joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180246604
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180237b5c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1802466a5
cmp ebx, dword [rsp + 0x30]
je 0x18024669e
test esi, esi
je 0x18024669e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180246679
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180246686
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180246663
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18024668a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1802466a7
mov eax, 1
jmp 0x1802466a7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180249bec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18023c94c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18023c94c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180249d3c
cmp rax, 0xffffffffffffffff
je 0x180249d3c
xor edi, edi
test rbp, rbp
jle 0x180249ce7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18023ae20
mov rbx, rax
test rax, rax
jne 0x180249c74
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180249cdd
mov edx, 0x8000
mov ecx, r14d
call fcn.180249a70
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18023a68c
cmp eax, 0xffffffff
je 0x180249cbd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180249c84
mov edx, r15d
mov ecx, r14d
call fcn.180249a70
jmp 0x180249cdd
cmp byte [rsi + 0x38], dil
je 0x180249cd4
cmp dword [rsi + 0x34], 5
jne 0x180249cd4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180249cdd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18023a994
jmp 0x180249d50
jns 0x180249d50
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18023c94c
cmp rax, 0xffffffffffffffff
jne 0x180249d08
cmp byte [rsi + 0x30], dil
je 0x180249d50
mov edi, dword [rsi + 0x2c]
jmp 0x180249d50
mov ecx, r14d
call fcn.180235c68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180249d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180249d50
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180249d49
mov eax, dword [rsi + 0x2c]
jmp 0x180249d4e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18023c94c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x2eda313c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
cmp edx, 1
je 0x2eda313d8
mov eax, 1
add rsp, 0x48
ret
lea rax, [rsp + 0x3c]
mov r9, rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [0x2eda313a0]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
test rax, rax
je 0x2eda313c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x48
ret

Function at 0x2eda31580
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
lea r11d, [r8 - 2]
mov rbx, rcx
mov rsi, rdx
test r11d, r11d
jle 0x2eda316b0
xor r10d, r10d
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rdx]
add rcx, 4
add r10d, 3
add rdx, 3
shr al, 2
and eax, 0x3f
movzx eax, byte [r9 + rax]
mov byte [rcx - 4], al
movsx eax, byte [rdx - 3]
movsx edi, byte [rdx - 2]
shl eax, 4
sar edi, 4
and eax, 0x30
and edi, 0xf
or eax, edi
cdqe
movzx eax, byte [r9 + rax]
mov byte [rcx - 3], al
movsx eax, byte [rdx - 2]
movsx edi, byte [rdx - 1]
shl eax, 2
sar edi, 6
and eax, 0x3c
and edi, 3
or eax, edi
cdqe
movzx eax, byte [r9 + rax]
mov byte [rcx - 2], al
movzx eax, byte [rdx - 1]
and eax, 0x3f
movzx eax, byte [r9 + rax]
mov byte [rcx - 1], al
cmp r10d, r11d
jl 0x2eda315a0
cmp r8d, r10d
jle 0x2eda31681
movsxd r9, r10d
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub r8d, 1
add r9, rsi
movzx eax, byte [r9]
shr al, 2
and eax, 0x3f
movzx eax, byte [rdx + rax]
mov byte [rcx], al
cmp r8d, r10d
je 0x2eda31690
add r10d, 1
movsx eax, byte [r9]
movsxd r10, r10d
add r10, rsi
shl eax, 4
movsx r8d, byte [r10]
and eax, 0x30
sar r8d, 4
and r8d, 0xf
or eax, r8d
cdqe
movzx eax, byte [rdx + rax]
mov byte [rcx + 1], al
movsx eax, byte [r10]
shl eax, 2
and eax, 0x3c
movzx eax, byte [rdx + rax]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
lea rax, [rcx + 1]
mov byte [rcx], 0
sub rax, rbx
pop rbx
pop rsi
pop rdi
ret
movsx eax, byte [r9]
mov byte [rcx + 2], 0x3d
shl eax, 4
and eax, 0x30
movzx eax, byte [rdx + rax]
mov byte [rcx + 1], al
jmp 0x2eda31679
xor r10d, r10d
jmp 0x2eda31611
Function at 0x2eda31800
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rcx, [0x2eda3e0c0]
call fcn.2eda35e40
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov r9d, 0x108
mov r13, rax
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r13
call rdi
mov r12d, eax
test eax, eax
je 0x2eda31878
xor r12d, r12d
mov rcx, r13
call fcn.2eda35ed0
mov eax, r12d
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x2eda3e130]
xor ebx, ebx
lea r14, [rsp + 0x5c]
call fcn.2eda35e40
lea rsi, [rsp + 0x70]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea r15, [rsp + 0x68]
mov qword [rsp + 0x48], rax
jmp 0x2eda318ab
add ebx, 1
mov dword [rsp + 0x5c], 0x104
mov r9, r14
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
jne 0x2eda31948
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x60]
mov rdx, rsi
mov r9d, 0x101
call rdi
test eax, eax
jne 0x2eda318a8
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
cmp eax, 1
adc r12d, 0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2eda318a8
mov rcx, qword [rsp + 0x48]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2eda31852

