joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012970
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.SetupAPI.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140357538], rax
test rax, rax
je 0x140012a77
lea rdx, str.SetupDiGetClassDevsW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140357720], rax
test rax, rax
je 0x140012a57
mov rcx, qword [0x140357538]
lea rdx, str.SetupDiEnumDeviceInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140357710], rax
test rax, rax
je 0x140012a57
mov rcx, qword [0x140357538]
lea rdx, str.SetupDiGetDeviceRegistryPropertyW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403576f8], rax
test rax, rax
je 0x140012a57
mov rcx, qword [0x140357538]
lea rdx, str.SetupDiDestroyDeviceInfoList
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140357700], rax
test rax, rax
je 0x140012a57
mov rcx, qword [0x140357538]
lea rdx, str.SetupDiEnumDeviceInterfaces
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140357708], rax
test rax, rax
je 0x140012a50
mov rcx, qword [0x140357538]
lea rdx, str.SetupDiGetDeviceInterfaceDetailW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140357718], rax
mov al, 1
add rsp, 0x28
ret
mov rax, qword [0x140357538]
test rax, rax
je 0x140012a77
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140357538], 0
xor al, al
add rsp, 0x28
ret
Function at 0x140020200
Capabilities:
Start service

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov qword [rsp + 0x118], rbx
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov qword [rbp - 0x31], rdx
xor r14b, r14b
mov rcx, qword [rcx + 8]
xor r15d, r15d
test rcx, rcx
je 0x140020341
cmp qword [rdx + 0x18], 8
jb 0x140020256
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rbp - 0x21], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
movdqa xmmword [rbp + 7], xmm0
mov qword [rbp - 0x39], r15
mov r8, r15
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x1400202aa
mov qword [rbp - 0x71], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x39], rax
lea r8, [rbp - 0x71]
mov rcx, rsi
mov qword [rbp - 0x29], rcx
mov rbx, r15
mov qword [rbp + 0x17], rbx
test r8, r8
je 0x1400202ef
mov qword [rbp - 0x21], rdx
mov rax, qword [r8 + 8]
mov qword [rbp - 0x19], rax
lea rbx, [rbp - 0x21]
mov qword [rbp + 0x17], rbx
lea rax, [rbp - 0x71]
cmp r8, rax
je 0x1400202ef
mov edx, 0x10
mov rcx, r8
call fcn.1401218ec
mov rbx, qword [rbp + 0x17]
mov rcx, qword [rbp - 0x29]
test rsi, rsi
je 0x140020310
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
setne r14b
mov rbx, qword [rbp + 0x17]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140020325
test rbx, rbx
je 0x1400203b3
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x17]
test rbx, rbx
je 0x140020341
lea rax, [rbp - 0x21]
cmp rbx, rax
je 0x140020341
mov edx, 0x10
mov rcx, rbx
call fcn.1401218ec
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14002037c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140020377
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400203b9
mov rcx, r8
call fcn.1401218ec
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
movzx eax, r14b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140121cc0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ffb0c
nop
call fcn.1401431ac
int3
Function at 0x1400203c0
Capabilities:
Stop service

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x138], rbx
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov qword [rbp - 0x51], rdx
xor r14b, r14b
mov rcx, qword [rcx + 8]
xor r15d, r15d
test rcx, rcx
je 0x14002051a
cmp qword [rdx + 0x18], 8
jb 0x140020417
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rbp - 0x59], r15
mov r8, r15
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x14002046f
mov qword [rsp + 0x28], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rbp - 0x59], rax
lea r8, [rsp + 0x28]
mov rcx, rsi
mov qword [rbp - 0x49], rcx
mov rbx, r15
mov qword [rbp - 9], rbx
test r8, r8
je 0x1400204b5
mov qword [rbp - 0x41], rdx
mov rax, qword [r8 + 8]
mov qword [rbp - 0x39], rax
lea rbx, [rbp - 0x41]
mov qword [rbp - 9], rbx
lea rax, [rsp + 0x28]
cmp r8, rax
je 0x1400204b5
mov edx, 0x10
mov rcx, r8
call fcn.1401218ec
mov rbx, qword [rbp - 9]
mov rcx, qword [rbp - 0x49]
test rsi, rsi
je 0x1400204e9
xor eax, eax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], eax
lea r8, [rbp + 7]
lea edx, [rax + 1]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
setne r14b
mov rbx, qword [rbp - 9]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400204fe
test rbx, rbx
je 0x14002058c
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x14002051a
lea rax, [rbp - 0x41]
cmp rbx, rax
je 0x14002051a
mov edx, 0x10
mov rcx, rbx
call fcn.1401218ec
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140020555
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140020550
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140020592
mov rcx, r8
call fcn.1401218ec
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
movzx eax, r14b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140121cc0
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ffb0c
nop
call fcn.1401431ac
int3
Function at 0x140020810
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x61], rdx
xor r15b, r15b
mov dword [r8], 0xffffffff
mov rcx, qword [rcx + 8]
xor r12d, r12d
test rcx, rcx
je 0x140020971
cmp qword [rdx + 0x18], 8
jb 0x14002086c
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rbp - 0x51], r12
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x69], r12
mov rcx, r12
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r12
je 0x1400208c7
mov qword [rsp + 0x28], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rbp - 0x69], rax
lea rcx, [rsp + 0x28]
mov qword [rbp - 0x59], rsi
mov rbx, r12
mov qword [rbp - 0x19], rbx
test rcx, rcx
je 0x140020903
mov qword [rbp - 0x51], rdx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x49], rax
lea rbx, [rbp - 0x51]
mov qword [rbp - 0x19], rbx
lea rax, [rsp + 0x28]
cmp rcx, rax
je 0x140020903
mov edx, 0x10
call fcn.1401218ec
mov rbx, qword [rbp - 0x19]
test rsi, rsi
je 0x14002093a
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
lea rdx, [rbp - 9]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne r15b
mov rbx, qword [rbp - 0x19]
test eax, eax
je 0x14002093a
mov eax, dword [rbp - 5]
mov dword [r14], eax
cmp qword [rbp - 0x59], 0
je 0x140020955
test rbx, rbx
je 0x1400209de
mov rcx, qword [rbp - 0x59]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x140020971
lea rax, [rbp - 0x51]
cmp rbx, rax
je 0x140020971
mov edx, 0x10
mov rcx, rbx
call fcn.1401218ec
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400209ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400209a7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400209e4
mov rcx, r8
call fcn.1401218ec
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
movzx eax, r15b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400ffb0c
nop
call fcn.1401431ac
int3
Function at 0x1400209f0
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r8
mov rdi, rdx
mov qword [rsp + 0x38], rdx
xor r15b, r15b
xor r12d, r12d
mov dword [r8], r12d
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140020b64
cmp qword [rdx + 0x18], 8
jb 0x140020a49
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rbp - 0x71], r12
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmmword [rbp - 0x49], xmm0
mov qword [rbp + 0xf], r12
mov rcx, r12
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r12
je 0x140020aa0
mov qword [rbp - 0x29], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0xf], rax
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x79], rsi
mov rbx, r12
mov qword [rbp - 0x39], rbx
test rcx, rcx
je 0x140020adb
mov qword [rbp - 0x71], rdx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x69], rax
lea rbx, [rbp - 0x71]
mov qword [rbp - 0x39], rbx
lea rax, [rbp - 0x29]
cmp rcx, rax
je 0x140020adb
mov edx, 0x10
call fcn.1401218ec
mov rbx, qword [rbp - 0x39]
test rsi, rsi
je 0x140020b2d
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp - 0x29]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
setne r15b
mov rbx, qword [rbp - 0x39]
test eax, eax
je 0x140020b2d
mov eax, dword [rbp - 0xd]
mov dword [r14], eax
cmp qword [rbp - 0x79], 0
je 0x140020b48
test rbx, rbx
je 0x140020bd1
mov rcx, qword [rbp - 0x79]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x140020b64
lea rax, [rbp - 0x71]
cmp rbx, rax
je 0x140020b64
mov edx, 0x10
mov rcx, rbx
call fcn.1401218ec
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140020b9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140020b9a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140020bd7
mov rcx, r8
call fcn.1401218ec
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
movzx eax, r15b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400ffb0c
nop
call fcn.1401431ac
int3
Function at 0x1400214c0
Capabilities:
Access the windows event log

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0xf0], rax
movzx esi, dx
mov r14d, r9d
mov rdx, qword [rsp + 0x150]
movzx ebp, r8w
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x1400214ff
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14002160a
cmp qword [rbx + 0x18], 8
jb 0x14002151d
mov rbx, qword [rbx]
xor eax, eax
mov qword [rsp + 0x98], rbx
xor ebx, ebx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x90], rbx
cmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource], rax
je 0x1400215a7
lea rax, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64___int__void____ptr64_.0
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400149d0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov dword [rsp + 0x30], ebx
mov r9d, r14d
mov word [rsp + 0x28], cx
movzx r8d, bp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
movzx edx, si
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, 1
lea rcx, [rsp + 0xa0]
sete bl
call fcn.140014900
movzx eax, bl
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x100
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400216d0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xb0
call fcn.140140210
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140021761
mov rax, qword [rsp + 0x80]
add rax, qword [rsp + 0x78]
add rax, qword [rsp + 0x70]
add rax, qword [rsp + 0x68]
add rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x58]
add rax, qword [rsp + 0x50]
add rax, qword [rsp + 0x48]
shl rax, 0xc
dec rax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0xe8
ret
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0xe8
ret
Function at 0x140027990
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, r9
mov rsi, r8
xor eax, eax
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
cmp qword [rdx + 0x18], 8
jb 0x1400279df
mov rdx, qword [rdx]
mov r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14002bdb0
mov edi, eax
test eax, eax
jne 0x140027b1b
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rsp + 0x60]
call fcn.140023900
nop
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
sub rax, rbx
sar rax, 1
cmp qword [rsi + 0x18], 8
jb 0x140027a3f
mov rsi, qword [rsi]
add eax, eax
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, rsi
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140027acb
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 1
jbe 0x140027a85
mov edi, SafeArrayDestroy
jmp 0x140027acb
test rbx, rbx
je 0x140027aac
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140027aa8
test al, 1
jne 0x140027aa1
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x140027aac
mov edi, SafeArrayDestroy
jmp 0x140027acb
mov word [rbx], r14w
mov edi, r14d
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x140027ab6
mov rdx, rbx
mov rcx, rbp
call fcn.1400150c0
test rsi, rsi
je 0x140027adc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r14
test rbx, rbx
je 0x140027b20
mov rax, qword [rsp + 0x70]
sub rax, rbx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140027b11
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027b4b
mov rcx, rbx
call fcn.1401218ec
jmp 0x140027b20
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140027b2e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1401431ac
nop
int3
Function at 0x140027b60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
jb 0x140027b99
mov rdx, qword [rdx]
mov r8, rdx
mov r9d, 0x20019
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14002bdb0
mov edi, eax
test eax, eax
jne 0x140027c16
cmp qword [rbx + 0x18], 8
jb 0x140027bbf
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140027c04
cmp dword [rsp + 0x34], 4
mov ebx, ebp
mov eax, SafeArrayDestroy
cmovne ebx, eax
test rdi, rdi
je 0x140027c12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140027c28
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140027c28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140027c40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov dword [rsp + 0x30], r9d
cmp qword [rdx + 0x18], 8
mov esi, r9d
mov rdi, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
jb 0x140027c7e
mov rdx, qword [rdx]
mov r8, rdx
mov r9d, 0x20019
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14002bdb0
mov ebx, eax
test eax, eax
jne 0x140027cf8
cmp qword [rdi + 0x18], 8
jb 0x140027ca4
mov rdi, qword [rdi]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
mov rdx, rdi
lea rax, [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140027cee
cmp dword [rsp + 0x38], 4
mov ebx, ebp
mov eax, SafeArrayDestroy
cmovne ebx, eax
test rdi, rdi
je 0x140027d08
mov rcx, rdi
jmp 0x140027d02
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140027d08
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
test ebx, ebx
cmovne eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140027dd0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
xor sil, sil
cmp qword [rdx + 0x18], 8
mov edi, r9d
mov rbx, r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
jb 0x140027e0b
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rax
mov r8, rdx
mov qword [rsp + 0x30], rax
mov rdx, rcx
mov dword [rsp + 0x28], 0x20006
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.14002bc30
test eax, eax
jne 0x140027e93
cmp qword [rbx + 0x18], 8
jb 0x140027e42
mov rbx, qword [rbx]
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r9d, 4
mov rcx, rdi
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, sil
mov ecx, 1
test eax, eax
cmove ebx, ecx
test rdi, rdi
je 0x140027e8e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x140027ea7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140027ea3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140027ec0
Capabilities:
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x68
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbx, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
jb 0x140027ef7
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rax
mov r8, rdx
mov qword [rsp + 0x30], rax
mov rdx, rcx
mov dword [rsp + 0x28], 0x20006
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.14002bc30
test eax, eax
jne 0x140027fa0
cmp qword [rbx + 0x18], 8
jb 0x140027f2e
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x140027f38
mov rdi, qword [rdi]
test rbx, rbx
jne 0x140027f42
lea eax, [rbx + 0xd]
jmp 0x140027f83
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140027f50
mov rcx, qword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
cmp qword [rsp + 0x40], 0
je 0x140027f9b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x140027fb2
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140027fb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140121cc0
add rsp, 0x68
pop rdi
pop rbx
ret