joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ef0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401ea6c0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret

Function at 0x140020fc0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401ea6e0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret
Function at 0x1400216f0
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x170]
call fcn.140022180
lea r8, [0x1401e9c5c]
mov edx, 0x81
lea rcx, [rsp + 0x280]
call fcn.140150800
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x280]
lea r8, [0x1401e9c5c]
mov dword [rsp + 0x20], 0x100
lea rdx, str.alternate_shell
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x12c
xor edi, edi
call fcn.14014a5c0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, 0x1000
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400217bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, dword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140021878
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14002186f
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.14015acf8
test eax, eax
je 0x14002183a
lea rcx, [rsp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140021816
test rax, rax
je 0x140021857
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x6c]
call fcn.14015acf8
test eax, eax
jne 0x140021857
mov ecx, dword [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140021857
cmp dword [rsp + 0x30], esi
je 0x14002186b
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400217f2
jmp 0x14002186f
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140021a10
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rax, qword [0x14022a710]
mov rbx, rcx
cmp dword [rax + 0xe20], 0
je 0x140021ab5
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
test rax, rax
je 0x140021b06
xor r9d, r9d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
cmp dword [rsp + 0x48], 0
jne 0x140021ab5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea r8, [0x1401e9c5c]
mov edx, 0x101
mov rcx, rbx
call fcn.140150800
cmp byte [rbx], 0
jne 0x140021aaa
mov rcx, qword [0x14022a710]
cmp dword [rcx + 0xe20], 0
jne 0x140021aaa
mov r9d, 0x101
lea r8, str.Default
mov edx, r9d
mov rcx, rbx
call fcn.14015abcc
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
mov dword [rsp + 0x50], 0x101
call fcn.1400218a0
test al, al
jne 0x140021a7d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140021a7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
je 0x140021a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.processHelper::GetCurrentUser_:_getusername_error__d_n
xor edx, edx
mov r9d, eax
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140021b10
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rbx, rax
call fcn.14014a5c0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140021b97
nop word [rax + rax]
lea rdx, str.LogonUI.exe
lea rcx, [rsp + 0x4c]
call fcn.14015aa5c
test eax, eax
je 0x140021bb2
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140021b70
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x270
pop rbx
ret
mov eax, 1
jmp 0x140021b99
Function at 0x1400224b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
mov byte [rsp + 0x40], bl
mov rax, qword [rcx + 8]
test rax, rax
jne 0x1400224e7
lea r8, str.34F673E0_878F_11D5_B98A_00B0D07B8C7C
xor edx, edx
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x140022518
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x109d0], rax
test rax, rax
setne bl
mov byte [rsp + 0x40], bl
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140027870
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
call fcn.140022180
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400216f0
test eax, eax
je 0x1400278dc
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x28]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
mov rbp, qword [rsp + 0x28]
xor esi, esi
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x14002795d
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140027927
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140149b38
test rax, rax
je 0x140027a2a
mov byte [rax], sil
lea rdi, [rbx + 0xd18]
lea r8, [0x1401e9c5c]
mov edx, 0x104
mov rcx, rdi
call fcn.140150800
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.140150860
lea r8, [0x1401ef4f8]
jmp 0x14002797d
lea rdi, [rbx + 0xd18]
lea r8, [0x1401e9c5c]
mov edx, 0x104
mov rcx, rdi
call fcn.140150800
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.140150860
lea r8, str.ultravnc.ini
mov edx, 0x104
mov rcx, rdi
call fcn.140150860
test rbp, rbp
je 0x140027a0f
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1400279bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jne 0x140027a0f
mov r9d, 0x104
mov r8, rdi
lea rdx, str._TEMP_
mov rcx, rbp
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
lea r8, [0x1401ef4f8]
mov edx, 0x104
mov rcx, rdi
call fcn.140150860
lea r8, str.ultravnc.ini
mov edx, 0x104
mov rcx, rdi
call fcn.140150860
mov rcx, rbx
call fcn.140027a80
mov rcx, rbx
call fcn.140027dc0
jmp 0x140027a23
mov rcx, rbx
call fcn.140027a80
mov rcx, rbx
call fcn.140027dc0
test esi, esi
jne 0x140027a2a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140027a3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140027a4a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002b150
Capabilities:
Check os version
Shutdown system

Disassembly:
sub rsp, 0x108
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14002b1f7
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14002b1f7
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edx, edx
cmp dword [rsp + 0x54], 6
lea ecx, [rdx + 0x12]
jb 0x14002b1f1
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x108
ret

Function at 0x14002b210
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSAStartup
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, str._rebootforce
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b0
pop rbx
ret
Function at 0x14002b620
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSAStartup
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, str._rebootsafemode
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b0
pop rbx
ret

Function at 0x14002b870
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x410
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x400], rax
movzx ebx, cl
mov dword [rsp + 0x140], __WSAFDIsSet
lea rcx, [rsp + 0x140]
movzx edi, dl
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r8d, 0x104
lea rdx, [rsp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x1e0]
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150800
test bl, bl
je 0x14002b8fe
lea r8, str.__preconnect
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150860
test dil, dil
lea rsi, str.__service_run
lea r8, str.__service_rdp_run
mov edx, 0x104
cmove r8, rsi
lea rcx, [0x14021f530]
call fcn.140150860
lea rcx, [rsp + 0x30]
call fcn.140022180
mov r8d, dword [0x14021f2d8]
lea r9, [rsp + 0x30]
lea rdx, str.kickrdp
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [0x14021f2dc]
lea r9, [rsp + 0x30]
lea rdx, str.clearconsole
mov dword [0x14021f2d8], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x14021f2dc], eax
lea r9, [rsp + 0x2f0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x1401e9c5c]
lea rdx, str.service_commandline
mov dword [rsp + 0x20], 0x100
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x2f0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14002b9c0
test rax, rax
je 0x14002ba58
lea r8, [rsp + 0x1e0]
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150800
test bl, bl
je 0x14002ba07
lea r8, str.__preconnect
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150860
lea r8, [0x1401f3d48]
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150860
lea r8, [rsp + 0x2f0]
mov edx, 0x104
lea rcx, [0x14021f530]
call fcn.140150860
lea rcx, [0x14021f530]
mov edx, 0x104
lea r8, str.__service_rdp_run
test dil, dil
jne 0x14002ba53
mov r8, rsi
call fcn.140150860
xor eax, eax
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14002d120
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x20
lea rax, vtable.TextChat.0
mov qword [rcx + 0x18], 0
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], rdx
mov byte [rcx + 0x20], 0
mov byte [rcx + 0x60], 0
mov ecx, 0x4000
call fcn.140147b5c
xor edx, edx
mov qword [rbx + 0x28], rax
mov r8d, 0x4000
mov rcx, rax
call fcn.14014a5c0
mov ecx, 0x4000
call fcn.140147b5c
xor edx, edx
mov qword [rbx + 0x30], rax
mov r8d, 0x4000
mov rcx, rax
call fcn.14014a5c0
mov ecx, 0x4000
call fcn.140147b5c
xor edx, edx
mov qword [rbx + 0x38], rax
mov r8d, 0x4000
mov rcx, rax
call fcn.14014a5c0
mov ecx, 0x80
call fcn.140147b5c
xorps xmm0, xmm0
mov qword [rbx + 0x40], rax
mov ecx, 0x80
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
call fcn.140147b5c
xorps xmm0, xmm0
mov qword [rbx + 0x48], rax
mov ecx, 0x4000
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
call fcn.140147b5c
xor edx, edx
mov qword [rbx + 0x50], rax
mov r8d, 0x4000
mov rcx, rax
call fcn.14014a5c0
mov rcx, qword [rbx + 0x48]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x80
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14002d264
cmp dword [rsp + 0x30], 0x80
jb 0x14002d264
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7c], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7d], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7e], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7f], 0
mov qword [rsp + 0x38], rsi
lea rcx, str.RICHED32.DLL
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x14002d320
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14002d304
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rsi, rax
test rdi, rdi
je 0x14002d320
test rax, rax
je 0x14002d320
cmp rax, rdi
je 0x14002d320
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov r9d, gethostbyname
lea r8, [0x140228240]
lea rdx, [0x140228200]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14002d320
mov r9d, gethostbyname
lea r8, [0x140228240]
lea rdx, [0x140228200]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x68], 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x14002d4e0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
movsxd rax, edx
mov rcx, qword [rcx + 8]
mov r8d, 8
sub r8d, edx
lea rdx, [rsp + 0x40]
add rdx, rax
mov rcx, qword [rcx + 0x3b0]
call fcn.14008b150
mov edx, dword [rsp + 0x44]
mov edi, edx
and edi, 0xff0000
mov eax, edx
shr eax, 0x10
or edi, eax
mov eax, edx
and eax, 0xff00
shl edx, 0x10
or eax, edx
shr edi, 8
shl eax, 8
or edi, eax
cmp edi, 0xffffffff
jne 0x14002d58e
cmp byte [rbx + 0x20], 0
jne 0x14002d660
lea rax, [rsp + 0x48]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14002dbe0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x14002d660
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp edi, 0xfffffffe
jne 0x14002d5be
cmp byte [rbx + 0x20], 0
je 0x14002d660
mov rcx, qword [rbx + 0x18]
lea r8d, [rdi + 3]
xor r9d, r9d
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp edi, 0xfffffffd
je 0x14002d660
cmp edi, 0x4000
jg 0x14002d660
test edi, edi
jne 0x14002d609
mov rcx, qword [rbx + 0x18]
lea r8, [0x1401e9c5c]
mov edx, 0x3fd
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov r8d, 0x4000
call fcn.14014a5c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov r8d, 0x4000
call fcn.14014a5c0
mov rcx, qword [rbx + 8]
mov r8d, edi
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rcx + 0x3b0]
call fcn.14008b150
mov rcx, qword [rbx + 0x18]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov r8, qword [rbx + 0x40]
mov r9d, 0xff
mov rdx, qword [rbx + 0x38]
mov rcx, rbx
call fcn.14002d720
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140030540
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140030591
mov edx, 0x5c
lea rcx, [rsp + 0x90]
call fcn.140149b38
test rax, rax
je 0x140030664
mov byte [rax], 0
lea r8, str.uvnckeyboardhelper.exe
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140150860
lea rdx, [0x1401f45e8]
lea rcx, [rsp + 0x90]
call fcn.14015b398
test rax, rax
je 0x140030664
mov rcx, rax
call fcn.14015b4c4
xorps xmm0, xmm0
lea rax, str.runas
xor ecx, ecx
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rax
lea rax, [0x1401e9c5c]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x28], rcx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140030664
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret
xor al, al
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret
Function at 0x140030680
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r14
push r15
sub rsp, 0x20
mov edi, r8d
movzx esi, dl
movzx ebp, cl
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x1400306cf
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
cmp byte [rax + 0xa], 0
je 0x14003086c
cmp dword [0x14021f634], 0
jne 0x14003086c
cmp dword [0x14021f638], 0
je 0x14003086c
mov dword [0x14021f63c], 0
mov dword [0x14021f634], 2
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
shr r14, 8
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r15d, ax
shr r15, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr rax, 8
mov rbx, qword [0x14021f648]
test rbx, rbx
je 0x14003084c
test r14b, r14b
jne 0x14003075e
test r15b, r15b
jne 0x14003075e
test al, al
je 0x14003084c
mov byte [rsp + 0x58], bpl
mov byte [rsp + 0x59], sil
mov dword [rsp + 0x5c], edi
cmp byte [rbx + 0x23c], 0
je 0x140030860
lea rcx, [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsxd r8, dword [rbx + 0x230]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x38]
call fcn.140149f10
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400307a7
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400307b6
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400307c5
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3e8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400307f3
inc dword [rbx + 0x238]
cmp dword [rbx + 0x238], 3
jle 0x1400307fd
mov byte [rbx + 0x23c], 0
jmp 0x140030827
mov dword [rbx + 0x238], 0
cmp byte [rbx + 0x23c], 0
je 0x140030827
mov edx, 0x3e8
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movsxd r8, dword [rbx + 0x234]
mov rdx, qword [rbx + 0x40]
xor ecx, ecx
call fcn.140149f10
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140030836
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x14021f634], 0
jmp 0x140030880
xor r9d, r9d
mov r8d, edi
movzx edx, sil
movzx ecx, bpl
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14021f634], 0
jmp 0x140030880
xor r9d, r9d
mov r8d, edi
movzx edx, sil
movzx ecx, bpl
call qword [sym.imp.USER32.dll_keybd_event]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret