joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [0x140196cd0]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013ac00
lea r8, [0x1401c5184]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013ac60
mov r8, rbx
lea rcx, [rsp + 0x90]
mov edx, 0x104
call fcn.14013ac60
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x2c0
pop rbx
ret
Function at 0x1400204e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140196d28]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret

Function at 0x1400205b0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140196d10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret

Function at 0x140020680
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140196cf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret
Function at 0x140020750
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140196ce0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret

Function at 0x140020820
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140196d00]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret
Function at 0x140020ef0
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x170]
call fcn.1400219e0
lea r8, [0x14019626c]
mov edx, 0x81
lea rcx, [rsp + 0x280]
call fcn.14013ac00
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x280]
lea r8, [0x14019626c]
mov dword [rsp + 0x20], 0x100
lea rdx, str.alternate_shell
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x12c
xor edi, edi
call fcn.1401348e0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, 0x1000
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140020fbc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, dword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140021078
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14002106f
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.14014a678
test eax, eax
je 0x14002103a
lea rcx, [rsp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140021016
test rax, rax
je 0x140021057
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x6c]
call fcn.14014a678
test eax, eax
jne 0x140021057
mov ecx, dword [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140021057
cmp dword [rsp + 0x30], esi
je 0x14002106b
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140020ff2
jmp 0x14002106f
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140021210
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rax, qword [0x1401fef68]
mov rbx, rcx
cmp dword [rax + 0xe20], 0
je 0x1400212b5
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
test rax, rax
je 0x140021306
xor r9d, r9d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
cmp dword [rsp + 0x48], 0
jne 0x1400212b5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea r8, [0x14019626c]
mov edx, 0x101
mov rcx, rbx
call fcn.14013ac00
cmp byte [rbx], 0
jne 0x1400212aa
mov rcx, qword [0x1401fef68]
cmp dword [rcx + 0xe20], 0
jne 0x1400212aa
mov r9d, 0x101
lea r8, str.Default
mov edx, r9d
mov rcx, rbx
call fcn.14014a54c
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
mov dword [rsp + 0x50], 0x101
call fcn.1400210a0
test al, al
jne 0x14002127d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14002127d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
je 0x140021269
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.processHelper::GetCurrentUser_:_getusername_error__d_n
xor edx, edx
mov r9d, eax
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140021370
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rbx, rax
call fcn.1401348e0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400213f7
nop word [rax + rax]
lea rdx, str.LogonUI.exe
lea rcx, [rsp + 0x4c]
call fcn.14014a3dc
test eax, eax
je 0x140021412
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400213d0
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x270
pop rbx
ret
mov eax, 1
jmp 0x1400213f9
Function at 0x140021d10
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
mov byte [rsp + 0x40], bl
mov rax, qword [rcx + 8]
test rax, rax
jne 0x140021d47
lea r8, str.34F673E0_878F_11D5_B98A_00B0D07B8C7C
xor edx, edx
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x140021d78
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x109d0], rax
test rax, rax
setne bl
mov byte [rsp + 0x40], bl
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400270d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
call fcn.1400219e0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call fcn.140020ef0
test eax, eax
je 0x14002713c
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x28]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
mov rbp, qword [rsp + 0x28]
xor esi, esi
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1400271bd
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140027187
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140133e58
test rax, rax
je 0x14002728a
mov byte [rax], sil
lea rdi, [rbx + 0xd18]
lea r8, [0x14019626c]
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac00
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac60
lea r8, [0x1401c3a08]
jmp 0x1400271dd
lea rdi, [rbx + 0xd18]
lea r8, [0x14019626c]
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac00
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac60
lea r8, str.UltraVNC.ini
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac60
test rbp, rbp
je 0x14002726f
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14002721c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jne 0x14002726f
mov r9d, 0x104
mov r8, rdi
lea rdx, str._TEMP_
mov rcx, rbp
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
lea r8, [0x1401c3a08]
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac60
lea r8, str.UltraVNC.ini
mov edx, 0x104
mov rcx, rdi
call fcn.14013ac60
mov rcx, rbx
call fcn.1400272e0
mov rcx, rbx
call fcn.140027620
jmp 0x140027283
mov rcx, rbx
call fcn.1400272e0
mov rcx, rbx
call fcn.140027620
test esi, esi
jne 0x14002728a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14002729a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400272aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002a280
Capabilities:
Delete service
Query service status

