joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d9e3c8f70
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r12d, r12d
mov r14, rdx
mov rdi, rcx
mov dword [rsp + 0x40], r12d
mov ebx, 1
mov dword [rsp + 0x44], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
lea rcx, [0x2d9e4095c8]
xor r9d, r9d
xor r8d, r8d
movzx r15d, bl
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
test rax, rax
je 0x2d9e3c90d9
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rdi
mov qword [rsp + 0x4a0], rsi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
jne 0x2d9e3c9017
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x2d9e3c90d1
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x2d9e3c90bb
mov r14d, 0x5a4d
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
call fcn.2d9e3e3840
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test ebx, ebx
je 0x2d9e3c9087
cmp word [rsp + 0x50], r14w
jne 0x2d9e3c90af
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], ebx
ja 0x2d9e3c9050
jmp 0x2d9e3c90b2
xor r15b, r15b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movzx eax, r15b
mov rsi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x460
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x2d9e3c9220
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov qword [rsp + 0x178], rsi
mov r8d, 0x120
mov rbx, rcx
call fcn.2d9e3e3840
call fcn.2d9e3c91b0
mov dword [rbx + 0x10], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
call fcn.2d9e3c91b0
xor edi, edi
test eax, eax
jne 0x2d9e3c9277
mov eax, edi
jmp 0x2d9e3c92b0
lea rcx, [0x2d9e409610]
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e409600]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3c92a7
lea rdx, [rsp + 0x20]
mov rcx, rsi
call rax
mov eax, edi
cmp dword [rsp + 0x20], eax
sete al
xor edx, edx
mov dword [rbx + 0x14], eax
mov r8d, 0x11c
lea rcx, [rsp + 0x30]
call fcn.2d9e3e3840
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rsi, qword [rsp + 0x178]
test eax, eax
je 0x2d9e3c9350
mov eax, dword [rsp + 0x3c]
cmp byte [rsp + 0x14a], 1
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x38]
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0xc], eax
mov eax, edi
setne al
mov dword [rbx], ecx
mov dword [rbx + 0x1c], eax
mov dword [rbx + 4], edx
cmp ecx, 5
jne 0x2d9e3c9325
cmp edx, 2
jne 0x2d9e3c9325
lea ecx, [rdx + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbx + 0x18], eax
lea rdx, [rsp + 0x44]
mov rax, rbx
sub rax, rdx
lea rcx, [rsp + 0x44]
lea rdx, [rax + 0x20]
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c9340
mov eax, dword [rbx]
cmp eax, 6
jne 0x2d9e3c935d
cmp dword [rbx + 4], 2
je 0x2d9e3c9365
test eax, eax
jne 0x2d9e3c93ec
lea rcx, [0x2d9e407900]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x2d9e409630]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3c9412
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call rax
movzx r8d, word [rsp + 0x20]
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov edx, dword [rsp + 0x24]
mov dword [rsp + 0x20], r8d
cmp eax, ecx
ja 0x2d9e3c93bc
jne 0x2d9e3c93ec
cmp edx, dword [rbx + 4]
jbe 0x2d9e3c93ec
mov dword [rbx], eax
mov dword [rbx + 4], edx
mov dword [rbx + 8], r8d
call fcn.2d9e3c9110
test al, al
setne dil
cmp dword [rbx], 5
mov dword [rbx + 0x1c], edi
jne 0x2d9e3c93ec
cmp dword [rbx + 4], 2
jne 0x2d9e3c93ec
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbx + 0x18], eax
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
jmp 0x2d9e3c93f1
Function at 0x2d9e3c9420
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x114
call fcn.2d9e3e3840
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0x158
ret

Function at 0x2d9e3c9480
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
xor edx, edx
mov edi, eax
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x2d9e3c94f4
cmp dword [rsp + 0x28], edi
je 0x2d9e3c94f0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x2d9e3c94d6
jmp 0x2d9e3c94f4
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x2d9e3c95d0
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, dword [0x2d9e408ab8]
xor bl, bl
mov dword [rdx], eax
mov r14, r9
mov eax, dword [0x2d9e408ab8]
mov rdi, r8
mov dword [r9], eax
mov rsi, rdx
mov eax, dword [0x2d9e408ab8]
mov r15, rcx
mov dword [r8], eax
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x2d9e3c9620
test rax, rax
je 0x2d9e3c97f1
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x260], r12
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
test eax, eax
je 0x2d9e3c97ec
mov ecx, r12d
mov qword [rsp + 0x268], rbp
call fcn.2d9e3da838
mov rbp, rax
test rax, rax
je 0x2d9e3c97ba
mov edx, dword [rsp + 0x30]
mov r9, rax
mov r8d, r12d
mov rcx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x2d9e3c97b2
lea r9, [rsp + 0x20]
mov rcx, rbp
lea r8, [rsp + 0x38]
lea rdx, [0x2d9e4096a0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x2d9e3c97b2
