joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8610
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b86c6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.004b80c0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.004b1120
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
cmp rax, 8
jne 0x4b86a8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8280]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b8610
Function at 0x4b91b0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b92f2
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x19
jne 0x4b9270
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4b92d4
lea rdx, [rbx + rbx*2]
mov rbx, qword [rax + rdx*8 + 8]
mov rsi, qword [rax + rdx*8]
and rcx, 0x1a0
movzx edi, byte [rbx + 0x17]
and edi, 0x1f
or rcx, rdi
movzx esi, byte [rsi]
test sil, 1
je 0x4b9259
mov rax, qword [rax + rdx*8 + 0x10]
mov qword [rsp + 0x48], rbx
shr rax, 1
mov rdx, qword [rsp + 0x30]
add rax, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rsi, qword [rax + rdx*8 + 0x10]
bt esi, 0
jae 0x4b926a
or rcx, 0x40
jmp 0x4b9230
or rcx, 0x20
jmp 0x4b9230
mov qword [rsp + 0x10], rax
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x13
mov eax, dword [0x01636820]
test eax, eax
jne 0x4b92a8
lea rax, [0x008a6643]
mov qword [rdi], rax
jmp 0x4b92b4
lea rax, [0x008a6643]
call fcn.004544a0
mov rax, qword [rsp + 0x10]
mov qword [rdi + 0x10], rax
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f82e0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b91b0
Function at 0x4b93f0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b9618
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x11
jne 0x4b9493
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x40]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4b95fa
mov rax, qword [rax + 0x30]
mov rdx, qword [rax]
imul rbx, rdx
mov rdx, qword [rsp + 0x30]
add rdx, rbx
test rcx, 0x60
je 0x4b948f
mov ebx, 0x20
movzx esi, byte [rax + 0x17]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
and rcx, 0x180
or rbx, rcx
and esi, 0x1f
or rsi, rbx
mov qword [rsp + 0x58], rsi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ebx, ebx
jmp 0x4b9462
cmp rax, 0x17
jne 0x4b94fe
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4b95dc
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x30]
mov rsi, qword [rdx]
imul rbx, rsi
add rbx, qword [rax]
test rcx, 0x60
je 0x4b94fa
mov eax, 0x20
movzx ecx, byte [rdx + 0x17]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rbx
and ecx, 0x1f
or rax, rcx
or rax, 0x180
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
jmp 0x4b94d1
cmp rax, 0x18
jne 0x4b955a
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4b95be
mov rax, qword [rax]
add rax, rbx
test rcx, 0x60
je 0x4b9556
mov ecx, 0x20
mov rdx, qword [0x010ee568]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
or rcx, 0x88
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ecx, ecx
jmp 0x4b952f
mov qword [rsp + 0x10], rax
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x13
mov eax, dword [0x01636820]
test eax, eax
jne 0x4b9592
lea rax, [0x008a6669]
mov qword [rdi], rax
jmp 0x4b959e
lea rax, [0x008a6669]
call fcn.004544a0
mov rax, qword [rsp + 0x10]
mov qword [rdi + 0x10], rax
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8310]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8300]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f82f0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b93f0
Function at 0x4b98a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b9a6a
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x4b99ee
movzx ecx, byte [rsp + 0x68]
test cl, cl
je 0x4b98eb
test rax, 0x60
jne 0x4b9a4c
bt eax, 9
jb 0x4b99a8
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rbx, rax
and rax, 0x1f
cmp rax, 0x14
jne 0x4b9977
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.004ba2e0
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4b9957
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
test rax, rax
je 0x4b9943
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.004b7dd0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x008946e8]
mov qword [rsp], rcx
mov qword [rsp + 8], 9
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.004aea50
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
jmp 0x4b98ff
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x17
mov eax, dword [0x01636820]
test eax, eax
jne 0x4b9a21
lea rax, [0x008aa114]
mov qword [rdi], rax
jmp 0x4b9a2d
lea rax, [0x008aa114]
call fcn.004544a0
mov qword [rdi + 0x10], 0
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8320]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b98a0
Function at 0x4bb220
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4bb3d2
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4bb338
bt eax, 9
jae 0x4bb318
sar rax, 0xa
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x4bb2b8
mov rdx, qword [rcx + 0x38]
mov rbx, qword [rcx + 0x40]
cmp rax, rbx
jae 0x4bb3b4
mov eax, dword [rdx + rax*8 + 4]
mov dword [rsp + 8], eax
mov qword [rsp], rcx
call fcn.004afab0
mov rax, qword [rsp + 0x10]
lea rcx, [0x00904b80]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x20], rax
mov qword [rsp], rcx
call fcn.004afe70
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
cmp rdx, rax
jae 0x4bb396
shl rdx, 4
mov eax, dword [rcx + rdx + 4]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.004afab0
mov rax, qword [rsp + 0x10]
lea rcx, [0x00904b80]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00904b80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x12
mov eax, dword [0x01636820]
test eax, eax
jne 0x4bb36b
lea rax, [0x008a560a]
mov qword [rdi], rax
jmp 0x4bb377
lea rax, [0x008a560a]
call fcn.004544a0
mov qword [rdi + 0x10], 0
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8050]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8390]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004bb220

Function at 0x4bb550
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4bb61d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4bb5a1
mov rax, qword [rsp + 0x30]
bt eax, 8
jae 0x4bb5ff
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x18
mov eax, dword [0x01636820]
test eax, eax
jne 0x4bb5d4
lea rax, [0x008aae2a]
mov qword [rdi], rax
jmp 0x4bb5e0
lea rax, [0x008aae2a]
call fcn.004544a0
mov qword [rdi + 0x10], 0
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8060]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004bb550
Function at 0x4cad00
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4caed0
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x70]
test rax, rax
jl 0x4caeb2
jle 0x4cae80
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
imul rcx, rax
mov rbx, rax
mov rax, rcx
mov rcx, rdx
cmp rbx, 0xffffffffffffffff
je 0x4cad5e
cqo
idiv rbx
jmp 0x4cad63
neg rax
xor edx, edx
cmp rax, rcx
jne 0x4cae94
lea rax, [0x007df620]
mov qword [rsp], rax
imul rbx, rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbx
call fcn.0043d760
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x68]
cmp rax, rbx
jle 0x4cae78
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdx
mov qword [rsp], rdx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454d00
mov rax, qword [rsp + 0x30]
jmp 0x4cadf5
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rax
call fcn.00454d00
mov rax, qword [rsp + 0x30]
shl rax, 1
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jge 0x4cae31
ja 0x4cae8d
mov qword [rsp + 0x30], rax
sub rcx, rax
mov rbx, qword [rsp + 0x40]
sub rbx, rax
neg rbx
sar rbx, 0x3f
and rbx, rax
mov rdi, qword [rsp + 0x48]
add rbx, rdi
cmp rcx, rax
jg 0x4cadda
mov rax, rcx
jmp 0x4cadda
mov qword [rsp], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
call fcn.004412b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbx, rax
jmp 0x4cadb1
mov rcx, qword [rsp + 0x68]
mov rbx, rax
jmp 0x4cad6c
call fcn.00429340
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f87c0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f87b0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004cad00
Function at 0x4dfae0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4dfbf4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e85]
cmp al, 1
jbe 0x4dfb1d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4dfb26
call fcn.00429570
ud2
mov byte [0x01635e85], 1
call fcn.004acaf0
call fcn.0045ed10
call fcn.004a0040
call fcn.004bebd0
call fcn.0045cf30
call fcn.004a1970
lea rax, [0x008b3a3a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eefd0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4dfbe3
mov qword [0x010eefd8], rcx
lea rax, [0x008af036]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eefc0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4dfbd2
mov qword [0x010eefc8], rcx
mov byte [0x01635e85], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eefc8]
mov rax, rcx
call fcn.004544a0
jmp 0x4dfbc1
lea rdi, [0x010eefd8]
mov rax, rcx
call fcn.004544a0
jmp 0x4dfb86
call fcn.00451b80
jmp fcn.004dfae0

Function at 0x4e42c0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e4379
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e81]
cmp al, 1
jbe 0x4e42fd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4e4306
call fcn.00429570
ud2
mov byte [0x01635e81], 1
call fcn.0045ed10
call fcn.004a1970
call fcn.004bebd0
lea rax, [0x008b5bde]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eef50], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4e4368
mov qword [0x010eef58], rcx
mov byte [0x01635e81], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eef58]
mov rax, rcx
call fcn.004544a0
jmp 0x4e4357
call fcn.00451b80
jmp fcn.004e42c0
Function at 0x4e4730
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e4853
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
cmp rax, 0x40
jne 0x4e4835
mov rcx, qword [rsp + 0x30]
xor edx, edx
jmp 0x4e4773
inc rdx
cmp rdx, rax
jge 0x4e4790
movzx ebx, byte [rcx + rdx]
cmp bl, 0xa
je 0x4e4817
cmp bl, 0xd
je 0x4e4817
jmp 0x4e4770
lea rax, [0x00853600]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov dword [rax + 0x140], 0x3d
mov qword [rsp], rax
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
call fcn.00454d00
mov rax, qword [rsp + 0x18]
xor ecx, ecx
jmp 0x4e47e1
mov byte [rax + rcx + 0x40], 0xff
inc rcx
cmp rcx, 0x100
jl 0x4e47d9
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ebx, ebx
jmp 0x4e4803
movzx esi, byte [rdx + rbx]
mov byte [rax + rsi + 0x40], bl
inc rbx
cmp rbx, rcx
jl 0x4e47f8
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7950]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7940]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004e4730

Function at 0x4e4860
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e4945
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00853600]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
lea rdi, [rax + 8]
lea rsi, [rsp + 0x28]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454948
mov rbp, qword [rbp]
mov ecx, dword [rsp + 0x168]
cmp ecx, 0xd
je 0x4e4927
cmp ecx, 0xa
je 0x4e4927
cmp ecx, 0xff
jg 0x4e4927
xor edx, edx
jmp 0x4e48e1
inc rdx
cmp rdx, 0x40
jge 0x4e48f1
movzx ebx, byte [rax + rdx]
cmp ebx, ecx
je 0x4e4909
jmp 0x4e48de
mov dword [rax + 0x140], ecx
mov qword [rsp + 0x170], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7970]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7960]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004e4860
Function at 0x4e6470
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe8]
cmp rax, qword [rcx + 0x10]
jbe 0x4e6662
sub rsp, 0x168
mov qword [rsp + 0x160], rbp
lea rbp, [rsp + 0x160]
movzx eax, byte [0x01635e80]
cmp al, 1
jbe 0x4e64c4
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
jne 0x4e64cd
call fcn.00429570
ud2
mov byte [0x01635e80], 1
call fcn.004e42c0
call fcn.0045ed10
call fcn.004acaf0
lea rax, [0x008bc38d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.004e4730
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x4e664e
mov qword [0x010ed410], rcx
lea rax, [0x008bc3cd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.004e4730
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x4e663a
mov qword [0x010ed418], rcx
mov rax, qword [0x010ed410]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rdi, [rsp + 8]
mov qword [rsp + 0x158], rdi
lea rsi, [rax + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454948
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.004e4860
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x150]
test eax, eax
jne 0x4e6626
mov qword [0x010ed400], rcx
mov rax, qword [0x010ed418]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rsi, [rax + 8]
mov rdi, qword [rsp + 0x158]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454948
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.004e4860
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x150]
test eax, eax
jne 0x4e6615
mov qword [0x010ed408], rcx
mov byte [0x01635e80], 2
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
lea rdi, [0x010ed408]
mov rax, rcx
call fcn.004544a0
jmp 0x4e65fe
lea rdi, [0x010ed400]
mov rax, rcx
call fcn.004544a0
jmp 0x4e65a8
lea rdi, [0x010ed418]
mov rax, rcx
call fcn.004544a0
jmp 0x4e6549
lea rdi, [0x010ed410]
mov rax, rcx
call fcn.004544a0
jmp 0x4e6516
call fcn.00451b80
jmp fcn.004e6470
Function at 0x4f08a0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4f0934
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0x14
jae 0x4f0916
mov rdx, qword [0x010efd58]
mov rbx, qword [0x010efd50]
cmp rcx, rdx
jae 0x4f090f
mov edx, dword [0x01636820]
lea rdi, [rbx + rcx*8]
test edx, edx
jne 0x4f0903
mov rax, qword [rsp + 0x28]
mov qword [rbx + rcx*8], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x28]
call fcn.004544a0
jmp 0x4f08f9
call fcn.004292d0
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7640]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004f08a0

Function at 0x4f50f0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4f51a4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e68]
cmp al, 1
jbe 0x4f512d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4f5136
call fcn.00429570
ud2
mov byte [0x01635e68], 1
call fcn.0045ed10
call fcn.004514e0
lea rax, [0x008b3d63]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eecf0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4f5193
mov qword [0x010eecf8], rcx
mov byte [0x01635e68], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eecf8]
mov rax, rcx
call fcn.004544a0
jmp 0x4f5182
call fcn.00451b80
jmp fcn.004f50f0

Function at 0x4f7b70
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4f7c33
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e66]
cmp al, 1
jbe 0x4f7bad
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4f7bb6
call fcn.00429570
ud2
mov byte [0x01635e66], 1
call fcn.004f50f0
call fcn.004acaf0
lea rax, [0x008b3d63]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eece0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4f7c22
mov qword [0x010eece8], rcx
call fcn.004f5510
movzx eax, byte [rsp]
mov byte [0x01635e67], al
mov byte [0x01635e66], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eece8]
mov rax, rcx
call fcn.004544a0
jmp 0x4f7c02
call fcn.00451b80
jmp fcn.004f7b70
Function at 0x4faef0
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4fb02c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
xor eax, eax
jmp 0x4fb00c
mov rbx, qword [rsp + 0x28]
mov r8, rbx
shl rbx, 8
lea r9, [0x016380c0]
add rbx, r9
mov dword [rbx + rdx*4], eax
lea rdx, [rdi + 1]
mov rax, r8
mov rcx, rsi
cmp rdx, 0x10
jge 0x4faff4
mov qword [rsp + 0x30], rdx
mov rbx, rax
shl rax, 6
lea rsi, [0x00b09680]
add rax, rsi
shl rcx, 4
add rax, rcx
movzx eax, byte [rax + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and rax, r8
mov qword [rsp], rax
lea rax, [0x00b02080]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.004fae90
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, rdx
and rdx, 2
shl rdx, 4
mov rsi, rbx
and rbx, 1
or rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shl rbx, 1
or edx, ebx
mov rbx, rax
shl rax, 1
shr rbx, 0x1f
or rax, rbx
movzx edx, dl
cmp rdx, 0x40
jb 0x4faf1f
jmp 0x4fb025
inc rcx
cmp rcx, 4
jge 0x4fb009
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x4faf42
inc rax
cmp rax, 8
jge 0x4fb01b
mov qword [rsp + 0x28], rax
xor ecx, ecx
jmp 0x4faff7
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.004faef0

Function at 0x506d50
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x506e09
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e82]
cmp al, 1
jbe 0x506d8d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x506d96
call fcn.00429570
ud2
mov byte [0x01635e82], 1
call fcn.0046a650
call fcn.004dfae0
call fcn.0045ed10
lea rax, [0x008b2ca0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eef60], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x506df8
mov qword [0x010eef68], rcx
mov byte [0x01635e82], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eef68]
mov rax, rcx
call fcn.004544a0
jmp 0x506de7
call fcn.00451b80
jmp fcn.00506d50