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x14002a2d8
lea r9d, [rax + 0x10]
lea r8, [0x1401c7af8]
lea rdx, str.Failed_to_open_service_control_manager
call fcn.1400208f0
lea eax, [rbx + 1]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x50
pop rbx
ret
mov r8d, 0x10004
mov qword [rsp + 0x60], rdi
lea rdx, [0x1401f0c50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x14002a365
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14002a32e
lea r9d, [rdi + 0x10]
lea r8, [0x1401c7af8]
lea rdx, str.Failed:_Permission_denied
call fcn.1400208f0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [rdi + 1]
jmp 0x14002a400
cmp eax, 0x424
je 0x14002a3dc
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1401c7af8]
lea rdx, str.Failed_to_open_the_service
call fcn.1400208f0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14002a400
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14002a380
lea rdx, str.Failed_to_query_service_status
jmp 0x14002a3c1
cmp dword [rsp + 0x24], 1
mov rcx, rdi
je 0x14002a3b0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002a280
mov eax, 1
jmp 0x14002a400
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14002a3ec
lea rdx, str.Failed_to_delete_the_service
lea r8, [0x1401c7af8]
mov r9d, reloc.WS2_32.dll_recv
call fcn.1400208f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14002a400
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x50
pop rbx
ret

Function at 0x14002a420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSACleanup
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, str._rebootforce
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b0
pop rbx
ret
Function at 0x14002a830
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSACleanup
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, str._rebootsafemode
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b0
pop rbx
ret

Function at 0x14002aa80
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x410
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x400], rax
movzx ebx, cl
mov dword [rsp + 0x140], __WSAFDIsSet
lea rcx, [rsp + 0x140]
movzx edi, dl
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r8d, 0x104
lea rdx, [rsp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x1e0]
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac00
test bl, bl
je 0x14002ab0e
lea r8, str.__preconnect
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac60
test dil, dil
lea rsi, str.__service_run
lea r8, str.__service_rdp_run
mov edx, 0x104
cmove r8, rsi
lea rcx, [0x1401f3d90]
call fcn.14013ac60
lea rcx, [rsp + 0x30]
call fcn.1400219e0
mov r8d, dword [0x1401f3b38]
lea r9, [rsp + 0x30]
lea rdx, str.kickrdp
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [0x1401f3b3c]
lea r9, [rsp + 0x30]
lea rdx, str.clearconsole
mov dword [0x1401f3b38], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x1401f3b3c], eax
lea r9, [rsp + 0x2f0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x14019626c]
lea rdx, str.service_commandline
mov dword [rsp + 0x20], 0x100
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x2f0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14002abd0
test rax, rax
je 0x14002ac68
lea r8, [rsp + 0x1e0]
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac00
test bl, bl
je 0x14002ac17
lea r8, str.__preconnect
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac60
lea r8, [0x1401c8148]
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac60
lea r8, [rsp + 0x2f0]
mov edx, 0x104
lea rcx, [0x1401f3d90]
call fcn.14013ac60
lea rcx, [0x1401f3d90]
mov edx, 0x104
lea r8, str.__service_rdp_run
test dil, dil
jne 0x14002ac63
mov r8, rsi
call fcn.14013ac60
xor eax, eax
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14002c4d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
movsxd rax, edx
mov rcx, qword [rcx + 8]
mov r8d, 8
sub r8d, edx
lea rdx, [rsp + 0x40]
add rdx, rax
mov rcx, qword [rcx + 0x3b0]
call fcn.140087d80
mov edx, dword [rsp + 0x44]
mov edi, edx
and edi, 0xff0000
mov eax, edx
shr eax, 0x10
or edi, eax
mov eax, edx
and eax, 0xff00
shl edx, 0x10
or eax, edx
shr edi, 8
shl eax, 8
or edi, eax
cmp edi, 0xffffffff
jne 0x14002c57e
cmp byte [rbx + 0x20], 0
jne 0x14002c650
lea rax, [rsp + 0x48]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14002cbd0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x14002c650
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp edi, 0xfffffffe
jne 0x14002c5ae
cmp byte [rbx + 0x20], 0
je 0x14002c650
mov rcx, qword [rbx + 0x18]
lea r8d, [rdi + 3]
xor r9d, r9d
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp edi, 0xfffffffd
je 0x14002c650
cmp edi, 0x4000
jg 0x14002c650
test edi, edi
jne 0x14002c5f9
mov rcx, qword [rbx + 0x18]
lea r8, [0x14019626c]
mov edx, 0x475
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov r8d, 0x4000
call fcn.1401348e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov r8d, 0x4000
call fcn.1401348e0
mov rcx, qword [rbx + 8]
mov r8d, edi
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rcx + 0x3b0]
call fcn.140087d80
mov rcx, qword [rbx + 0x18]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov r8, qword [rbx + 0x40]
mov r9d, 0xff
mov rdx, qword [rbx + 0x38]
mov rcx, rbx
call fcn.14002c710
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14002f4e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14002f531
mov edx, 0x5c
lea rcx, [rsp + 0x90]
call fcn.140133e58
test rax, rax
je 0x14002f604
mov byte [rax], 0
lea r8, str.uvnckeyboardhelper.exe
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013ac60
lea rdx, [0x1401c89e8]
lea rcx, [rsp + 0x90]
call fcn.14014aad4
test rax, rax
je 0x14002f604
mov rcx, rax
call fcn.14014ac00
xorps xmm0, xmm0
lea rax, str.runas
xor ecx, ecx
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rax
lea rax, [0x14019626c]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x28], rcx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x14002f604
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret
xor al, al
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x1b8
ret