mov rax, qword [rsp + 0x38]
lea rdx, [0x2d9e409650]
lea rcx, [rsp + 0x40]
movzx ebx, word [rax]
movzx eax, word [rax + 2]
shl ebx, 0x10
or ebx, eax
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x20]
mov rcx, rbp
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x2d9e3c9710
mov rcx, qword [rsp + 0x28]
sub rsi, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rsi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c9700
mov r8d, ebx
lea rdx, [0x2d9e409730]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x20]
mov rcx, rbp
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x2d9e3c9761
mov rcx, qword [rsp + 0x28]
sub r14, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [r14 + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c9750
mov r8d, ebx
lea rdx, [0x2d9e4096e0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x20]
mov rcx, rbp
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x2d9e3c97b0
mov rcx, qword [rsp + 0x28]
sub rdi, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c97a0
mov bl, 1
mov rcx, rbp
call fcn.2d9e3da7f4
mov rbp, qword [rsp + 0x268]
movzx eax, bl
mov r12, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx eax, bl
jmp 0x2d9e3c97c5
movzx eax, bl
jmp 0x2d9e3c97cd
Function at 0x2d9e3c9b50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rdx
mov rbp, rcx
mov edx, 0x104
lea rcx, [rsp + 0x70]
mov rdi, r9
mov esi, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
xor r15d, r15d
lea eax, [rbx - 1]
cmp word [rsp + rax*2 + 0x70], 0x5c
je 0x2d9e3c9bc4
mov ecx, 0x5c
mov word [rsp + rbx*2 + 0x70], cx
inc ebx
mov eax, ebx
add rax, rax
cmp rax, 0x208
jae 0x2d9e3c9c9b
mov word [rsp + rax + 0x70], r15w
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.2d9e3c9800
mov r9d, r15d
lea rcx, [rsp + 0x22]
mov edx, 1
nop
movzx r8d, word [rcx]
cmp r8w, 0x2d
je 0x2d9e3c9bfb
mov word [rsp + rbx*2 + 0x70], r8w
inc r9d
inc ebx
cmp r9d, esi
je 0x2d9e3c9c06
inc edx
add rcx, 2
cmp edx, 0x25
jl 0x2d9e3c9be0
test rdi, rdi
je 0x2d9e3c9c33
movzx ecx, word [rdi]
test cx, cx
je 0x2d9e3c9c33
nop dword [rax]
nop word [rax + rax]
mov word [rsp + rbx*2 + 0x70], cx
lea rdi, [rdi + 2]
movzx ecx, word [rdi]
inc ebx
test cx, cx
jne 0x2d9e3c9c20
mov eax, ebx
add rax, rax
cmp rax, 0x208
jae 0x2d9e3c9ca1
mov word [rsp + rax + 0x70], r15w
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x70]
mov r8, r14
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [r8 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x2d9e3c9c60
mov rax, r14
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.2d9e3dad58
int3
call fcn.2d9e3dad58
int3
Function at 0x2d9e3ca4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebx, ebx
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x30], ebx
lea rcx, [0x2d9e4097b0]
call fcn.2d9e3c9800
lea r8, [rsp + 0x50]
lea rdx, [0x2d9e407f00]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, dword [rsp + 0x34]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.2d9e3e3840
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3ca583
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x2d9e407f34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3ca583
mov eax, dword [rsp + 0x30]
jmp 0x2d9e3ca585
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0x2c0
pop rbx
ret
Function at 0x2d9e3ca5a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov esi, ecx
mov dword [rsp + 0x54], 4
xor edi, edi
lea rcx, [0x2d9e4097b0]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x50], edi
call fcn.2d9e3c9800
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e407f00]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, dword [rsp + 0x54]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.2d9e3e3840
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14d, [rdi + 1]
test eax, eax
jne 0x2d9e3ca6a0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x308], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x2d9e407f34]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, edi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x308]
je 0x2d9e3ca6a0
mov eax, dword [rsp + 0x50]
jmp 0x2d9e3ca734
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3ca732
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, [0x2d9e407f34]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmove edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x2d9e3ca697
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rsi, qword [rsp + 0x310]
add rsp, 0x2e0
pop r14
pop rdi
pop rbp
ret
Function at 0x2d9e3ca760
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x2d9e3ca8c6
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x78], rbx
mov esi, edx
or rbx, 0xffffffffffffffff
mov rdi, rcx
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x2d9e3ca780
cmp rax, 1
jb 0x2d9e3ca8bb
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
lea rdx, [0x2d9e4097f0]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x80], rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3ca82b
cmp word [rdi + rbx*2 + 2], bp
lea rbx, [rbx + 1]
jne 0x2d9e3ca7e4
mov rcx, qword [rsp + 0x80]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x2d9e407f34]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rdx, [0x2d9e4097f0]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rbp, qword [rsp + 0x50]
test eax, eax
jne 0x2d9e3ca8bb
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, [0x2d9e407fc8]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x2d9e3caad0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x114
mov edi, ebx
call fcn.2d9e3e3840
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 6
jb 0x2d9e3cac4d
lea rcx, [0x2d9e409590]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x2d9e3cac4f
lea rdx, [0x2d9e4097d8]
mov qword [rsp + 0x180], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x2d9e409580]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rbp, rbp
je 0x2d9e3cac1a
test rax, rax
je 0x2d9e3cac1a
xor edx, edx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call rbp
test eax, eax
je 0x2d9e3cac1a
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov r9, qword [rsp + 0x38]
test r8d, r8d
je 0x2d9e3cac11
nop dword [rax + rax]
mov eax, edx
lea rcx, [rax + rax*2]
cmp dword [r9 + rcx*8 + 0x10], ebx
je 0x2d9e3cabd6
inc edx
cmp edx, r8d
jb 0x2d9e3cabc0
jmp 0x2d9e3cabe4
mov eax, edx
lea rcx, [rax + rax*2]
mov edi, dword [r9 + rcx*8]
test edi, edi
jne 0x2d9e3cac11
test r8d, r8d
je 0x2d9e3cac11
nop dword [rax]
mov eax, ebx
lea rcx, [rax + rax*2]
cmp dword [r9 + rcx*8 + 0x10], 1
je 0x2d9e3cac07
inc ebx
cmp ebx, r8d
jb 0x2d9e3cabf0
jmp 0x2d9e3cac11
mov eax, ebx
lea rdx, [rax + rax*2]
mov edi, dword [r9 + rdx*8]
mov rcx, r9
call rsi
test edi, edi
jne 0x2d9e3cac45
lea rcx, [0x2d9e409890]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x2d9e3cac45
lea rdx, [0x2d9e409870]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3cac45
call rax
mov edi, eax
mov rbp, qword [rsp + 0x180]
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x2d9e3cac80
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xd0
xor ebp, ebp
lea rcx, [rsp + 0x68]
mov rbx, rdx
mov rsi, r9
xor edx, edx
mov edi, ebp
lea r8d, [rbp + 0x60]
call fcn.2d9e3e3840
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x100], rbp
call fcn.2d9e3cd980
test eax, eax
jne 0x2d9e3cad15
call fcn.2d9e3cda20
mov rax, qword [rsp + 0x120]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rdx, rsi
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x2d9e3cadff
call fcn.2d9e3caad0
mov ebx, eax
test eax, eax
je 0x2d9e3cadfd
lea rcx, [0x2d9e409590]
mov qword [rsp + 0xf0], rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x2d9e3cadfd
lea rdx, [0x2d9e4098b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3cadfd
lea rdx, [rsp + 0xf0]
mov ecx, ebx
call rax
test eax, eax
je 0x2d9e3cadfd
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x100]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x2d9e3cad99
mov rcx, rbp
mov qword [rsp + 0x100], rcx
jmp 0x2d9e3cada6
mov rcx, qword [rsp + 0x100]
mov edi, 0x400
mov rax, qword [rsp + 0x120]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rsi
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x2d9e3cadfd
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, ebp
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x2d9e3cae20
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x590]
mov r8d, 0x208
call fcn.2d9e3e3840
mov rdx, rdi
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x2d9e4098cc]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2d9e3caea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2d9e3cb001
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x8e0], rbx
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x2d9e3caff9
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x380]
mov r8d, 0x208
call fcn.2d9e3e3840
mov rdx, rdi
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x2d9e407858]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.2d9e3e3840
mov rdx, rsi
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x2d9e407858]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rsp + 0x20], 0x10
je 0x2d9e3cafcc
lea rdx, [0x2d9e407870]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x2d9e3cafcc
lea rdx, [0x2d9e407874]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x2d9e3cafcc
xor edx, edx
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2d9e3cafb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2d9e3cafe3
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x380]
call fcn.2d9e3cae20
jmp 0x2d9e3cafe3
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2d9e3caed0
mov rbx, qword [rsp + 0x8e0]
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0x8b0
pop rdi
pop rsi
pop rbp
ret