joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d9e3b4f40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.2d9e3e4414
mov rdi, rax
test rax, rax
jne 0x2d9e3b4f76
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [rdi], 0x5c
mov rbx, rdi
jne 0x2d9e3b4ff5
cmp word [rdi + 2], 0x5c
jne 0x2d9e3b4ff5
movzx eax, word [rdi + 4]
lea rcx, [rdi + 4]
test ax, ax
je 0x2d9e3b4fb7
nop
cmp ax, 0x5c
je 0x2d9e3b4fb7
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x2d9e3b4fa0
cmp word [rcx], 0
lea rax, [rcx + 2]
cmove rax, rcx
cmp word [rax], 0
je 0x2d9e3b4fe7
movzx ecx, word [rax]
nop dword [rax]
cmp cx, 0x5c
je 0x2d9e3b4fe7
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rax]
test cx, cx
jne 0x2d9e3b4fd0
cmp word [rax], 0
lea rbx, [rax + 2]
cmove rbx, rax
jmp 0x2d9e3b500b
cmp word [rdi + 2], 0x3a
jne 0x2d9e3b500b
cmp word [rdi + 4], 0x5c
lea rbx, [rdi + 4]
jne 0x2d9e3b500b
add rbx, 2
cmp word [rbx], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
je 0x2d9e3b5078
xor ebp, ebp
mov esi, 0x5c
cmp word [rbx], si
jne 0x2d9e3b5067
mov rcx, rdi
mov word [rbx], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x2d9e3b5060
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2d9e3b5064
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2d9e3b5064
mov rcx, rdi
call fcn.2d9e3e4124
xor al, al
jmp 0x2d9e3b5082
test al, 0x10
je 0x2d9e3b5054
mov word [rbx], si
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp word [rax], bp
jne 0x2d9e3b5022
mov rcx, rdi
call fcn.2d9e3e4124
mov al, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x2d9e3b50a0
Capabilities:
Enumerate network shares

Disassembly:
push rdi
sub rsp, 0x50
mov edx, 1
mov dword [rsp + 0x68], 0x4000
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], 0xffffffff
xor edi, edi
mov qword [rsp + 0x20], rax
mov ecx, edx
mov qword [rsp + 0x70], rdi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
je 0x2d9e3b50e6
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x48], rbp
mov edx, 0x400
mov ecx, 0x40
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [rsp + 0x68]
mov ecx, 0x40
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x2d9e3b512a
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
nop dword [rax]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
mov r8, r15
lea rdx, [rsp + 0x60]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x2d9e3b5205
xor esi, esi
cmp dword [rsp + 0x60], esi
jbe 0x2d9e3b5140
nop dword [rax + rax]
lea r14, [rsi + rsi*2]
shl r14, 4
add r14, r15
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
lea eax, [rax + 1]
lea ebx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rbx, rax
jbe 0x2d9e3b51bb
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 0x42
mov rcx, rbp
lea eax, [rax + 1]
lea edx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbp, rax
mov r8, qword [r14 + 0x18]
mov eax, edi
add rax, rbp
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r8]
lea r8, [r8 + 2]
mov word [rax], dx
lea rax, [rax + 2]
test dx, dx
jne 0x2d9e3b51d0
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
lea edi, [rdi + rax*2]
add edi, 2
cmp esi, dword [rsp + 0x60]
jb 0x2d9e3b5170
jmp 0x2d9e3b5140
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MPR.dll_WNetCloseEnum]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
test rbp, rbp
je 0x2d9e3b5260
mov rcx, rbp
cmp edi, 1
jae 0x2d9e3b524f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x30]
xor ebp, ebp
mov eax, ebp
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
pop rdi
ret
mov edx, edi
mov r8d, 0x42
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbp, rax
mov r15, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
pop rdi
ret
Function at 0x2d9e3b57b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xaa0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0xa90], rax
mov rbx, rdx
mov rsi, rcx
mov r8, rdx
lea rcx, [rsp + 0x680]
lea rdx, [0x2d9e407860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x680]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x2d9e3b5820
