joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014b30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14010bfe8]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x140014b91
cmp byte [rbx + 0x4d4e], 0
jne 0x140014b91
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003520
test dil, 2
je 0x140014cbf
jmp 0x140014c1a
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5eb8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140049158]
mulss xmm1, dword [0x14004914c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x1400490e0]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
call fcn.140003520
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140014c70
lea r11, [0x140043b50]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140014c53
cmp byte [r8], r9b
jne 0x140014c53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014c40
not ecx
call fcn.14000b300
test rax, rax
je 0x140014cbf
cmp byte [rax + 0xbe], 0
je 0x140014cbf
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.140003520
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14000e010
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003f830
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140019b30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
lea rbx, [rcx + 0x6018]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140019bd7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140019b8a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c260
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400040e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6020]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14010bfe0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140019bdf
mov rcx, rbx
call fcn.1400040e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140019f00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x14010bfe8]
xor ebp, ebp
cmp byte [rbx + 0x5f68], bpl
jne 0x140019fdf
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140019fd8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1400039a0
mov rsi, rax
test rax, rax
je 0x140019fd8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140019f64
mov rcx, rax
call fcn.14001a130
mov r8, qword [0x14010bfe8]
test r8, r8
je 0x140019fcf
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140019fc4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f68], 1
movss xmm0, dword [rbx + 0x5f6c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001a06e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f6c], xmm0
jb 0x14001a06e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001a061
mov rax, qword [0x14010bfe8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f6c], ebp
call fcn.14001a390
lea rdx, [0x140043664]
mov rcx, rdi
mov rsi, rax
call fcn.1400037f0
mov rdi, rax
test rax, rax
je 0x14001a068
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001a068
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f6c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a090
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14010bfe8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001a0f3
mov qword [rsp], rbx
lea rbx, [0x140043b50]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001a0d3
cmp byte [r8], r9b
jne 0x14001a0d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001a0c0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001a11f
cmp dword [r8 + 8], eax
je 0x14001a126
add r8, 0x48
cmp r8, rcx
jne 0x14001a110
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14002ef80
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x14010bfe8]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002f19e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002f19e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x14010bfe8]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x14002f054
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x14002f049
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x14002f071
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x14002f074
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140048b58]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x14002f0b7
mov rsi, qword [r8 + 0x90]
jmp 0x14002f0ba
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14002f0e5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x14010bfe8]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14002f15e
inc rbx
cmp rbx, 5
jl 0x14002f140
jmp 0x14002f18a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14002f1a0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003f830
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x140039f50
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140039fa2
xor r9d, r9d
lea r8, str.Inject_Error
lea rdx, str.Run_GTA5_first_before_injecting_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140039faf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rbp, rax
jb 0x140039ff4
mov rcx, qword [rdi]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x14003a000
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp qword [rdi + 0x18], 0x10
mov r9, rbx
mov r14, rax
jb 0x14003a045
mov rcx, qword [rdi]
inc r9
cmp byte [rcx + r9], 0
jne 0x14003a036
mov r8, rcx
jmp 0x14003a052
inc r9
cmp byte [rdi + r9], 0
jne 0x14003a045
mov r8, rdi
xor r15d, r15d
inc r9
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140048ec8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x14003a0c1
mov rax, qword [rdi]
cmp byte [rax + rbx + 1], r15b
lea rbx, [rbx + 1]
jne 0x14003a0c1
lea r8, [rbx + 1]
mov r9d, 0x8000
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14003a118
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14003a113
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a18d
mov rcx, r8
call fcn.14003f9cc
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003a15d
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14003a158
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a18d
mov rcx, r8
call fcn.14003f9cc
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003f830
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400403dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140040426
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140040426
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140040426
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140040426
cmp dword [rcx + 0x84], 0xe
jbe 0x140040426
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140040428
xor al, al
add rsp, 0x28
ret
Function at 0x401070
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4011a4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x401186
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x4010eb
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x4010a6
mov rcx, qword [rsp + 0x38]
cmp rdx, rcx
jne 0x401168
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 8], rcx
add rax, 8
mov qword [rsp], rax
call fcn.00402270
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00437b90
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0xffffffffffffffff
call fcn.004022d0
movzx eax, byte [rsp + 0x18]
test al, al
jne 0x401125
call fcn.00437bc0
mov rax, qword [rsp + 0x30]
jmp 0x4010a6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 8]
mov qword [rsp], rcx
call fcn.00402270
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00402270
call fcn.00437bc0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8830]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8820]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.00401070
Function at 0x402de0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40303e
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rdx, qword [rcx]
cmp rdx, 0x10000
jae 0x403023
movzx ebx, byte [rcx + 0x15]
cmp bl, 8
ja 0x403008
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jl 0x402fea
cmp rdx, 0x21
jae 0x402fd0
lea rax, [0x00b073a0]
mov rax, qword [rax + rdx*8]
cmp rbx, rax
ja 0x402fea
mov rax, rdx
imul rdx, rbx
movabs rsi, 0x7ffffff9f
cmp rdx, rsi
ja 0x402fea
mov qword [rsp + 0x20], rcx
test rbx, rbx
jne 0x402f03
mov qword [rsp], 0x60
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov rax, qword [rsp + 0x18]
test byte [rax], al
mov ecx, dword [0x01636820]
lea rdi, [rax + 0x10]
test ecx, ecx
jne 0x402efc
mov qword [rax + 0x10], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov word [rax + 0x18], dx
mov edx, dword [0x01636820]
lea rdi, [rax + 0x20]
test edx, edx
jne 0x402eec
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, rax
mov rax, rcx
call fcn.004544a0
mov rax, rdx
jmp 0x402ed4
call fcn.004544a0
jmp 0x402eb6
test rax, rax
je 0x402e82
movzx eax, byte [rcx + 0x17]
test al, 0x80
je 0x402f64
lea rax, [rdx + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov rax, qword [rsp + 0x18]
test byte [rax], al
mov ecx, dword [0x01636820]
lea rdi, [rax + 0x10]
lea rdx, [rax + 0x60]
test ecx, ecx
jne 0x402f51
mov qword [rax + 0x10], rdx
jmp 0x402eb6
mov rcx, rax
mov rax, rdx
call fcn.004544a0
mov rax, rcx
jmp 0x402eb6
lea rax, [0x008715e0]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov rbx, qword [rsp + 0x48]
imul rdx, rbx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 1
call fcn.0040f6d0
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x28]
lea rdi, [rcx + 0x10]
mov rdx, qword [rsp + 0x18]
test eax, eax
jne 0x402fc6
mov qword [rcx + 0x10], rdx
mov rax, rcx
jmp 0x402eb6
mov rax, rdx
call fcn.004544a0
jmp 0x402fbe
movabs rax, 0x7ffffffff
mov rsi, rdx
xor edx, edx
div rsi
mov rdx, rsi
jmp 0x402e51
lea rax, [0x008013e0]
mov qword [rsp], rax
lea rax, [0x008f8480]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x008a9f31]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
lea rax, [0x008b456e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00402de0
Function at 0x406ca0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x406ebf
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x406e8e
mov rcx, qword [rax]
test rcx, rcx
je 0x406e8e
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x406ea4
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx]
mov esi, dword [rax + 0xc]
mov qword [rsp + 8], rsi
mov rsi, qword [rsp + 0x58]
mov qword [rsp], rsi
mov rdi, qword [rdx]
call rdi
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x50]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x48]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x406d86
movzx r9d, byte [rdx + 8]
test r9b, 8
je 0x406e86
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
test byte [rbx], al
movzx edi, byte [r8 + rdi]
dec edi
cmp dil, 3
jae 0x406e7e
shr rax, 0x38
cmp al, 4
jae 0x406d91
add eax, 4
mov byte [rsp + 0x1f], al
jmp 0x406e57
inc rdx
cmp rdx, 8
jae 0x406e4b
movzx ebx, byte [rdx + rcx]
cmp al, bl
jne 0x406d9a
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
movzx edi, byte [rsi + 0x51]
lea rcx, [rbx + rcx + 8]
test dil, dil
je 0x406dcd
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x406e08
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
jmp 0x406d9a
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x52]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
movzx eax, byte [rax + 0x53]
mov rdx, qword [rsp + 0x30]
lea rcx, [rdx + rcx + 8]
test al, al
je 0x406e46
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
jmp 0x406e37
movzx ebx, word [rsi + 0x54]
lea rbx, [rcx + rbx - 8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x406e68
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x406d9d
lea rax, [0x016374e0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
jmp 0x406d86
shr rbx, 1
jmp 0x406d68
lea rax, [0x016374e0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00406ca0
Function at 0x406ed0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4070fe
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x4070c8
mov rcx, qword [rax]
test rcx, rcx
je 0x4070c8
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x4070e3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx]
mov esi, dword [rax + 0xc]
mov qword [rsp + 8], rsi
mov rsi, qword [rsp + 0x58]
mov qword [rsp], rsi
mov rdi, qword [rdx]
call rdi
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x50]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x48]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
add rcx, qword [rdx + 0x10]
mov r8, qword [rdx + 0x18]
test r8, r8
je 0x406fb6
movzx r9d, byte [rdx + 8]
test r9b, 8
je 0x4070c0
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
test byte [rbx], al
movzx edi, byte [r8 + rdi]
dec edi
cmp dil, 3
jae 0x4070b8
shr rax, 0x38
cmp al, 4
jae 0x406fc1
add eax, 4
mov byte [rsp + 0x1f], al
jmp 0x40708c
inc rdx
cmp rdx, 8
jae 0x407080
movzx ebx, byte [rdx + rcx]
cmp al, bl
jne 0x406fca
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
movzx edi, byte [rsi + 0x51]
lea rcx, [rbx + rcx + 8]
test dil, dil
je 0x406ffd
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x407038
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
jmp 0x406fca
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x52]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
movzx eax, byte [rax + 0x53]
mov rdx, qword [rsp + 0x30]
lea rcx, [rdx + rcx + 8]
test al, al
je 0x40707b
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
jmp 0x407067
movzx ebx, word [rsi + 0x54]
lea rbx, [rcx + rbx - 8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x40709d
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x406fcd
lea rax, [0x016374e0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
jmp 0x406fb6
shr rbx, 1
jmp 0x406f98
lea rax, [0x016374e0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x008b177f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00406ed0