Function at 0x2eda319f0
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
lea rcx, [0x2eda3e190]
call fcn.2eda35e40
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, r12
mov r13, rax
call fcn.2eda35ed0
lea rcx, [0x2eda3e1b1]
call fcn.2eda35dc0
mov rcx, r13
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov rbx, rax
call fcn.2eda35ed0
lea rcx, [rsp + 0x20]
test rbx, rbx
je 0x2eda31a60
call rbx
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
Function at 0x2eda31ab0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x480
mov rbx, rcx
lea rcx, [0x2eda3e1cd]
lea r13, [rsp + 0x20]
call fcn.2eda35e40
mov r9, rbx
mov edx, 0x104
mov rcx, r13
mov r12, rax
mov r8, rax
lea rbx, [rsp + 0x230]
call fcn.2eda31a80
mov rcx, r12
xor r12d, r12d
call fcn.2eda35ed0
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x2eda31bb9
lea rcx, [0x2eda3e1e4]
lea rdi, [rsp + 0x25c]
call fcn.2eda35e40
lea rcx, [0x2eda3e1ef]
mov r14, rax
call fcn.2eda35e40
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15, rax
jmp 0x2eda31b60
add r12d, 1
mov rdx, rbx
mov rcx, r13
call rsi
test eax, eax
je 0x2eda31ba0
test byte [rsp + 0x230], 0x10
je 0x2eda31b50
mov rdx, r14
mov rcx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x2eda31b54
mov rdx, r15
mov rcx, rdi
call sub.msvcrt.dll_wcscmp
mov rdx, rbx
mov rcx, r13
cmp eax, 1
sbb r12d, 0xffffffff
call rsi
test eax, eax
jne 0x2eda31b60
nop word [rax + rax]
mov rcx, r15
call fcn.2eda35ed0
mov rcx, r14
call fcn.2eda35ed0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, r12d
add rsp, 0x480
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x2eda31bd0
Capabilities:
Get common file path

Disassembly:
push r12
sub rsp, 0x230
mov ecx, 0x104
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x2eda31c00
add rsp, 0x230
pop r12
ret
mov rcx, r12
call fcn.2eda31ab0
add rsp, 0x230
pop r12
ret

