joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a730
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.DeskDupEngine.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
mov qword [rcx + 0x88], rsi
mov byte [rcx + 0x2d], 1
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
lea edi, [rsi + 4]
mov r8w, 3
mov dx, 1
mov cx, 5
call fcn.140027360
mov ecx, 5
test al, al
cmovne edi, ecx
xor r8d, r8d
xor edx, edx
mov cx, 6
call fcn.140027360
mov ecx, 6
test al, al
cmovne edi, ecx
xor r8d, r8d
lea edx, [rsi + 2]
call fcn.140027360
test al, al
je 0x14001a918
mov dword [rbx + 8], 0xa
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001a845
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140134588
test rax, rax
je 0x14001a929
mov byte [rax], sil
lea r8, str.ddengine64.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14013b390
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x14001a912
lea rdx, str.StartW8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
lea rdx, str.StartW8V2
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.StopW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.LockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.UnlockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
lea rdx, str.ShowCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
lea rdx, str.HideCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
cmp qword [rbx + 0x38], rsi
je 0x14001a912
cmp qword [rbx + 0x48], rsi
je 0x14001a912
cmp qword [rbx + 0x50], rsi
je 0x14001a912
cmp qword [rbx + 0x58], rsi
je 0x14001a912
cmp qword [rbx + 0x60], rsi
je 0x14001a912
test rax, rax
jne 0x14001a91b
mov byte [rbx + 0x2d], sil
jmp 0x14001a91b
mov dword [rbx + 8], edi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x98], rsi
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001aa60
Capabilities:
Print debug messages
Read file via mapping
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x2d], 0
mov edi, r9d
mov rbx, rcx
mov dword [rcx + 0x28], 1
je 0x14001ac12
mov ecx, 0x4e
mov qword [rsp + 0x40], rsi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, dword [rsp + 0x60]
jne 0x14001aaac
cmp esi, edi
jne 0x14001aaac
xor cl, cl
jmp 0x14001aaae
mov cl, 1
mov r9, qword [rbx + 0x40]
mov rsi, qword [rsp + 0x40]
test r9, r9
je 0x14001aaf7
mov eax, 0x3e8
cdq
idiv dword [rsp + 0x70]
movzx edx, byte [rsp + 0x68]
mov r8d, eax
call r9
test al, al
jne 0x14001ab0f
lea r8, str.DeskDupEngine::videoDriver_start_:_DDengine_V2_failed__not_supported_by_video_driver_n
mov edx, 8
lea rcx, vtable.VNCLog.0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140018c00
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14001ab0f
call rax
test al, al
jne 0x14001ab0f
lea r8, str.DeskDupEngine::videoDriver_start_:_DDengine_failed__not_supported_by_video_driver_n
jmp 0x14001aadc
cmp qword [rbx + 0x70], 0
jne 0x14001ac12
xor edx, edx
lea r8, str.3DA76AC7_62E7_44AF_A8D1_45022044BB3E
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x14001ac12
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x14001ac12
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x80], rdi
jne 0x14001ac12
lea r8, str.0E3D996F_B070_4503_9090_198A9DA092D5
xor edx, edx
lea ecx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x14001ac12
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x14001ac12
cmp qword [rbx + 0x90], rdi
jne 0x14001ac12
lea r8, str.3BFBA3A0_2133_48B5_B5BD_E58C72853FFB
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x14001ac12
cmp qword [rbx + 0x98], rdi
jne 0x14001ac12
lea r8, str.3A77E11C_B0B4_40F9_BC8B_D249116A76FE
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x14001ac12
mov rax, qword [rbx + 0x88]
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b4e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov rbx, rdx
lea rax, [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov qword [rsp + 0x68], rdi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b664
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ProductSuite
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b659
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x30], rsi
call fcn.14013268c
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov rsi, rax
lea rdx, str.ProductSuite
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b64c
mov rdi, rsi
cmp byte [rsi], al
je 0x14001b64c
nop word [rax + rax]
lea rdx, str.Terminal_Server
mov rcx, rdi
call fcn.140144f90
test eax, eax
jne 0x14001b5cc
or dword [rbx + 0x130], 0x10
jmp 0x14001b631
lea rdx, [0x1401c3750]
mov rcx, rdi
call fcn.140144f90
test eax, eax
je 0x14001b62a
lea rdx, str.Small_Business
mov rcx, rdi
call fcn.140144f90
test eax, eax
je 0x14001b62a
lea rdx, str.Enterprise
mov rcx, rdi
call fcn.140144f90
test eax, eax
jne 0x14001b60e
or dword [rbx + 0x130], 2
jmp 0x14001b631
lea rdx, str.Personal
mov rcx, rdi
call fcn.140144f90
test eax, eax
jne 0x14001b631
or dword [rbx + 0x130], 0x40
jmp 0x14001b631
or dword [rbx + 0x130], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc rdi
movsxd rcx, eax
add rdi, rcx
cmp byte [rdi], 0
jne 0x14001b5b0
mov rcx, rsi
call fcn.140132640
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14001ea30
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [0x140195ce0]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013b330
lea r8, [0x1401c48ec]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013b390
mov r8, rbx
lea rcx, [rsp + 0x90]
mov edx, 0x104
call fcn.14013b390
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x2c0
pop rbx
ret
Function at 0x140020af0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x1b8
ret

Function at 0x140020bc0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d20]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x1b8
ret

Function at 0x140020c90
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d00]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x1b8
ret
Function at 0x140020d60
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195cf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x1b8
ret

Function at 0x140020e30
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140132620
add rsp, 0x1b8
ret
Function at 0x140021560
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x170]
call fcn.140022050
lea r8, [0x14019528c]
mov edx, 0x81
lea rcx, [rsp + 0x280]
call fcn.14013b330
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x280]
lea r8, [0x14019528c]
mov dword [rsp + 0x20], 0x100
lea rdx, str.alternate_shell
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x12c
xor edi, edi
call fcn.140135010
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, 0x1000
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14002162c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, dword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400216e8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400216df
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.140145828
test eax, eax
je 0x1400216aa
lea rcx, [rsp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140021686
test rax, rax
je 0x1400216c7
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x6c]
call fcn.140145828
test eax, eax
jne 0x1400216c7
mov ecx, dword [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1400216c7
cmp dword [rsp + 0x30], esi
je 0x1400216db
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140021662
jmp 0x1400216df
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140021880
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rax, qword [0x1401fdf80]
mov rbx, rcx
cmp dword [rax + 0xe20], 0
je 0x140021925
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
test rax, rax
je 0x140021976
xor r9d, r9d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
cmp dword [rsp + 0x48], 0
jne 0x140021925
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea r8, [0x14019528c]
mov edx, 0x101
mov rcx, rbx
call fcn.14013b330
cmp byte [rbx], 0
jne 0x14002191a
mov rcx, qword [0x1401fdf80]
cmp dword [rcx + 0xe20], 0
jne 0x14002191a
mov r9d, 0x101
lea r8, str.Default
mov edx, r9d
mov rcx, rbx
call fcn.1401456fc
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
mov dword [rsp + 0x50], 0x101
call fcn.140021710
test al, al
jne 0x1400218ed
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400218ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
je 0x1400218d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.processHelper::GetCurrentUser_:_getusername_error__d_n
xor edx, edx
mov r9d, eax
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400219e0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rbx, rax
call fcn.140135010
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140021a67
nop word [rax + rax]
lea rdx, str.LogonUI.exe
lea rcx, [rsp + 0x4c]
call fcn.14014558c
test eax, eax
je 0x140021a82
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140021a40
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140132620
add rsp, 0x270
pop rbx
ret
mov eax, 1
jmp 0x140021a69
Function at 0x140022380
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
mov byte [rsp + 0x40], bl
mov rax, qword [rcx + 8]
test rax, rax
jne 0x1400223b7
lea r8, str.34F673E0_878F_11D5_B98A_00B0D07B8C7C
xor edx, edx
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400223e8
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x109d0], rax
test rax, rax
setne bl
mov byte [rsp + 0x40], bl
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140027740
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
call fcn.140022050
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call fcn.140021560
test eax, eax
je 0x1400277ac
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x28]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
mov rbp, qword [rsp + 0x28]
xor esi, esi
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x14002782d
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400277f7
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140134588
test rax, rax
je 0x1400278fa
mov byte [rax], sil
lea rdi, [rbx + 0xd18]
lea r8, [0x14019528c]
mov edx, 0x104
mov rcx, rdi
call fcn.14013b330
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.14013b390
lea r8, [0x1401c3148]
jmp 0x14002784d
lea rdi, [rbx + 0xd18]
lea r8, [0x14019528c]
mov edx, 0x104
mov rcx, rdi
call fcn.14013b330
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.14013b390
lea r8, str.UltraVNC.ini
mov edx, 0x104
mov rcx, rdi
call fcn.14013b390
test rbp, rbp
je 0x1400278df
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14002788c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jne 0x1400278df
mov r9d, 0x104
mov r8, rdi
lea rdx, str._TEMP_
mov rcx, rbp
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
lea r8, [0x1401c3148]
mov edx, 0x104
mov rcx, rdi
call fcn.14013b390
lea r8, str.UltraVNC.ini
mov edx, 0x104
mov rcx, rdi
call fcn.14013b390
mov rcx, rbx
call fcn.140027950
mov rcx, rbx
call fcn.140027c90
jmp 0x1400278f3
mov rcx, rbx
call fcn.140027950
mov rcx, rbx
call fcn.140027c90
test esi, esi
jne 0x1400278fa
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14002790a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14002791a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret