joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409210
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4093ad
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40937c
mov rcx, qword [rax]
test rcx, rcx
je 0x40937c
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x409392
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x4092e3
mov rax, qword [rax + 0x10]
jmp 0x4092c0
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x4092ad
mov ebx, dword [rcx]
mov esi, dword [rsp + 0x38]
cmp ebx, esi
jne 0x40926d
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x40926d
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x4092cd
lea rcx, [rax + 8]
xor edx, edx
jmp 0x409274
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x40936a
movzx edx, byte [rdx + 8]
test dl, 8
je 0x409377
and rbx, rax
imul rbx, rdi
lea rax, [r8 + rbx]
test byte [rax], al
movzx edx, byte [rbx + r8]
dec edx
cmp dl, 3
jae 0x409372
mov rax, rcx
jmp 0x4092c0
mov rcx, rax
jmp 0x40936a
shr rbx, 1
jmp 0x409351
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00409210
Function at 0x4093c0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x409570
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40953a
mov rcx, qword [rax]
test rcx, rcx
je 0x40953a
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x409555
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x4094a1
mov rax, qword [rax + 0x10]
jmp 0x409479
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x409466
mov ebx, dword [rcx]
mov esi, dword [rsp + 0x38]
cmp ebx, esi
jne 0x409421
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x409421
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x409486
lea rcx, [rax + 8]
xor edx, edx
jmp 0x409428
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x409528
movzx edx, byte [rdx + 8]
test dl, 8
je 0x409535
and rbx, rax
imul rbx, rdi
lea rax, [r8 + rbx]
test byte [rax], al
movzx edx, byte [rbx + r8]
dec edx
cmp dl, 3
jae 0x409530
mov rax, rcx
jmp 0x409479
mov rcx, rax
jmp 0x409528
shr rbx, 1
jmp 0x40950f
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004093c0
Function at 0x409580
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x409720
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x4096ef
mov rcx, qword [rax]
test rcx, rcx
je 0x4096ef
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x409705
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x409656
mov rax, qword [rax + 0x10]
jmp 0x409633
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x409620
mov rbx, qword [rcx]
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
jne 0x4095dd
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x4095dd
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x409640
lea rcx, [rax + 8]
xor edx, edx
jmp 0x4095e4
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x4096dd
movzx edx, byte [rdx + 8]
test dl, 8
je 0x4096ea
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
test byte [rax], al
movzx edx, byte [r8 + rdi]
dec edx
cmp dl, 3
jae 0x4096e5
mov rax, rcx
jmp 0x409633
mov rcx, rax
jmp 0x4096dd
shr rbx, 1
jmp 0x4096c4
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00409580
Function at 0x409730
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4098e3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x4098ad
mov rcx, qword [rax]
test rcx, rcx
je 0x4098ad
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x4098c8
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x409814
mov rax, qword [rax + 0x10]
jmp 0x4097ec
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x4097d9
mov rbx, qword [rcx]
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
jne 0x409791
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x409791
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x4097f9
lea rcx, [rax + 8]
xor edx, edx
jmp 0x409798
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x40989b
movzx edx, byte [rdx + 8]
test dl, 8
je 0x4098a8
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
test byte [rax], al
movzx edx, byte [r8 + rdi]
dec edx
cmp dl, 3
jae 0x4098a3
mov rax, rcx
jmp 0x4097ec
mov rcx, rax
jmp 0x40989b
shr rbx, 1
jmp 0x409882
lea rax, [0x016374e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00409730
Function at 0x40cb10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40cc61
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov eax, dword [rax + 0xb8]
test eax, eax
jne 0x40cc46
mov rax, qword [0x010e3358]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rbx, rdx
shr rdx, 2
lea rdx, [rdx + rdx*2]
cmp rcx, rdx
jae 0x40cb95
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0040cc70
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x20], rax
shl rbx, 1
lea rax, [rbx + 2]
shl rax, 3
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
shl rdx, 1
mov qword [rax], rdx
lea rdx, [0x00455910]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov qword [rsp], rdx
call fcn.0040e210
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 8]
cmp rcx, rdx
jne 0x40cc2b
lea rcx, [0x010e3358]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004021e0
mov rax, qword [0x010e3358]
jmp 0x40cb78
lea rax, [0x008b4d15]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042ab20
ud2
lea rax, [0x008a25c8]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0040cb10

Function at 0x40e290
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40e3e7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 8]
inc rdx
mov qword [rcx + 8], rdx
mov rbx, rcx
shl rcx, 0x10
mov rsi, rdx
and rdx, 0x7ffff
or rcx, rdx
mov rdx, rcx
sar rcx, 0x13
shl rcx, 3
cmp rcx, rbx
jne 0x40e312
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rcx]
mov qword [rbx], rsi
mov rax, rsi
lock cmpxchg qword [rcx], rdx
sete sil
test sil, sil
je 0x40e2f1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x20], rcx
call fcn.0042b400
lea rax, [0x008b7184]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088c800]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x00892044]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089432e]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042bdc0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x0089bfaa]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0040e290
Function at 0x40e7b0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40e8f7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
cmp rax, rdx
jne 0x40e8dc
mov qword [rsp + 0x18], rax
mov qword [rsp], rcx
call fcn.00428900
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x20], rcx
mov rdx, rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
lock cmpxchg qword [rbx], rcx
sete al
test al, al
je 0x40e8ae
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x010e3350]
mov rax, qword [rax]
test rax, rax
jne 0x40e87d
jmp 0x40e89a
mov qword [rsp], 0x989680
call fcn.00428770
mov rax, qword [0x010e3350]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00453280
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
test rax, rax
je 0x40e84a
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00428770
mov rdx, qword [rsp + 0x18]
jmp 0x40e885
mov rax, qword [rbx]
cmp rax, 1
jne 0x40e8c1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x008aed44]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042ab20
ud2
lea rax, [0x008a655f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0040e7b0
Function at 0x40e910
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rdx
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40eb29
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x38]
test rax, rax
jge 0x40e9d8
mov rax, qword [rcx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x010e3350]
mov rax, qword [rax]
test rax, rax
jne 0x40e995
jmp 0x40e9c9
mov rax, qword [0x010e3350]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00453280
mov qword [rsp], 0x989680
call fcn.00428770
mov eax, dword [rsp + 8]
test eax, eax
jl 0x40e979
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00428770
jmp 0x40e9aa
call fcn.00455830
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x40e9f3
mov rax, rdx
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x30]
mov byte [rbx + 0xe5], 1
mov rbx, qword [0x010e3350]
mov rbx, qword [rbx]
test rbx, rbx
je 0x40ea20
cmp rcx, 0x989680
jle 0x40ea20
mov ecx, 0x989680
mov qword [rsp], rcx
call fcn.00428770
mov eax, dword [rsp + 8]
test eax, eax
jge 0x40eb0a
mov rax, qword [0x010e3350]
mov rax, qword [rax]
test rax, rax
jne 0x40eaf3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00455830
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40e9f0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rsi, rbx
jne 0x40eaae
mov rax, rbx
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete bl
test bl, bl
je 0x40ea7f
mov byte [rsp + 0x50], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rbx, 1
jne 0x40eb5c
mov byte [rdi + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
call fcn.00428770
mov eax, dword [rsp + 8]
test eax, eax
jl 0x40eb41
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00453280
jmp 0x40ea48
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
cmp rax, 1
jne 0x40eb77
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008b9629]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0042ab20
ud2
lea rax, [0x008b8f00]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042ab20
ud2
lea rax, [0x008afb4a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042ab20
ud2
Function at 0x40f200
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40f45d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
test byte [rax], al
mov rcx, qword [rax + 0x1340]
mov rdx, qword [rax + 0x1338]
mov rbx, rcx
sub rcx, rdx
mov rdx, qword [rsp + 0x58]
cmp rdx, rcx
jbe 0x40f288
lea rcx, [rdx + 0x10001fff]
and rcx, 0xfffffffff0000000
lea rsi, [rcx + rbx]
cmp rbx, rsi
ja 0x40f288
mov rbx, qword [rax + 0x1328]
mov rdi, rsi
sub rsi, rbx
lea rbx, [rsi - 1]
movabs rsi, 0x7ffffffff
cmp rbx, rsi
jbe 0x40f337
mov rcx, qword [rax + 0x1340]
mov rbx, qword [rax + 0x1338]
sub rcx, rbx
cmp rdx, rcx
jbe 0x40f2b1
mov qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rbx
movzx ecx, byte [rax + 0x1348]
mov byte [rsp + 0x10], cl
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
lea rbx, [0x0163d0f8]
mov qword [rsp + 0x18], rbx
call fcn.00414aa0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x1338]
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x1338], rcx
mov rdx, qword [rax + 0x1330]
cmp rcx, rdx
ja 0x40f322
mov rax, qword [rsp + 0x38]
test rax, 0x1fff
jne 0x40f442
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rcx
mov qword [rsp], rax
mov byte [rsp + 0x10], 1
call fcn.00420aa0
jmp 0x40f302
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x27], 0
mov rdx, qword [rax + 0x1340]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
lea rdx, [rsp + 0x27]
mov qword [rsp + 0x10], rdx
call fcn.004149c0
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x40f29e
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x1340]
cmp rax, rdx
jne 0x40f3a8
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x1340], rax
movzx eax, byte [rsp + 0x27]
mov byte [rcx + 0x1348], al
mov rax, rcx
mov rdx, qword [rsp + 0x58]
jmp 0x40f288
mov rbx, qword [rcx + 0x1328]
cmp rbx, rax
ja 0x40f43b
mov rsi, qword [rsp + 0x30]
lea rdi, [rax + rsi]
mov r8, rdi
sub rdi, rbx
lea rbx, [rdi - 1]
movabs rdi, 0x7ffffffff
cmp rbx, rdi
ja 0x40f414
mov rbx, qword [rcx + 0x1338]
sub rdx, rbx
cmp rdx, 0x1000000
jae 0x40f414
mov qword [rcx + 0x1340], r8
add rax, 0x1fff
and rax, 0xffffffffffffe000
mov qword [rcx + 0x1338], rax
movzx eax, byte [rsp + 0x27]
mov byte [rcx + 0x1348], al
jmp 0x40f39b
mov qword [rsp + 0x28], rsi
mov qword [rsp], rax
mov qword [rsp + 8], rsi
lea rax, [rsp + 0x28]
mov qword [rsp + 0x10], rax
call fcn.00414880
mov rcx, qword [rsp + 0x50]
jmp 0x40f39b
mov rsi, qword [rsp + 0x30]
jmp 0x40f414
lea rax, [0x008b4d3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0040f200
Function at 0x40f470
Capabilities:
Get geographical location
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40f6c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test byte [rax], al
movzx ecx, byte [rsp + 0x60]
movzx edx, cl
cmp rdx, 0x86
jae 0x40f6bf
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rcx
call fcn.004114a0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40f596
movzx eax, word [rcx + 0x60]
movzx ecx, ax
cmp rcx, rdx
jne 0x40f63a
lea rax, [0x0044eb90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
movzx ecx, byte [rsp + 0x60]
mov byte [rsp + 0x40], cl
lea rcx, [rsp + 0x30]
mov qword [rsp], rcx
call fcn.00451a20
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax*8 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp], rax
call fcn.004114a0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov edx, 1
mov rbx, qword [rcx + 0x38]
cmp rax, rbx
jae 0x40f61f
mov rbx, qword [rcx + 0x68]
imul rax, rbx
lea rbx, [rcx + 0x18]
add rax, qword [rbx]
movzx ebx, word [rcx + 0x60]
inc ebx
mov word [rcx + 0x60], bx
movzx esi, bx
mov rdi, qword [rcx + 0x38]
cmp rsi, rdi
ja 0x40f59a
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x78], dl
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor edx, edx
jmp 0x40f54c
mov word [rsp + 0x16], bx
mov qword [rsp + 0x18], rdi
call fcn.0042b400
lea rax, [0x008a0fea]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00898825]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008aa1b5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
lea rax, [0x008a8e54]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042ab20
ud2
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x16], ax
call fcn.0042b400
lea rax, [0x008aa19e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042bdc0
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00898825]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b8f31]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.0040f470
Function at 0x4102d0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4103b9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
cmp rcx, 1
je 0x41036c
test rcx, rcx
jl 0x41039b
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rdx]
cmp rbx, 0x21
jae 0x410355
lea rax, [0x00b073a0]
mov rax, qword [rax + rbx*8]
cmp rcx, rax
ja 0x41039b
imul rbx, rcx
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
movabs rax, 0x7ffffffff
mov rsi, rdx
xor edx, edx
div rbx
mov rdx, rsi
jmp 0x410325
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008013e0]
mov qword [rsp], rax
lea rax, [0x008f84e0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004102d0