joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4e20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400a5580
test rax, rax
jne 0x1400a4e85
mov ecx, 0xa0c
call fcn.1400c0f54
lea rcx, [rdi + 8]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
mov rdx, rbx
call fcn.1400a6220
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1400a4e85
lea r8d, [rax + 0x6c]
lea rdx, str.CRtkEffectConditionsBase::ResetConditions
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005f240
mov rdx, rax
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400a4ea0

Function at 0x1400a5a40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call fcn.14000b520
mov rdx, rbx
call fcn.140090350
mov rdi, rax
test rax, rax
jne 0x1400a5a92
mov r8d, 0x1b0
lea rdx, str.CRtkEffectConditionsBase::SaveCondToPropertyStore
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14005f240
mov rdx, rbx
mov rcx, rsi
call fcn.1400a5580
test rax, rax
jne 0x1400a5aaa
mov r8d, 0x1b3
jmp 0x1400a5a70
cmp dword [rax], 0
jg 0x1400a5ab7
mov r8d, 0x1b4
jmp 0x1400a5a70
lea rcx, [rdi + 0x10]
mov dword [rsp + 0x20], 1
mov r9d, 0xa0c
lea rdx, [0x1400dfe58]
mov r8, rax
call fcn.140003700
test eax, eax
jne 0x1400a5af8
mov r9, rbx
lea rdx, str.CRtkEffectConditionsBase::SaveCondToPropertyStore
mov r8d, 0x1b8
lea rcx, str._s__d_EpId_s_set_PKEY_RTK_BSS_CONDITIONS_GUID_VALUE_ARRAY_V3_failed
call fcn.14005f240
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a8ae0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x30], rcx
lea rax, vtable.CSimpleOrientationSensorManagerEvents.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], SafeArrayUnaccessData
mov dword [rcx + 0x58], ebp
mov dword [rcx + 0x5c], 0xa
mov qword [rcx + 0x60], rbp
mov qword [rcx + 0x68], rbp
mov dword [rcx + 0x3c], 0x3f400000
mov dword [rcx + 0x40], 0x3e800000
mov dword [rcx + 0x44], 0x40100000
xor ecx, ecx
movss xmm1, dword [0x14012d108]
movabs rdx, 0x8000000000000000
movss xmm0, dword [0x14012d134]
comiss xmm1, xmm0
jb 0x1400a8b85
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400a8b85
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
mov qword [rdi + 0x48], rax
xor ecx, ecx
movss xmm1, dword [0x14012d0b0]
comiss xmm1, xmm0
jb 0x1400a8bac
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400a8bac
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
cmp rax, 0x11
cmovb rax, rbp
mov qword [rdi + 0x50], rax
mov dword [rdi + 8], ebp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0xc], 1
mov ecx, pe_nt_image_headers64
call fcn.1400c0f54
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400c71e0
mov r8, rdi
mov rcx, rbx
call fcn.1400b0a60
nop
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x78], rbp
mov qword [rdi + 0x80], rbp
mov qword [rdi + 0x88], rbp
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.1.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.2.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.0
mov qword [rbx], rax
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov r8d, 0xa
lea rdx, [0x140122be0]
lea rcx, [0x1400e4bf0]
call fcn.14005f240
mov qword [rsp + 0x40], rbx
call fcn.140093000
mov rsi, rax
test rbx, rbx
je 0x1400a8cc5
lea rcx, [rax + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rsi + 0xc8]
mov rax, qword [rcx]
test rax, rax
je 0x1400a8cae
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400a8cb8
mov rax, qword [rax]
test rax, rax
jne 0x1400a8ca0
lea rdx, [rsp + 0x40]
call fcn.140006ca0
lea rcx, [rsi + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x1400a9210]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c0920
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400af330
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.14007f4d0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e6
lea rcx, str._s__d_hadRun_d
call fcn.14005f240
cmp dword [rsp + 0x40], 1
jne 0x1400af489
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e9
lea rcx, str._s__d_hadRun_d
call fcn.14005f240
call fcn.14000b520
mov rcx, rax
call fcn.14008e7c0
call fcn.14000b520
mov rcx, rax
call fcn.14008e760
mov rbx, rax
test rbx, rbx
je 0x1400af477
call fcn.14000b520
call fcn.14000b520
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400af3c6
cmp dword [rcx + 0x1ac], 1
jne 0x1400af3c6
add rcx, 0xc8
mov qword [rsp + 0x48], rdi
call fcn.140010240
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.14007f4d0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2f6
lea rcx, str._s__d_bMuted_d
call fcn.14005f240
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
call qword [r9 + 0x10]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.14007f600
mov rdi, qword [rsp + 0x48]
call fcn.14000b520
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.14008e840
add rsp, 0x30
pop rbx
ret

Function at 0x1400aff40
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400affc6
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400afff0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140029a50
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400b0099
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400b0320
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400b0373
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400b0451
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400b044f
cmp eax, 3
jne 0x1400b03d8
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400b0368
cmp dword [rsp + 0x3c], 1
je 0x1400b044f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400b046c
cmp dword [rsp + 0x3c], 3
je 0x1400b0385
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400b0368
cmp dword [rsp + 0x3c], 1
je 0x1400b044f
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400b0368
cmp dword [rsp + 0x3c], 1
je 0x1400b044f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400b046c
cmp dword [rsp + 0x3c], 1
jne 0x1400b0400
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400b0451
Function at 0x1400b0970
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.14005f240
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400b09f0]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b1610
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b169b
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c0920
add rsp, 0x58
ret
Function at 0x1400b4de0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
cmp edx, 0x20
jb 0x1400b4e17
mov r8d, 0x1b4
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005f240
call fcn.14002a380
lea rcx, [rax + 0x10]
call fcn.140045400
call fcn.14002a380
mov rcx, rax
mov edx, edi
call fcn.1400628e0
mov edi, eax
call fcn.14002a380
sub dword [rax + 0x28], 1
mov ecx, dword [rax + 0x28]
jne 0x1400b4e50
mov rcx, qword [rax + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400b4e6e
cmp ecx, 0x32
jle 0x1400b4e6e
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.14005f240
test edi, edi
je 0x1400b4ec3
xor edx, edx
lea rcx, [0x1400e4fe8]
call fcn.1400b4620
call fcn.1400569d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x108]
test eax, eax
je 0x1400b4ee9
xor ecx, ecx
lea rax, [rbx - 8]
test rax, rax
mov dword [0x1401632a4], ecx
cmove rbx, rcx
call fcn.140020610
mov rdx, rbx
lea rcx, [rax + 0x10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000b5f0
call fcn.1400569d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x88]
test eax, eax
jne 0x1400b4ee9
mov edx, 0x2000000
lea rcx, str._Ping
call fcn.1400b4620
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b6680
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x12c], 0
mov r14, rcx
jne 0x1400b688f
nop dword [rax]
mov ecx, dword [r14 + 0x130]
lea rdx, [r14 + 0x138]
mov r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x1400b6881
cmp qword [r14 + 0xe8], 0
je 0x1400b6881
mov edx, dword [r14 + 0xf0]
xor ecx, ecx
test edx, edx
je 0x1400b670f
mov r9, qword [r14 + 0xe0]
nop dword [rax]
mov r8, qword [r9 + rcx*8]
test r8, r8
jne 0x1400b6720
inc ecx
cmp ecx, edx
jb 0x1400b6700
xor r8d, r8d
test r8, r8
je 0x1400b6881
nop dword [rax + rax]
mov r11, r8
test r8, r8
je 0x1400b6764
mov rcx, qword [r8 + 0x10]
test rcx, rcx
jne 0x1400b6761
mov eax, dword [r8 + 0x18]
xor edx, edx
mov r10d, dword [r14 + 0xf0]
div r10d
inc edx
cmp edx, r10d
jae 0x1400b6761
mov rax, qword [r14 + 0xe0]
mov r9, qword [rax + rdx*8]
test r9, r9
cmovne rcx, r9
inc edx
test rcx, rcx
je 0x1400b6743
mov r8, rcx
mov rax, qword [r11 + 8]
test rax, rax
je 0x1400b677a
cmp dword [rax + 0x18], ebx
jne 0x1400b677a
mov rdi, qword [rax]
test rdi, rdi
jne 0x1400b6784
test r8, r8
jne 0x1400b6720
jmp 0x1400b6881
mov r15d, dword [rax + 8]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov r12d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov r8d, 0xb1
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r9d, eax
lea rcx, str._s__d___Thread_ID___d
call fcn.14005f240
mov ecx, 1
lock xadd dword [rdi + 0xb4], ecx
mov rsi, qword [rdi + 0x50]
test rsi, rsi
je 0x1400b6841
cmp dword [rdi + 0xb0], 0
jne 0x1400b6841
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
test rsi, rsi
je 0x1400b68c4
cmp qword [rdi + 0x90], 0
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jbe 0x1400b6822
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400b6822
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400b6820
mov rax, qword [rax]
test rax, rax
jne 0x1400b6810
jmp 0x1400b6822
xor ebx, ebx
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400b683c
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
test rsi, rsi
jne 0x1400b67d0
mov eax, 0xffffffff
lock xadd dword [rdi + 0xb4], eax
lea rcx, [rdi + 0x28]
call fcn.14000b430
cmp r12d, 1
jbe 0x1400b687b
mov r9d, r12d
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r8d, SystemTimeToVariantTime
lea rcx, str._s__d_CoInitializeEx_hr_x
call fcn.14005f240
jmp 0x1400b6881
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
cmp dword [r14 + 0x12c], 0
je 0x1400b66b0
mov r8d, 0xdb
lea rdx, str.CTimerEventNotify::WorkThreadLoop
lea rcx, [0x1400e4bf0]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14005f240
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x1400b6af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140027bc0
test eax, eax
je 0x1400b6b78
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14005f240
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400b6be7
jmp 0x1400b6be1
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_110
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6bd9
cmp dword [rsp + 0x40], 4
jne 0x1400b6bd9
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400b6bce
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400b6be7
mov eax, 1
jmp 0x1400b6be9
test rbx, rbx
je 0x1400b6be7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400b6c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140027bc0
test eax, eax
je 0x1400b6c98
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14005f240
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400b6d07
jmp 0x1400b6d01
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_20
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6cf9
cmp dword [rsp + 0x40], 4
jne 0x1400b6cf9
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400b6cee
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400b6d07
mov eax, 1
jmp 0x1400b6d09
test rbx, rbx
je 0x1400b6d07
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400b7dc0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x1400e4bf0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r8d, 0x83
call fcn.14005f240
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
test rbx, rbx
jne 0x1400b7e05
mov r8d, 0x84
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.14005f240
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x86
mov qword [rsp + 0x20], rax
call fcn.14005f240
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400b7e65
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x8a
mov qword [rsp + 0x20], rax
call fcn.14005f240
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400b79b0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400b80e0

Function at 0x1400b7e80
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x1400e4bf0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r8d, 0x96
call fcn.14005f240
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
test rbx, rbx
jne 0x1400b7ec5
mov r8d, 0x97
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.14005f240
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x99
mov qword [rsp + 0x20], rax
call fcn.14005f240
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400b7f25
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x9d
mov qword [rsp + 0x20], rax
call fcn.14005f240
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400b7ba0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400b80e0