joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.0040bf00
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x444164
mov ecx, dword [rbp + 0xd8]
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x78]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x444220
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4441be
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x4441be
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x444233
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x1f4
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x70]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x4440fe
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.0040be70
lea rcx, [rbp + 0xd0]
call fcn.0040bd90
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x444530
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.0040bf00
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x4445e3
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x78]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x44469f
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x44463d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x44463d
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x4446b2
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x70]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x44457e
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.0040be70
lea rcx, [rbp + 0xd0]
call fcn.0040bd90
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x4449b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov dword [rbp + 0x48], r9d
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0xa8], rdx
mov qword [rbp + 0xb0], r8
lea rcx, [rbp + 0xa8]
call fcn.0040bf00
lea rcx, [rbp + 0xb0]
call fcn.0040bf00
nop
mov al, 1
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x444a91
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.0040d230
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x88]
call fcn.0040d180
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x444a91
mov eax, 0x80
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
and eax, 1
cmp eax, 1
jne 0x444b5c
mov eax, dword [rbp + 0x48]
and eax, 0xfffffffe
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
test eax, eax
jne 0x444ab8
mov eax, 0x80
mov dword [rbp + 0x48], eax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.0040d230
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x78]
call fcn.0040d180
mov rcx, rax
mov edx, dword [rbp + 0x48]
call sub.kernel32.dll_SetFileAttributesW
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.0040d230
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x68]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x444bcc
jmp 0x444bc6
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.0040d230
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x58]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x444bcc
xor eax, eax
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.0040be70
lea rcx, [rbp + 0xa8]
mov edx, 2
call fcn.0040be70
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x444e20
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x70], rcx
lea rcx, [rbp + 0x70]
call fcn.0040bf00
nop
or rax, 0xffffffffffffffff
mov qword [rbp + 0x20], rax
mov bl, 0xa
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
call fcn.00444c40
mov rcx, qword [rbp + 0x28]
call fcn.0040d180
mov rcx, rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x40]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x444e81
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x20], rax
jmp 0x444e94
mov ecx, 0x64
call sub.kernel32.dll_Sleep
sub bl, 1
test bl, bl
jne 0x444e49
nop
nop
lea rcx, [rbp + 0x28]
call fcn.0040bd90
lea rcx, [rbp + 0x70]
call fcn.0040bd90
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x44f2c0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x28
mov cx, 0x101
mov rax, qword [0x00465110]
lea rdx, [rax + 0x148]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x44f2ed
mov rax, qword [0x00465110]
mov byte [rax + 0x12c], 1
add rsp, 0x28
ret

Function at 0x450320
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x70], rcx
lea rcx, [rbp + 0x70]
call fcn.0040bf00
nop
or rax, 0xffffffffffffffff
mov qword [rbp + 0x20], rax
mov bl, 0xa
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
call fcn.00450140
mov rcx, qword [rbp + 0x28]
call fcn.0040d180
mov rcx, rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x40]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x450381
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x20], rax
jmp 0x450394
mov ecx, 0x64
call sub.kernel32.dll_Sleep
sub bl, 1
test bl, bl
jne 0x450349
nop
nop
lea rcx, [rbp + 0x28]
call fcn.0040bd90
lea rcx, [rbp + 0x70]
call fcn.0040bd90
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x450590
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rsp
movdqa xmmword [rbp + 0x70], xmm6
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0xb0], rcx
lea rcx, [rbp + 0xb0]
call fcn.0040bf00
nop
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x45060a
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0xb0]
call fcn.0040d820
mov rcx, qword [rbp + 0x48]
xor edx, edx
call fcn.00438b50
mov rcx, qword [rbp + 0xb0]
call fcn.00450320
mov rbx, rax
test rbx, rbx
jg 0x45064e
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x4507f4
lea rcx, [0x004508a8]
xor edx, edx
call fcn.00438b50
xor ecx, ecx
xor edx, edx
call fcn.00438b50
jmp 0x4507f4
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xb0]
call fcn.004503f0
test al, al
jne 0x450692
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x4507f4
lea rcx, [0x00450944]
xor edx, edx
call fcn.00438b50
xor ecx, ecx
xor edx, edx
call fcn.00438b50
jmp 0x4507f4
lea rcx, [rbp + 0x60]
mov rdx, qword [0x0042eec0]
call fcn.00410600
lea rcx, [rbp + 0x60]
mov rdx, qword [0x0042eec0]
mov r8d, 1
mov r9d, 0x100000
call fcn.00410430
xor esi, esi
mov dil, 1
lea rcx, [0x004509e0]
xor edx, edx
call fcn.00438930
jmp 0x45078a
mov rcx, qword [rbp + 0x68]
mov rdx, rsi
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov r8d, 0x100000
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
add rsi, 0x100000
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x45078a
cmp rsi, rbx
jle 0x450727
mov rsi, rbx
cvtsi2sd xmm6, rsi
cvtsi2sd xmm0, rbx
divsd xmm6, xmm0
mulsd xmm6, qword [0x00450840]
jmp 0x45077c
movzx rax, dil
mov ecx, 0xa
xor edx, edx
div ecx
test edx, edx
jne 0x45076a
lea rcx, [rbp + 0x40]
movzx rdx, dil
call fcn.004225b0
mov rcx, qword [rbp + 0x40]
xor edx, edx
call fcn.00438930
jmp 0x450778
lea rcx, [0x004509f0]
xor edx, edx
call fcn.00438930
add dil, 1
movzx rax, dil
cvtsi2sd xmm0, eax
comisd xmm6, xmm0
jae 0x45073f
cmp rsi, rbx
jl 0x4506d6
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0xb0]
lea r8, [0x004509f8]
call fcn.0040d230
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x38]
call fcn.0040d180
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x4507f3
xor ecx, ecx
xor edx, edx
call fcn.00438b50
xor ecx, ecx
xor edx, edx
call fcn.00438b50
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040be70
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040bdd0
lea rcx, [rbp + 0x60]
mov rdx, qword [0x0042eec0]
call fcn.00410600
lea rcx, [rbp + 0xb0]
call fcn.0040bd90
movdqa xmm6, xmmword [rbp + 0x70]
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x450cb0
Capabilities:
Terminate process

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2b0
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
nop
mov ecx, 2
xor edx, edx
call fcn.00438360
mov rbx, rax
mov dword [rbp + 0x78], 0x238
mov rcx, rbx
lea rdx, [rbp + 0x78]
call fcn.00438390
jmp 0x450e70
xor eax, eax
mov rcx, qword [0x00465110]
mov rcx, qword [rcx + 0x48]
mov r13d, dword [rcx + 0x10]
sub r13d, 1
mov esi, eax
cmp esi, r13d
jg 0x450e63
sub r13d, eax
add r13d, 1
movsxd rdi, esi
lea rcx, [rbp + 0x60]
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x48]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rdi*8]
call fcn.0040d850
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.004220f0
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0xa4]
mov r8d, 0x104
call fcn.0040d110
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.004220f0
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x58]
call fcn.0040d640
test eax, eax
je 0x450e36
lea rcx, [rbp + 0x40]
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x48]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rdi*8]
call fcn.0040d850
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.004220f0
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0xa4]
mov r8d, 0x104
call fcn.0040d7b0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.00422b70
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x30]
call fcn.0040d850
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x20]
call fcn.004220f0
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
call fcn.0040d640
test eax, eax
jne 0x450e53
mov ecx, 1
xor edx, edx
mov r8d, dword [rbp + 0x80]
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
add esi, 1
sub r13d, 1
test r13d, r13d
jne 0x450d5f
nop
mov rcx, rbx
lea rdx, [rbp + 0x78]
call fcn.004383c0
test eax, eax
jne 0x450d38
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x20]
call fcn.0040bd90
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040bdd0
lea rcx, [rbp + 0x38]
mov edx, 7
call fcn.0040be70
lea rsp, [rbp + 0x2b0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x140003f00
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400bb008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
xor eax, eax
mov qword [rsp + 0x38], rax
call fcn.140003520
mov rcx, rax
test rax, rax
je 0x1400040f0
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9, rbx
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140081910]
lea rcx, [rsp + 0x38]
call fcn.140004c30
mov rsi, qword [rsi + 8]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x140003fab
mov r8d, 0xf0
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140026f80
jmp 0x1400040bb
test rbp, rbp
jne 0x140003fb8
mov r8d, 0xf1