Function at 0x2eda31c20
Capabilities:
Get common file path

Disassembly:
push r12
sub rsp, 0x240
xor r8d, r8d
xor r9d, r9d
mov edx, 0x1a
xor ecx, ecx
lea r12, [rsp + 0x30]
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r8d, eax
xor eax, eax
test r8d, r8d
js 0x2eda31c58
mov rcx, r12
call fcn.2eda31ab0
add rsp, 0x240
pop r12
ret
Function at 0x2eda31c70
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.2eda31bd0
cmp eax, 0xe
jg 0x2eda31c8d
call fcn.2eda31c20
cmp eax, 4
jle 0x2eda31cd8
call fcn.2eda319f0
cmp eax, 3
jbe 0x2eda31ca3
call fcn.2eda31970
cmp eax, 0xeff
jg 0x2eda31cad
call fcn.2eda319f0
cmp eax, 7
jbe 0x2eda31cc0
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x2eda34e00
call fcn.2eda31970
cmp eax, 0x1fff
jg 0x2eda31cad
add rsp, 0x20
pop r12
ret
call fcn.2eda31800
cmp eax, 4
jg 0x2eda31c8d
jmp 0x2eda31ccc
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14, rcx
lea rcx, [0x2eda3d020]
call fcn.2eda35e40
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
je 0x2eda34e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2eda34e70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp fcn.2eda35ed0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x89
mov esi, eax
je 0x2eda34e49
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
nop dword [rax + rax]
add ebx, 1
mov ecx, 0x64
call rdi
cmp esi, ebx
jne 0x2eda34e90
call fcn.2eda32040
test eax, eax
je 0x2eda34eb8
mov rdx, r12
mov rcx, r14
call fcn.2eda343b0
jmp 0x2eda34e49
mov rcx, r14
call fcn.2eda34d00
test eax, eax
jne 0x2eda34e49
jmp 0x2eda34ea7
Function at 0x2eda32040
Capabilities:
Accept command line arguments

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x2c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x2eda32070
cmp dword [rsp + 0x2c], 1
jg 0x2eda32080
mov eax, r13d
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
lea rcx, [0x2eda3e2e3]
call fcn.2eda35e40
cmp dword [rsp + 0x2c], 1
mov r12, rax
jle 0x2eda320e0
mov ebx, 1
jmp 0x2eda320aa
add rbx, 1
cmp dword [rsp + 0x2c], ebx
jle 0x2eda320e0
mov rcx, qword [rsi + rbx*8]
mov rdx, r12
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x2eda320a0
mov r13d, 1
mov rcx, r12
call fcn.2eda35ed0
mov eax, r13d
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
xor r13d, r13d
jmp 0x2eda320c0

Function at 0x2eda32100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, r8d
mov r9, rcx
not eax
test edx, edx
je 0x2eda32153
mov edx, edx
lea r10, [rcx + rdx]
nop word [rax + rax]
movzx edx, byte [r9]
add r9, 1
xor eax, edx
mov edx, 8
nop word [rax + rax]
mov ecx, eax
shr ecx, 1
mov r8d, ecx
xor r8d, 0xedb88320
test al, 1
mov eax, ecx
cmovne eax, r8d
sub edx, 1
jne 0x2eda32130
cmp r10, r9
jne 0x2eda32118
not eax
ret
mov eax, r8d
ret
Function at 0x2eda33770
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
xor r15d, r15d
mov r13, rdx
mov ebx, r8d
call fcn.2eda32990
mov r12, rax
test rax, rax
je 0x2eda3383b
mov rcx, rax
call fcn.2eda32830
mov r14, rax
test rax, rax
je 0x2eda33833
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x2eda3382b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, r13
mov qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
test eax, eax
je 0x2eda33822
xor r15d, r15d
cmp dword [rsp + 0x4c], ebx
sete r15b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.2eda34f30
mov rcx, r12
call fcn.2eda34f30
mov eax, r15d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x2eda33990
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
xor r12d, r12d
mov rbx, rdx
call fcn.2eda32990
mov r14, rax
test rax, rax
je 0x2eda33a41
mov rcx, rax
call fcn.2eda32830
mov r12, rax
test rax, rax
je 0x2eda33a39
xor r9d, r9d
mov r8d, 7
mov rcx, rax
xor r15d, r15d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x2eda33a2e
mov rdi, qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r9d, 2
call rdi
mov esi, eax
cmp eax, 0x40000000
jbe 0x2eda33a58
xor r15d, r15d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov r12, r15
call fcn.2eda34f30
mov rcx, r14
call fcn.2eda34f30
mov rax, r12
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, eax
call fcn.2eda34ed0
mov r15, rax
test rax, rax
je 0x2eda33a22
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rdi
lea r9, [rsp + 0x4c]
mov r8d, esi
mov rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x2eda33a9b
cmp dword [rsp + 0x4c], esi
je 0x2eda33aa8
mov rcx, r15
call fcn.2eda34f30
jmp 0x2eda33a22
test rbx, rbx
je 0x2eda33a25
mov dword [rbx], esi
jmp 0x2eda33a25
Function at 0x2eda33ca0
Capabilities:
Set current directory