xor al, al
jmp 0x2d9e3b58d3
movzx ecx, word [rsp + 0x4c]
cmp cx, word [0x2d9e407870]
movzx eax, word [rsp + 0x4e]
jne 0x2d9e3b583c
cmp ax, word [0x2d9e407872]
je 0x2d9e3b58a6
cmp cx, word [0x2d9e407874]
jne 0x2d9e3b585c
cmp ax, word [0x2d9e407876]
jne 0x2d9e3b585c
movzx eax, word [rsp + 0x50]
cmp ax, word [0x2d9e407878]
je 0x2d9e3b58a6
test byte [rsp + 0x20], 0x10
lea r9, [rsp + 0x4c]
mov r8, rbx
lea rdx, [0x2d9e407880]
lea rcx, [rsp + 0x270]
je 0x2d9e3b5892
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x270]
mov rcx, rsi
call fcn.2d9e3b57b0
jmp 0x2d9e3b58a6
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2d9e3b5820
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
mov rcx, qword [rsp + 0xa90]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2d9e3b5900
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
xor edi, edi
mov rbp, rcx
add rcx, 0x30
mov dword [rsp + 0x60], edi
mov rbx, rdx
cmp rcx, rdx
je 0x2d9e3b5929
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.2d9e3b3e10
mov rax, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
cmp rax, 8
jb 0x2d9e3b593c
mov rcx, qword [rbx]
jmp 0x2d9e3b593f
mov rcx, rbx
cmp word [rcx + rdx*2 - 2], 0x5c
mov qword [rsp + 0x68], rsi
je 0x2d9e3b59b2
cmp rax, 8
jb 0x2d9e3b5957
mov rcx, qword [rbx]
jmp 0x2d9e3b595a
mov rcx, rbx
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x2d9e3b5999
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbx + 0x10]
mov qword [rsp + 0x70], r14
lea r14d, [rcx*2 + 0xb]
mov ecx, 0x40
movsxd rdx, r14d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov byte [rax], 0x6a
mov ecx, dword [rsp + 0x60]
mov dword [rax + 1], ecx
mov dword [rax + 5], edi
cmp qword [rbx + 0x18], 8
mov r8, qword [rbx + 0x10]
jb 0x2d9e3b59ee
mov rbx, qword [rbx]
lea r8, [r8*2 + 2]
mov rdx, rbx
lea rcx, [rax + 9]
call fcn.2d9e3e2bb0
mov rcx, qword [rbp + 8]
mov r9b, 0x3f
mov r8d, r14d
mov rdx, rsi
call fcn.2d9e3b1ff0
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x70]
mov eax, ebx
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret

Function at 0x2d9e3b5c00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
mov rdi, rcx
mov rbx, qword [rax]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
dec qword [rcx + 0x20]
lea rcx, [rbx + 0x10]
call fcn.2d9e3b39e0
mov rcx, rbx
call fcn.2d9e3da86c
cmp qword [rdi + 0x20], 0
jne 0x2d9e3b5c6c
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov r9b, 0x3f
mov byte [rsp + 0x40], 0x6c
mov r8d, 1
call fcn.2d9e3b1ff0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi + 0x18]
mov rcx, rdi
mov rdx, qword [rax]
add rdx, 0x10
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.2d9e3b5900
Function at 0x2d9e3b70f0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [0x2d9e419c20], 0
mov ebx, ecx
jne 0x2d9e3b711b
mov ecx, 0x50
call fcn.2d9e3da7fc
mov rcx, rax
call fcn.2d9e3b6fe0
mov qword [0x2d9e419c20], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
lea rdx, [0x2d9e407950]
mov rcx, 0xffffffff80000002
test ebx, ebx
je 0x2d9e3b71cf
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3b7172
mov rcx, qword [rsp + 0x68]
lea rdx, [0x2d9e406058]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rbx
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x2d9e407950]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3b71bf
mov rcx, qword [rsp + 0x68]
lea rdx, [0x2d9e406058]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x2d9e419c20]
mov dword [rax + 0x48], ebx
add rsp, 0x50
pop rbx
ret
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x2d9e3b720a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, [0x2d9e407950]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x104
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x2d9e3b7259
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x2d9e419c20]
mov dword [rax + 0x48], 1
add rsp, 0x50
pop rbx
ret
Function at 0x2d9e3b7710
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rdi, rcx