jmp 0x140003f93
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1400423f0
test eax, eax
jne 0x14000400a
mov rdx, rbx
mov rcx, rsi
call fcn.140041c40
test eax, eax
jne 0x14000400a
mov r8d, 0xfa
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140026f80
nop
jmp 0x1400040bb
mov r9d, 2
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400222c0
test eax, eax
je 0x140004050
mov r8d, 0xff
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140026f80
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400040bb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1400040bb
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x1400040a8
mov r8d, 0x103
lea rdx, str.CRegClient::SetRegBinary
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140026f80
nop
test rsi, rsi
je 0x1400040bb
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1400040bb
test rsi, rsi
je 0x1400040b6
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400040d6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140065bd0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140003270
int3
Function at 0x140004e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test rax, rax
jne 0x140004e63
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140004eaa
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140004ea5
nop
cmp rbx, rcx
jae 0x140004eaa
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140004e90
cmp rbx, rcx
jb 0x140004eae
xor eax, eax
jmp 0x140004eba
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a3a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400bb008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor edi, edi
add rcx, 8
mov dword [rcx + 0x28], edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [rbx + 0x38], rdi
lea rax, vtable.CAsyncEventNotifyBase.0
mov qword [rbx], rax
lea r8, [0x14000a5a0]
mov qword [rbx + 0x40], rdi
lea rax, [rsp + 0x30]
mov dword [rbx + 0x48], edi
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov dword [rbx + 0x78], 0xa
mov dword [rsp + 0x30], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x38], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbx + 0x40], rax
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140065bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000e000
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test rdx, rdx
mov rbx, rcx
lea rdx, str.CAudioDeviceMuteStateHandler::OnRemoveDevice
jne 0x14000e02c
mov r8d, 0xff
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140026f80
mov r8d, 0x101
lea rcx, [0x140081b98]
call fcn.140026f80
cmp dword [rbx + 0x30], 0
je 0x14000e05c
call fcn.1400085d0
mov rcx, rax
mov edx, 0x3fd
mov r8d, 0xc8
call fcn.14005ea10
cmp dword [rbx + 0x2c], 0
je 0x14000e07f
call fcn.1400085d0
mov rcx, rax
mov edx, 0x3fe
mov r8d, 0xc8
add rsp, 0x20
pop rbx
jmp fcn.14005ea10
add rsp, 0x20
pop rbx
ret
Function at 0x140013780
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rdx, rdx
jne 0x1400137aa
lea r8d, [rdx + 0x4a]
lea rdx, str.CControlChangeEventNotify::OnAddDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
jmp fcn.140026f80
mov qword [rsp + 0x30], rbx
lea rbx, [rdx + 0xd0]
mov rax, qword [rbx + 0x48]
test rax, rax
jne 0x1400137cb
mov rcx, rbx
call fcn.14000bef0
mov rax, qword [rbx + 0x48]
cmp qword [rax + 0x10], 0
mov rbx, qword [rsp + 0x30]
jbe 0x1400137f8
mov rcx, qword [rax]
test rcx, rcx
je 0x1400137fe
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400137f8
mov rax, qword [rcx]
lea rdx, [rdi - 8]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003270
int3

Function at 0x140013810
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rdx, rdx
jne 0x14001383a
lea r8d, [rdx + 0x59]
lea rdx, str.CControlChangeEventNotify::OnRemoveDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rdi
jmp fcn.140026f80
mov qword [rsp + 0x30], rbx
lea rbx, [rdx + 0xd0]
mov rax, qword [rbx + 0x48]
test rax, rax
jne 0x14001385b
mov rcx, rbx
call fcn.14000bef0
mov rax, qword [rbx + 0x48]
cmp qword [rax + 0x10], 0
mov rbx, qword [rsp + 0x30]
jbe 0x140013888
mov rcx, qword [rax]
test rcx, rcx
je 0x14001388e
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140013888
mov rax, qword [rcx]
lea rdx, [rdi - 8]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003270
int3
Function at 0x14001b110
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14001b209
call fcn.1400135e0
mov rbx, rax
test rax, rax
jne 0x14001b168
mov r8d, 0x8a
lea rdx, str.CCustomizeHuawei::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.140026f80
mov edx, edi
mov rcx, rbx
call fcn.140028c30
imul rcx, rdi, 0xac
movzx ebx, word [rcx + rbx + 0x100]
shr ebx, 1
and ebx, 1
xor eax, eax
mov qword [rsp + 0x38], rax
call fcn.140003520
mov rcx, rax
test rax, rax
je 0x14001b214
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140081910]
lea rcx, [rsp + 0x38]
call fcn.140004c30
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x1400bf598]
call fcn.1400419e0
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001b209
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003270
int3