx]
mov qword [rsp + 8], rcx
mov qword [rsp], rsi
call fcn.00410d00
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
mov ebx, dword [rsp + 0x1c]
jmp 0x412353
shr ebx, 1
jmp 0x41236f
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rax
call fcn.0044c070
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rcx
call fcn.0042b400
lea rax, [0x008b5797]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042bdc0
lea rax, [0x008a17f4]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008b391a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
mov qword [rsp], rax
call fcn.0044c070
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
call fcn.0042b400
lea rax, [0x008b5797]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042bdc0
lea rax, [0x0089878b]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008a488a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x12
call fcn.0042bdc0
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b391a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
lea rax, [0x008b5e6e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042ab20
ud2
Function at 0x413a70
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x413bb2
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0xd0]
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
movzx edx, byte [rsp + 0x38]
movzx edx, dl
cmp rdx, 0x86
jae 0x413bab
mov rbx, qword [rcx + rdx*8 + 0x28]
movzx esi, word [rbx + 0x60]
mov rdi, qword [rbx + 0x38]
cmp rsi, rdi
jne 0x413b90
mov qword [rsp + 0x18], rax
lea rsi, [0x010f08a0]
cmp rbx, rsi
je 0x413af9
mov byte [rbx + 0x63], 0
mov qword [rsp + 0x10], rdx
shl rdx, 6
lea rcx, [0x0110afe0]
lea rcx, [rcx + rdx + 0x1350]
mov qword [rsp], rcx
call fcn.00413c70
mov rax, qword [rsp + 8]
test rax, rax
je 0x413b75
movzx ecx, word [rax + 0x60]
mov rdx, qword [rax + 0x38]
cmp rcx, rdx
je 0x413b5a
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + rcx*8 + 0x28], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
add dword [rax + 0xd0], 0xffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008a91c4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042ab20
ud2
lea rax, [0x0089e67d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042ab20
ud2
lea rax, [0x008b56a7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00413a70

Function at 0x4140c0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4141d8
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [rsp + 0x30]
mov byte [rax + 0x63], 0
movzx ecx, word [rax + 0x60]
test cx, cx
je 0x4141bd
mov rdx, qword [rax + 0x20]
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x4141b6
shl rdx, 0xd
mov rsi, rax
mov rax, rdx
xor edx, edx
div rbx
movzx ecx, cx
sub eax, ecx
test eax, eax
jg 0x41414f
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], eax
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
call fcn.00422740
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0x10]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
call fcn.004228e0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
neg rax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x68]
imul rcx, rax
lea rdx, [0x0163e800]
lock xadd qword [rdx], rcx
mov rcx, qword [rsp + 0x28]
lock xadd qword [rcx + 0x30], rax
jmp 0x414137
call fcn.004293b0
ud2
lea rax, [0x008b3a5e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004140c0
Function at 0x414530
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4146bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.00428e40
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x414630
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
jmp 0x414612
mov rax, qword [rsp + 0x28]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0x1000
jb 0x4145fc
mov rdx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.00428e40
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x41459f
mov rax, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x41463a
mov rdx, qword [rsp + 0x30]
sub rdx, rax
mov rbx, qword [rsp + 0x40]
lea rcx, [rbx + rax]
mov rax, rdx
test rax, rax
jbe 0x414626
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov rdx, rax
jmp 0x4145b7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004554b0
mov eax, dword [rsp]
mov qword [rsp + 0x38], rax
call fcn.0042b400
lea rax, [0x008aae5a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008ab03a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b1c65]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00414530
Function at 0x4146d0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x414874
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428ea0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
cmp rcx, rax
je 0x4147e5
mov rax, qword [rsp + 0x68]
jmp 0x4147c7
mov rax, qword [rsp + 0x30]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp rax, 0x1000
jb 0x4147b1
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428ea0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x41474b
mov rax, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x4147ef
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rbx, qword [rsp + 0x48]
lea rdx, [rbx + rax]
mov rax, rcx
test rax, rax
jbe 0x4147db
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdx
mov rcx, rax
jmp 0x414763
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004554b0
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0042b400
lea rax, [0x008abc56]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008ab03a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b05b7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004146d0

Function at 0x414880
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.004251e0
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00428e40
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4148e6
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.004554b0
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.0042b400
lea rax, [0x008aae5a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008ab03a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b0fe6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042ab20
ud2
Function at 0x414aa0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x414bdd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00425130
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428ea0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jne 0x414b2f
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004554b0
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
call fcn.0042b400
lea rax, [0x008abc56]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008ab03a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
mov eax, dword [rsp + 0x34]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
mov eax, dword [rsp + 0x34]
cmp eax, 8
je 0x414bc2
cmp eax, 0x5af
je 0x414bc2
lea rax, [0x008b8921]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042ab20
ud2
lea rax, [0x0089e67d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00414aa0
Function at 0x415d00
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x415e6a
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x415e2c
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x415d88
mov rcx, qword [rbx]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add rcx, qword [rax + 0x30]
mov qword [rax + 0x30], rcx
movzx ecx, byte [rax + 0x40]
test cl, cl
jne 0x415d6b
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x28], rbx
mov rax, qword [rax]
mov qword [rsp + 8], rax
mov qword [rsp], rbx
call fcn.00454a70
mov rbx, qword [rsp + 0x28]
jmp 0x415d5c
mov ebx, dword [rax + 0x28]
cmp rbx, rcx
jb 0x415df0
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x415dcd
mov rdx, qword [rax]
add rdx, qword [rax + 0x20]
mov qword [rax + 0x20], rdx
mov edx, dword [rax + 0x28]
mov rbx, qword [rax]
sub edx, ebx
mov dword [rax + 0x28], edx
mov rdx, qword [rax]
add rdx, qword [rax + 0x30]
mov qword [rax + 0x30], rdx
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x20], rcx
mov rbx, qword [rax + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
jmp 0x415d9d
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x10], rcx
mov qword [rsp], 0x4000
mov qword [rsp + 8], 0
call fcn.00410680
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x20], rax
mov dword [rcx + 0x28], 0x4000
mov rax, rcx
jmp 0x415d90
call fcn.0042b400
lea rax, [0x008b9fc5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008aa159]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00415d00
Function at 0x416d30
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x416fa2
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x01635f30]
test eax, eax
je 0x416f87
mov rax, qword [rsp + 0x30]
test byte [rax], al
mov rcx, qword [rax + 0x1258]
test rcx, rcx
je 0x416f74
lea rcx, [rax + 0x1270]
test byte [rcx], al
mov rcx, qword [rax + 0x1270]
test rcx, rcx
je 0x416f6a
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x416f63
mov rcx, qword [rax + 0x1278]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
sete cl
test cl, cl
je 0x416f59
mov rcx, qword [0x010f1020]
test rcx, rcx
jne 0x416f4f
mov ecx, dword [0x010f10a8]
mov edx, dword [0x010f10ac]
cmp ecx, edx
jae 0x416f48
mov ecx, 1
test cl, cl
je 0x416f35
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 0x38]
test byte [rdx], al
mov rdx, qword [rcx + 0x38]
test rdx, rdx
jle 0x416f2e
mov rdx, 0xffffffffffffffff
lock xadd qword [rcx + 0x38], rdx
dec rdx
test rdx, rdx
jl 0x416f23
mov edx, 1
test dl, dl
je 0x416e8e
mov qword [rax + 0x1260], 0
mov rax, qword [rax + 0x1258]
mov qword [rsp + 0x10], rax
mov qword [rsp], rax
movabs rcx, 0x100000004
mov qword [rsp + 8], rcx
call fcn.0042e4a0
movzx eax, byte [0x01112510]
test al, al
jne 0x416e75
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004482f0
jmp 0x416e61
movsd xmm0, qword [rcx + 0x50]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x416e9e
jnp 0x416f10
call fcn.00455830
mov rax, qword [rsp]
sub rax, qword [0x01636d70]
test rax, rax
jle 0x416f09
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x1250]
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
mov rax, qword [rsp + 0x28]
movsd xmm1, qword [rax + 0x50]
ucomisd xmm0, xmm1
ja 0x416ef6
mov qword [rcx + 0x1260], 1
mov rax, rcx
jmp 0x416e32
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x30]
jmp 0x416ee3
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov edx, 1
lock xadd qword [rcx + 0x38], rdx
xor edx, edx
jmp 0x416e23
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ecx, ecx
jmp 0x416de5
mov ecx, 1
jmp 0x416de5
mov ecx, 1
jmp 0x416de5
xor ecx, ecx
jmp 0x416db4
mov ecx, 1
jmp 0x416db4
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008ba735]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00416d30