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x230
movabs rdx, 0x100002600
movzx eax, word [rcx]
mov rbx, rcx
test ax, ax
je 0x2eda33cce
nop dword [rax]
cmp ax, 0x20
jbe 0x2eda33cf8
mov rcx, rbx
xor r12d, r12d
call sub.msvcrt.dll_wcslen
cmp rax, 1
ja 0x2eda33d10
mov eax, r12d
add rsp, 0x230
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
bt rdx, rax
jae 0x2eda33cce
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x2eda33cc8
jmp 0x2eda33cce
lea rcx, [0x2eda3e618]
call fcn.2eda35e40
mov r8d, 2
mov rcx, rbx
mov r13, rax
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
movsxd r12, eax
test r12d, r12d
je 0x2eda33d46
xor r12d, r12d
mov rcx, r13
call fcn.2eda35ed0
jmp 0x2eda33cdf
movzx eax, word [rbx + 4]
lea rsi, [rbx + 4]
movabs rdx, 0x100002600
test ax, ax
je 0x2eda33d6a
nop dword [rax]
cmp ax, 0x20
jbe 0x2eda33e10
mov rcx, rsi
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x2eda33d39
xor edx, edx
mov word [rsp + 0x20], dx
movzx edx, word [rsi]
cmp dx, 0x22
je 0x2eda33e30
mov eax, 1
cmp dx, 0x20
ja 0x2eda33daa
movabs rcx, 0x100002601
bt rcx, rdx
jb 0x2eda33e72
movabs rcx, 0x100002601
lea r14, [rsp + 0x20]
nop dword [rax]
mov word [r14 + rax*2 - 2], dx
movzx edx, word [rsi + rax*2]
movsxd r12, eax
add rax, 1
cmp dx, 0x20
ja 0x2eda33dc0
bt rcx, rdx
jae 0x2eda33dc0
xor eax, eax
mov rcx, r14
mov word [rsp + r12*2 + 0x20], ax
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x2eda33d39
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r12d, eax
jmp 0x2eda33d3c
bt rdx, rax
jae 0x2eda33d6a
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x2eda33d60
jmp 0x2eda33d6a
movzx edx, word [rsi + 2]
test dx, dx
je 0x2eda33e72
mov eax, 1
lea r14, [rsp + 0x20]
cmp dx, 0x22
jne 0x2eda33e56
jmp 0x2eda33e72
cmp dx, 0x22
je 0x2eda33ddd
mov word [r14 + rax*2 - 2], dx
movzx edx, word [rsi + rax*2 + 2]
movsxd r12, eax
add rax, 1
test dx, dx
jne 0x2eda33e50
jmp 0x2eda33ddd
lea r14, [rsp + 0x20]
jmp 0x2eda33ddd
Function at 0x2eda34b10
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa80
mov r8d, 0x104
mov r12, rdx
lea r13, [rsp + 0x240]
lea r15, [rsp + 0x30]
mov r14, rcx
mov rdx, r15
mov rcx, qword [0x2eda420c8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [0x2eda3e6c0]
call fcn.2eda35e40
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov rbx, rax
call fcn.2eda35ed0
lea rcx, [0x2eda3e6df]
call fcn.2eda35dc0
mov rcx, rbx
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov rbx, rax
call fcn.2eda35ed0
xor ecx, ecx
mov rdx, r13
call rbx
test eax, eax
je 0x2eda34bd0
cmp eax, 0xb7
je 0x2eda34bd0
xor eax, eax
add rsp, 0xa80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x2eda3e6f9]
lea rdi, [rsp + 0x450]
call fcn.2eda35e40
lea rcx, [0x2eda3e716]
lea rsi, [rsp + 0x660]
mov r12, rax
call fcn.2eda35e40
lea rdx, [0x2eda3e734]
mov rcx, r13
mov rbx, rax
call sub.msvcrt.dll_wcscat
mov rdx, r13
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_wcscat
mov rdx, r13
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov edx, dword [0x2eda420c0]
mov rcx, r13
test edx, edx
mov rdx, r12
cmovne rdx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call fcn.2eda35ed0
mov rcx, r12
call fcn.2eda35ed0
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
call rbx
mov rcx, rsi
call rbx
xor r8d, r8d
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x2eda34bb8
mov eax, dword [0x2eda420c0]
test eax, eax
je 0x2eda34ce0
lea rax, [0x2eda3e74e]
mov r9, r13
lea rbx, [rsp + 0x870]
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea rax, [0x2eda3e754]
mov rcx, rbx
lea r8, [0x2eda3e738]
mov qword [rsp + 0x20], rax
call fcn.2eda32770
mov r8, rbx
lea rdx, str.rundll32.exe
mov rcx, r14
call fcn.2eda361a0
jmp 0x2eda34bba
lea r8, [0x2eda3e74e]
mov rdx, r13
mov rcx, r14
call fcn.2eda361a0
jmp 0x2eda34bba
Function at 0x2eda34e00
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.2eda31bd0
cmp eax, 0xe
jg 0x2eda31c8d
call fcn.2eda31c20
cmp eax, 4
jle 0x2eda31cd8
call fcn.2eda319f0
cmp eax, 3
jbe 0x2eda31ca3
call fcn.2eda31970
cmp eax, 0xeff
jg 0x2eda31cad
call fcn.2eda319f0
cmp eax, 7
jbe 0x2eda31cc0
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x2eda34e00
call fcn.2eda31970
cmp eax, 0x1fff
jg 0x2eda31cad
add rsp, 0x20
pop r12
ret
call fcn.2eda31800
cmp eax, 4
jg 0x2eda31c8d
jmp 0x2eda31ccc
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14, rcx
lea rcx, [0x2eda3d020]
call fcn.2eda35e40
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
je 0x2eda34e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2eda34e70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp fcn.2eda35ed0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x89
mov esi, eax
je 0x2eda34e49
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
nop dword [rax + rax]
add ebx, 1
mov ecx, 0x64
call rdi
cmp esi, ebx
jne 0x2eda34e90
call fcn.2eda32040
test eax, eax
je 0x2eda34eb8
mov rdx, r12
mov rcx, r14
call fcn.2eda343b0
jmp 0x2eda34e49
mov rcx, r14
call fcn.2eda34d00
test eax, eax
jne 0x2eda34e49
jmp 0x2eda34ea7

Function at 0x2eda35310
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
xor eax, eax
mov word [rcx], ax
mov r9, rcx
mov rbx, rdx
xor eax, eax
nop
mov byte [r9 + rax + 2], al
add rax, 1
cmp rax, 0x100
jne 0x2eda35320
xor r10d, r10d
xor ecx, ecx
nop word cs:[rax + rax]
mov rax, rcx
xor edx, edx
movzx r11d, byte [r9 + rcx + 2]
div r8
movzx eax, byte [rbx + rdx]
add eax, r11d
add r10d, eax
movzx eax, r10b
movzx edx, byte [r9 + rax + 2]
mov byte [r9 + rcx + 2], dl
add rcx, 1
mov byte [r9 + rax + 2], r11b
cmp rcx, 0x100
jne 0x2eda35340
pop rbx
ret

Function at 0x2eda35380
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
mov rbx, rdx
test r9, r9
je 0x2eda353dd
xor r11d, r11d
nop dword [rax]
movzx eax, byte [rcx]
movzx r10d, byte [rcx + 1]
add eax, 1
mov byte [rcx], al
movzx eax, al
movzx edx, byte [rcx + rax + 2]
add r10d, edx
mov byte [rcx + 1], r10b
movzx r10d, r10b
movzx esi, byte [rcx + r10 + 2]
mov byte [rcx + rax + 2], sil
mov byte [rcx + r10 + 2], dl
add dl, byte [rcx + rax + 2]
movzx edx, dl
movzx eax, byte [rcx + rdx + 2]
xor al, byte [rbx + r11]
mov byte [r8 + r11], al
add r11, 1
cmp r9, r11
jne 0x2eda35390
pop rbx
pop rsi
ret