mov dword [rsp + 0x40], 0x104
call fcn.2d9e3cd980
test eax, eax
jne 0x2d9e3b7767
call fcn.2d9e3cda20
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [0x2d9e4098a0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x40], eax
test eax, eax
jmp 0x2d9e3b77db
call fcn.2d9e3caad0
lea rcx, [0x2d9e409590]
mov qword [rsp + 0x48], 0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x2d9e3b7872
lea rdx, [0x2d9e4098b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3b7872
lea rdx, [rsp + 0x48]
mov ecx, ebx
call rax
test eax, eax
je 0x2d9e3b7872
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x2d9e3b7872
lea rdx, [0x2d9e407a30]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9, qword [rdi + 0x98]
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e407a80]
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
call fcn.2d9e3cae20
lea r8, [rsp + 0x280]
lea rdx, [0x2d9e407a90]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rdi + 0x98]
lea r9, [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
call fcn.2d9e3cac80
jmp 0x2d9e3b7874
xor eax, eax
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x4a0
pop rdi
ret
Function at 0x2d9e3b78a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rdi, rcx
mov dword [rsp + 0x40], 0x104
call fcn.2d9e3cd980
test eax, eax
jne 0x2d9e3b78f7
call fcn.2d9e3cda20
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [0x2d9e4098a0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x40], eax
test eax, eax
jmp 0x2d9e3b796b
call fcn.2d9e3caad0
lea rcx, [0x2d9e409590]
mov qword [rsp + 0x48], 0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x2d9e3b7a02
lea rdx, [0x2d9e4098b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3b7a02
lea rdx, [rsp + 0x48]
mov ecx, ebx
call rax
test eax, eax
je 0x2d9e3b7a02
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x2d9e3b7a02
lea rdx, [0x2d9e407ba0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9, qword [rdi + 0x98]
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e407a80]
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
call fcn.2d9e3cae20
lea r8, [rsp + 0x280]
lea rdx, [0x2d9e407bf0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rdi + 0x98]
lea r9, [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
call fcn.2d9e3cac80
jmp 0x2d9e3b7a04
xor eax, eax
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x4a0
pop rdi
ret
Function at 0x2d9e3b7a30
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xa10]
sub rsp, 0xb10
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0xa00], rax
mov rdi, rcx
mov dword [rsp + 0x40], 0x104
call fcn.2d9e3cd980
test eax, eax
jne 0x2d9e3b7a95
call fcn.2d9e3cda20
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp + 0x1c0]
lea rcx, [0x2d9e4098a0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x40], eax
test eax, eax
jmp 0x2d9e3b7b0b
call fcn.2d9e3caad0
lea rcx, [0x2d9e409590]
mov qword [rsp + 0x48], 0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x2d9e3b7c88
lea rdx, [0x2d9e4098b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3b7c88
lea rdx, [rsp + 0x48]
mov ecx, ebx
call rax
test eax, eax
je 0x2d9e3b7c88
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x2d9e3b7c88
lea rdx, [0x2d9e407d00]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9, qword [rdi + 0x98]
lea r8, [rbp + 0x1c0]
lea rdx, [0x2d9e407880]
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [0x2d9e407d48]
lea r8, [rbp + 0x1c0]
lea rdx, [0x2d9e407a80]
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x2d9e3b7c39
nop dword [rax + rax]
lea rdx, [0x2d9e407870]
lea rcx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x2d9e3b7bea
lea rdx, [0x2d9e407874]
lea rcx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x2d9e3b7bea
lea r9, [rbp - 0x64]
lea r8, [rbp + 0x1c0]
lea rdx, [0x2d9e407d68]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x2d9e3b7bfe
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2d9e3b7b90
jmp 0x2d9e3b7c30
lea r9, [rbp - 0x64]
lea r8, [rbp + 0x1c0]
lea rdx, [0x2d9e407da8]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x3d0]
call fcn.2d9e3cae20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0x5e0]
lea rdx, [0x2d9e407dd0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rdi + 0x98]
lea r9, [rbp + 0x1c0]
xor eax, eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
call fcn.2d9e3cac80
jmp 0x2d9e3b7c8a
xor eax, eax
mov rcx, qword [rbp + 0xa00]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0xb10]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x2d9e3b8a60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov ebx, edx
lea rdx, [rsp + 0x60]
call fcn.2d9e3c9800
lea r8, [rsp + 0x60]
lea rdx, [0x2d9e407f00]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea eax, [rbx + 0x13c]
xor r9d, r9d
xor ebx, ebx
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3b8b3d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x2d9e407f34]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
mov edi, 1
test eax, eax
cmove ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3b8b3d
mov eax, edi
jmp 0x2d9e3b8b3f
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2d0
pop rdi
ret

Function at 0x2d9e3b8b60
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x30], rax
mov eax, 2
mov word [rcx + 0x28], ax
lea rcx, [0x2d9e407900]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x2d9e3b8c29
lea rdx, [0x2d9e407f38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
test rax, rax
je 0x2d9e3b8c29
lea rdx, [0x2d9e407f58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x2d9e3b8c29
lea rdx, [0x2d9e407f70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x2d9e3b8c29
movzx ecx, word [rbx + 0x28]
lea r8, [rbx + 0x24]
lea rdx, [rbx + 0x20]
call qword [rbx + 8]
test eax, eax
jne 0x2d9e3b8c29
mov ecx, dword [rbx + 0x20]
call fcn.2d9e3da838
mov qword [rbx + 0x30], rax
test rax, rax
je 0x2d9e3b8c29
mov r8d, dword [rbx + 0x20]
xor edx, edx
mov rcx, rax
call fcn.2d9e3e3840
mov dword [rbx], 1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x2d9e3bc3c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x2d9e3bb6f0]
mov byte [rsp + 0x40], 1
xor ebx, ebx
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r8, [0x2d9e3c8af0]
mov qword [rsp + 0x48], rax
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.2d9e3e4db4
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 0xffffffffffffffff
je 0x2d9e3bc43c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x50
pop rbx
ret

Function at 0x2d9e3bd490
Capabilities:
Encode data using xor
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov rcx, qword [0x2d9e419e30]
xor r9d, r9d
add rcx, 0x21a
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov dword [rsp + 0x68], 0
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x2d9e3bd50f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x2d9e3bd513
add ebx, ebx
movsxd rsi, ebx
mov rcx, rsi
call fcn.2d9e3da838
xor r8d, r8d
mov rbp, rax
test ebx, ebx
jle 0x2d9e3bd5ae
cmp ebx, 0x20
jb 0x2d9e3bd5ae
lea ecx, [rbx - 1]
movsxd rdx, ecx
add rax, rdx
lea rcx, [rdx + rdi]
cmp rbp, rcx
ja 0x2d9e3bd550
cmp rax, rdi
jae 0x2d9e3bd5ae
mov ecx, ebx
and ecx, 0x8000001f
jge 0x2d9e3bd561
dec ecx
or ecx, 0xffffffe0
inc ecx
movdqa xmm2, xmmword [0x2d9e40a0a0]
mov eax, ebx
sub eax, ecx
mov rdx, rdi
sub rdx, rbp
movsxd r10, eax
mov r9, rbp
mov rcx, rbp
neg r9
nop
movdqu xmm0, xmmword [rdx + rcx]
lea rcx, [rcx + 0x20]
add r8d, 0x20
lea rax, [r9 + rcx]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x20], xmm0
movdqu xmm1, xmmword [rdx + rcx - 0x10]
pxor xmm1, xmm2
movdqu xmmword [rcx - 0x10], xmm1
cmp rax, r10
jl 0x2d9e3bd580
movsxd rax, r8d
cmp rax, rsi
jge 0x2d9e3bd5d3
sub rdi, rbp
lea rcx, [rax + rbp]
sub rsi, rax
movzx eax, byte [rcx + rdi]
lea rcx, [rcx + 1]
xor al, 0x58
mov byte [rcx - 1], al
sub rsi, 1
jne 0x2d9e3bd5c0
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.2d9e3da7f4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret