joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180022540
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rdx
mov rdi, rcx
cmp qword [rdx + 0x50], 0
jne 0x18002256f
lea rdx, [0x1801ca568]
jmp 0x180022573
mov rdx, qword [rdx + 0x40]
call sym.WebKeyAPICPPDLLx64.dll_public:_bool___cdecl_WKCertFileStorage::CertExists_char_const____ptr64____ptr64
test al, al
jne 0x1800225d7
mov ecx, 0x108
call fcn.180152604
mov qword [rsp + 0x48], rax
mov rdx, rbx
mov rcx, rax
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKCertData::constructor_class_WKCertData____ptr64____ptr64
mov rsi, rax
mov rdx, qword [rdi + 0x60]
cmp rdx, qword [rdi + 0x68]
jne 0x1800225b4
add rdx, qword [rdi + 0x70]
lea rcx, [rdi + 0x58]
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKArray_class_WKObject____ptr64____ptr64_::Grow_unsigned_long_long_unsigned___int64_____ptr64
mov rdx, qword [rdi + 0x60]
mov rax, qword [rdi + 0x58]
mov qword [rax + rdx*8], rsi
inc qword [rdi + 0x60]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp sym.WebKeyAPICPPDLLx64.dll_private:_void___cdecl_WKCertFileStorage::Save_void____ptr64
mov ecx, gethostname
call fcn.180152604
mov qword [rsp + 0x50], rax
lea r8, str.Certificate_already_exists
mov edx, 0x40d
mov rcx, rax
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKException::constructor_unsigned_int__char_const____ptr64____ptr64
nop
mov qword [rsp + 0x48], rax
lea rdx, [0x1802460c0]
lea rcx, [rsp + 0x48]
call fcn.180155078
int3
Function at 0x180023460
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x75f8
call fcn.1801532b0
sub rsp, rax
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0x75e0], rax
cmp byte [sym.WebKeyAPICPPDLLx64.dll_bool_WKDataPackage::m_bInited], 0
mov byte [rsp + 0xb0], 0
jne 0x180023637
lea rax, [rsp + 0x38]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareBIO_keyWKDPDebug
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180023582
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x4ed0]
mov dword [rsp + 0x30], 0x2710
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LogFileName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180023577
mov eax, dword [rsp + 0x34]
cmp eax, 2
jne 0x180023559
xor edx, edx
lea rcx, [rsp + 0x27c0]
mov r8d, 0x2710
call fcn.180154c10
mov r8d, 0x2710
lea rdx, [rsp + 0x27c0]
lea rcx, [rsp + 0x4ed0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x180023577
xor eax, eax
movzx ecx, byte [rsp + rax + 0x27c0]
mov byte [rsp + rax + 0xb0], cl
lea rax, [rax + 1]
test cl, cl
jne 0x180023540
jmp 0x180023577
cmp eax, 1
jne 0x180023577
xor eax, eax
movzx ecx, byte [rsp + rax + 0x4ed0]
mov byte [rsp + rax + 0xb0], cl
lea rax, [rax + 1]
test cl, cl
jne 0x180023560
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0xb0], 0
je 0x180023624
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x1801cbc0c]
mov edx, 0x64
mov r9d, eax
lea rcx, [rsp + 0x40]
call fcn.180023010
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rsp + 0xb0]
call fcn.180154428
test rax, rax
je 0x1800235c9
mov byte [rax], 0
lea r8, [rsp + 0x40]
mov edx, 0x2710
lea rcx, [rsp + 0xb0]
call fcn.180168188
lea r8, str..log
mov edx, 0x2710
lea rcx, [rsp + 0xb0]
call fcn.180168188
mov r9d, 1
mov byte [rsp + 0x28], 0
lea rdx, [0x1801cbc18]
mov dword [rsp + 0x20], 0x4a7
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
call sym.WebKeyAPICPPDLLx64.dll_public:_static_void___cdecl_BKLog::WebKeyAPISetLogFile_char_const____ptr64__char_const____ptr64__int__int__int__bool_
lea rcx, str.WEB_key_API_initialized_successfully.
mov byte [sym.WebKeyAPICPPDLLx64.dll_bool_WKDataPackage::m_bInited], 1
call sym.WebKeyAPICPPDLLx64.dll_public:_static_void___cdecl_BKLog::WKLogMsg_char_const____ptr64_
mov rcx, qword [rsp + 0x75e0]
xor rcx, rsp
call fcn.1801525d0
add rsp, 0x75f8
ret
Function at 0x1800280c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rsi, rcx
lea rax, vtable.WKSimpleSocket.0
mov qword [rcx], rax
lea rbx, [rcx + 8]
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call fcn.180154c10
lea rax, vtable.WKString.0
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 0
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea r9d, [r14 + 1]
lea r8d, [r14 + 4]
lea rdx, str.SOFTWAREBIO_keyWEB_key_d._dSettings
lea rcx, [rsp + 0x38]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
lea rdx, [0x1801ca568]
cmp qword [rsp + 0x58], r14
cmovne rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdi, str.localhost
test eax, eax
jne 0x1800281e2
mov dword [rsp + 0x80], 0x100
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call fcn.180154c10
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1800281d4
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call fcn.180154c10
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1800281f0
test rax, rax
jne 0x180028262
mov eax, 2
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rbx + 0x60], xmm0
lea rbx, [rbx + 0x80]
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [rbx - 0x10], xmm1
lea rdi, [rdi + 0x80]
sub rax, 1
jne 0x180028210
mov qword [rsi + 0x108], r14
mov dword [rsi + 0x110], r14d
cmp qword [rsp + 0x48], 0
je 0x180028282
mov rcx, qword [rsp + 0x48]
call fcn.1801525f4
mov rax, rsi
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x1800282f0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xd8
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rbp - 1], rax
mov rsi, r9
mov edi, r8d
mov r14, rdx
mov rbx, rcx
lea r13, vtable.WKString.0
mov qword [rbp - 0x51], r13
mov byte [rbp - 0x49], 0
xor r15d, r15d
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x31], r15
mov edx, r8d
lea rcx, str.Connecting_to_port__d
call sym.WebKeyAPICPPDLLx64.dll_public:_static_void___cdecl_BKLog::WKLogMsg_char_const____ptr64_
test edi, edi
jle 0x180028537
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov r12d, 2
mov word [rbp - 0x11], r12w
movzx ecx, di
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0xf], ax
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180028572
movsx r8, word [rax + 0x12]
mov rdx, qword [rax + 0x18]
mov rdx, qword [rdx]
lea rcx, [rbp - 0xd]
call fcn.1801547b0
lea edx, [r15 + 1]
lea r8d, [r15 + 6]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x108], rax
test rsi, rsi
je 0x18002844c
cmp byte [rsi], r15b
je 0x18002844c
xor eax, eax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov word [rbp - 0x21], r12w
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp - 0x1d], eax
movzx ecx, word [rbp + 0x7f]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x1f], ax
lea r8d, [r15 + 0x10]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbx + 0x108]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x18002844c
movzx edx, word [rbp - 0x1f]
lea rcx, str.Error:_Socket_bind_failed_on_port___d_._Retry...
call sym.WebKeyAPICPPDLLx64.dll_public:_static_void___cdecl_BKLog::WKLogMsg_char_const____ptr64_
xor ecx, ecx
mov ecx, gethostname
call fcn.180152604
mov qword [rsp + 0x38], rax
lea r8, str.port_must_be_greater_than_0.
mov edx, 0x40a
mov rcx, rax
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKException::constructor_unsigned_int__char_const____ptr64____ptr64
nop
mov qword [rsp + 0x30], rax
lea rdx, [0x1802460c0]
lea rcx, [rsp + 0x30]
call fcn.180155078
int3
mov qword [rbp - 0x79], r13
mov byte [rbp - 0x71], 0
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x59], r15
mov r8, r14
lea rdx, str.Invalid_host:__s
lea rcx, [rbp - 0x79]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
mov ecx, gethostname
call fcn.180152604
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, [rbp - 0x79]
call sym.WebKeyAPICPPDLLx64.dll_public:_char____ptr64___cdecl_WKString::operator_char____ptr64_void____ptr64
mov rdx, rax
mov rcx, rbx
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKSimpleSocketException::constructor_char_const____ptr64____ptr64
nop
mov qword [rsp + 0x30], rax
lea rdx, [0x180246280]
lea rcx, [rsp + 0x30]
call fcn.180155078
nop
Function at 0x180028780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
mov rcx, qword [rcx + 0x108]
test rcx, rcx
je 0x180028862
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1800287c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov edx, 2
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rdi + 0x108]

Function at 0x1800289e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
mov rcx, qword [rcx + 0x108]
test rcx, rcx
je 0x180028ac2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180028a20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov edx, 2
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_closesocket]
xor ecx, ecx
mov qword [rdi + 0x108], rcx
lea rax, vtable.WKString.0
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], cl
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
mov r8d, ebx
lea rdx, str.Error_writing_to_socket:__d
lea rcx, [rsp + 0x28]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
mov ecx, gethostname
call fcn.180152604
mov rbx, rax
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x28]
call sym.WebKeyAPICPPDLLx64.dll_public:_char____ptr64___cdecl_WKString::operator_char____ptr64_void____ptr64
mov rdx, rax
mov rcx, rbx
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKSimpleSocketException::constructor_char_const____ptr64____ptr64
nop
mov qword [rsp + 0x60], rax
lea rdx, [0x180246280]
lea rcx, [rsp + 0x60]
call fcn.180155078
nop
mov ecx, gethostname
call fcn.180152604
mov qword [rsp + 0x78], rax
lea rdx, str.Socket_not_connected.
mov rcx, rax
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKSimpleSocketException::constructor_char_const____ptr64____ptr64
nop
mov qword [rsp + 0x60], rax
lea rdx, [0x180246280]
lea rcx, [rsp + 0x60]
call fcn.180155078
int3
Function at 0x180028c30
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov rdi, rcx
lea rdx, [rcx + 0x110]
xor esi, esi
mov dword [rdx], esi
mov rax, qword [rcx + 0x108]
mov qword [rcx + 0x118], rax
inc dword [rdx]
mov dword [r11 + 8], esi
mov dword [r11 + 0xc], 0x186a0
mov ecx, dword [rcx + 0x108]
inc ecx
lea rax, [r11 + 8]
mov qword [r11 - 0x58], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x180028c94
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
cmp eax, 0xffffffff
je 0x180028ca3
mov al, 1
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov edx, 2
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x108], rsi
lea rax, vtable.WKString.0
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov r8d, ebx
lea rdx, str.Error_waiting_to_read_from_socket:__d
lea rcx, [rsp + 0x38]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
mov ecx, gethostname
call fcn.180152604
mov rbx, rax
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x38]
call sym.WebKeyAPICPPDLLx64.dll_public:_char____ptr64___cdecl_WKString::operator_char____ptr64_void____ptr64
mov rdx, rax
mov rcx, rbx
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKSimpleSocketException::constructor_char_const____ptr64____ptr64
nop
mov qword [rsp + 0x88], rax
lea rdx, [0x180246280]
lea rcx, [rsp + 0x88]
call fcn.180155078
int3
Function at 0x180028d50
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov rdi, rcx
lea r8, [rcx + 0x110]
xor esi, esi
mov dword [r8], esi
mov rax, qword [rcx + 0x108]
mov qword [rcx + 0x118], rax
inc dword [r8]
mov dword [r11 + 8], esi
mov dword [r11 + 0xc], 0x186a0
mov ecx, dword [rcx + 0x108]
inc ecx
lea rax, [r11 + 8]
mov qword [r11 - 0x58], rax
xor r9d, r9d
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x180028db5
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
cmp eax, 0xffffffff
je 0x180028dc4
mov al, 1
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov edx, 2
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rdi + 0x108]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x108], rsi
lea rax, vtable.WKString.0
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov r8d, ebx
lea rdx, str.Error_waiting_to_write_to_socket:__d
lea rcx, [rsp + 0x38]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
mov ecx, gethostname
call fcn.180152604
mov rbx, rax
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x38]
call sym.WebKeyAPICPPDLLx64.dll_public:_char____ptr64___cdecl_WKString::operator_char____ptr64_void____ptr64
mov rdx, rax
mov rcx, rbx
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKSimpleSocketException::constructor_char_const____ptr64____ptr64
nop
mov qword [rsp + 0x88], rax
lea rdx, [0x180246280]
lea rcx, [rsp + 0x88]
call fcn.180155078
int3

Function at 0x180029e40
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9d, dword [rcx + 0x20]
xor eax, eax
mov r8, qword [rcx + 0x10]
mov rdi, rcx
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, eax
xor ecx, ecx
mov esi, eax
call qword [sym.imp.WS2_32.dll_connect]
mov rbx, rax
test rax, rax
je 0x180029ea1
mov r9d, dword [rdi + 0x20]
xor edx, edx
mov r8, qword [rdi + 0x10]
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
Function at 0x180040660
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rcx, qword [rcx + 8]
lea rdi, [0x1801ca568]
test rcx, rcx
jne 0x1800406e5
cmp qword [rbx + 0x58], r15
mov rcx, rdi
je 0x1800406c6
mov rcx, qword [rbx + 0x48]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1800406f3
mov qword [rbx + 8], r15
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]

Function at 0x18005b2e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x75f8
call fcn.1801532b0
sub rsp, rax
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0x75e0], rax
cmp byte [sym.WebKeyAPICPPDLLx64.dll_bool_WebKeyAPI::m_bInited], 0
mov byte [rsp + 0xb0], 0
jne 0x18005b504
lea rax, [rsp + 0x38]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareBIO_keyWEB_keyAPIDebug
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18005b402
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x4ed0]
mov dword [rsp + 0x30], 0x2710
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LogFileName
Function at 0x180074c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x19], rdx
mov rdx, qword [rdx]
test rdx, rdx
je 0x180074d97
movsxd rax, dword [rdx + 8]
cmp eax, 0x20
jne 0x180074d97
mov r8, rax
mov rdx, qword [rdx]
lea rcx, [rbp + 0x17]
call fcn.1801547b0
mov dword [rbp - 9], 0xb701fa32
mov dword [rbp - 5], 0xa904e84
mov dword [rbp - 1], 0xb1c7405c
mov dword [rbp + 3], 0xfaaf2488
mov dword [rbp + 7], 0x915053bd
mov dword [rbp + 0xb], 0x62071139
mov dword [rbp + 0xf], 0xd6f36c6a
mov dword [rbp + 0x13], 0x84029d3
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm1, xmmword [rbp + rax - 9]
movdqu xmm0, xmmword [rbp + rax + 0x17]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x17], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x180074d10
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x29], eax
xor byte [rbp + 0x17], al
movzx edx, byte [rbp - 0x28]
xor byte [rbp + 0x18], dl
movzx edx, byte [rbp - 0x27]
xor byte [rbp + 0x19], dl
movzx edx, byte [rbp - 0x26]
xor byte [rbp + 0x1a], dl
mov qword [rbx], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rbp + 0x17]
mov rcx, rbx
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKBinary::SetData_unsigned_char____ptr64__int____ptr64
nop
mov rcx, rdi
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKBinary::Clear_void____ptr64
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1801525d0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
mov ecx, gethostname
call fcn.180152604
mov qword [rbp - 0x11], rax
lea r8, str.Key_is_not_256_bits__32_bytes__long
mov edx, 0x5e8
mov rcx, rax
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKException::constructor_unsigned_int__char_const____ptr64____ptr64
nop
mov qword [rbp - 0x29], rax
lea rdx, [0x1802460c0]
lea rcx, [rbp - 0x29]
call fcn.180155078
int3

Function at 0x180077050
Capabilities:
Delete file
Read file on windows

Disassembly:
mov rcx, rdx
lea rdx, [0x1801d5838]
jmp sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKCertFileStorage::Open_char_const____ptr64____ptr64
Function at 0x180077f20
Capabilities:
Write file on windows

Disassembly:
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WebKeyAPI::CacheMime_class_WebKeyMime____ptr64____ptr64
add rcx, 0x700
lea rdx, [0x1801ca568]
jmp sym.WebKeyAPICPPDLLx64.dll_protected:_void___cdecl_WKString::Set_char_const____ptr64____ptr64
Function at 0x1800786b0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
xor edi, edi
mov dword [rax + 8], edi
cmp dword [rcx + 0x360], 1
jne 0x180078843
mov rcx, qword [rcx + 0x7f0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + Ordinal_41]
nop
mov dl, 0x5c
lea rcx, [rsp + 0x78]
call sym.WebKeyAPICPPDLLx64.dll_public:_void___cdecl_WKString::constructor_char____ptr64
mov rbx, rax
mov ebp, 1
cmp qword [rsp + 0x40], rbp
cmovb rbp, qword [rsp + 0x40]
lea r15, vtable.WKString.0
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x58], dil
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0xc0], 1
mov qword [rsp + 0x70], rbp
lea rcx, [rbp + 1]
mov qword [rsp + 0x68], rcx
call fcn.180152710
mov r14, rax
mov rdx, qword [rsp + 0x30]
sub rdx, rbp
add rdx, qword [rsp + 0x40]
mov r8, rbp
mov rcx, rax
call fcn.1801547b0
mov byte [r14 + rbp], dil
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x18007878a
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [r8 + rdi], 0
jne 0x180078780
test rbp, rbp
jne 0x180078798
test rdi, rdi
jne 0x1800787bd
xor bl, bl
jmp 0x1800787bf
test rdi, rdi
je 0x1800787bd
mov rax, r14
sub r8, r14
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800787b6
inc rax
test ecx, ecx
jne 0x1800787a3
test edx, edx
setne bl
jmp 0x1800787bf
mov bl, 1
test r14, r14
je 0x1800787cd
mov rcx, r14
call fcn.1801525f4
nop
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1800787e4
call fcn.1801525f4
test bl, bl
je 0x1800787f4
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::operator_char____ptr64
lea rbx, [0x1801ca568]
cmp qword [rsi + 0x720], 0
mov rdx, rbx
je 0x18007880f
mov rdx, qword [rsi + 0x710]
lea rcx, [rsp + 0x20]
call sym.WebKeyAPICPPDLLx64.dll_protected:_void___cdecl_WKString::Concate_char_const____ptr64____ptr64
cmp qword [rsp + 0x40], 0
cmovne rbx, qword [rsp + 0x30]
mov rcx, rbx