joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b2e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14001b30e
xor eax, eax
jmp 0x14001b3f4
cmp qword [rcx + 0x68], 0
je 0x14001b31f
call fcn.14001b410
jmp 0x14001b3f4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b336
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001b338
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001b36a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140038d30
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14001b3ee
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14001b3a1
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14001b3ca
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140026dd4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14001b3ee
cmp rsi, rbx
ja 0x14001b3a8
test rsi, rsi
je 0x14001b3ee
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140026dd4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002c564
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x14002c5bc
je 0x14002c5b3
mov eax, 0xc433
cmp ecx, eax
ja 0x14002c597
je 0x14002c5b3
mov eax, ecx
sub eax, 0x2a
je 0x14002c5b3
sub eax, 0xc402
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
cmp eax, 3
jmp 0x14002c5b1
mov eax, ecx
sub eax, 0xc435
je 0x14002c5b3
sub eax, 0x1263
je 0x14002c5ef
sub eax, 0x812
je 0x14002c5b3
cmp eax, 1
jne 0x14002c5b5
xor edx, edx
call fcn.140263d56
push 0xffffffffffffff8b
shr dword [0x14003a471], 0x74
out dx, al
mov eax, ecx
sub eax, 0xdead
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 1
je 0x14002c5b3
sub eax, 0x1f35
je 0x14002c5b3
cmp eax, 1
jne 0x14002c5b5
and edx, 8
jmp 0x14002c5b5

Function at 0x140038a20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140038a48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140038a48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400f9473
Capabilities:
Encode data using xor

Disassembly:
mov r12, r14
mov rbx, r12
xor r12d, 0x1ad41e9d
add qword [rsp], 0x5aa05
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx + r14 - 0x4656]
call fcn.14019616d
Function at 0x140138f2c
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [rsp + 0x6c]
insb byte [rdi], dx
add qword [rsp + 0x20], 0xffffffffbfe5e1f1
mov rdx, qword [rsp + 0x50]
and r12d, r12d
xor r12b, 0x20
movabs rcx, 0x7e1731891a04764c
add qword [rsp + 0x30], 0xffffffffbff8e4ee
test r12w, 0x5c3a
cmovg cx, r12w
mov rcx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x68]
jbe 0x1402470f8
call fcn.14023efec
cmp al, 0x9d
insb byte [rdi], dx
test al, 0x7d
xor al, 0x2e
mov esp, dword [rax - 0x712c2c36]
and byte [rax - 0x5f7451a3], cl
outsb dx, byte [rsi]
cmp eax, ebx
jns 0x140138f30
mov dh, 2
outsb dx, byte [rsi]
invalid
test r13, 0xfa3227b
movabs rbx, 0x45a73f976def3b63
lea rdx, [rdx + 1]
not bl
seta bl
add qword [rsp + 0x18], 0xfffffffffffeefc1
lea rbx, [rbx + rbx*8 + 0x3c0437dd]
push rsi
xor ebx, r13d
mov qword [rsp + r13 - 0x78330bdb], rdx
call fcn.1400e392e

Function at 0x1401a015a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rbp + 0x24648d48], bl
call fcn.140321738
call fcn.1401a34cf
lock xor edi, dword [rax - 0x775aef05]
mov dl, 0x88
xor eax, 0x9d4bd97f
or eax, 0xc0c57d39
and qword [r11], 0xffffffffffffff8f
jge 0x1401a0108
invalid

Function at 0x140213ac4
Capabilities:
Packed with generic packer

Disassembly:
push 0x33f950cd
call fcn.1401ab484
setne r10b
add qword [rsp], 0xfffffffffff22747
mov rdi, r10
or word [rsp + 0x20], di
mov r11, rdi
ja 0x14022d320
movabs rbx, 0x76bb799b2bcd02f3
sub byte [rsp + 0x18], 0x7a
and word [rsp + 0x18], 0x515e
cmp r15d, 0x168b7f2a
call fcn.1400cffac
mov r11d, r10d
mov rdi, qword [rsp]
mov rdi, qword [rdi + r11 - 0x621b1a01]
cmp qword [rsp + 0x20], 0x3cac3910
jle 0x140004f70
jb 0x1400da74b
and r11b, byte [rsp + 0x23]
bswap r10d
lea rdi, [rdi + r11 - 0x4e2716bd]
test r11b, r11b
mov qword [rsp], r10
xchg qword [rsp + r11 - 0x621b19d9], rdi
jb 0x1402224ce
not dword [rsp]
add r11w, word [rsp + 0x25]
not qword [rsp]

Function at 0x14027d9dc
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rsp + 0x18]
jb 0x1401fe374
add qword [rsp + 0x40], 0x55a0130b
call fcn.140280ee8
push r11
mov qword [rsp + 8], 0xffffffffc3f12b1c
call fcn.14022696e
Function at 0x140003910
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov qword [rsp + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
jne 0x140003954
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
jmp 0x140003965
cmp r9d, 1
jne 0x140003a1a
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017e40
lea r8, [0x1400436ec]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.140017ea8
lea r8, str.FxProperties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400039e7
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
jmp 0x140003a1c
test byte [rdi + 0x378], 1
je 0x140003a1a
mov r9d, eax
lea r8, str.Cannot_Open_Property_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140001140
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000c610
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140003c80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x858
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call fcn.140011520
lea rbp, [rsp + 0x898]
call fcn.140003e70
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov r9, 0xffffffffffffffff
mov r8d, 0x400
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call fcn.140017aec
test dword [rdi + 0x378], esi
je 0x140003d0e
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x858
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004f50
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test byte [rcx + 0x270], 4
mov rbx, rcx
je 0x140004f6f
lea rcx, str.Enter_Metering::Metering_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, qword [rbx + 0x228]
test rcx, rcx
je 0x140004f81
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, [rbx + 0x1e0]
mov qword [rbx + 0x228], 0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
test byte [rbx + 0x270], 4
je 0x140004faf
lea rcx, str.Leave_Metering::Metering_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004fbd
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rax, vtable.RpcServer::CMMEndpointNotify.0
mov qword [rbx + 0x1c0], 0
lea rcx, [rbx + 0x190]
mov qword [rbx + 0x188], rax
call fcn.140003d50
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.140009af0

Function at 0x140005fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov dword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
xor r9d, r9d
call fcn.140008450
test al, al
je 0x14000602d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_3
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140006027
mov eax, dword [rsp + 0x3c]
mov dword [rdi], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
Function at 0x140006050
Capabilities:
Print debug messages
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov dword [rsp + 0x38], r8d
mov rbx, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call fcn.140011520
test byte [rbx + 0x270], 4
je 0x1400060a2
lea rcx, str.Enter_Metering::SetNLDValue_r_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.140008450
test al, al
je 0x140006138
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x1400060fa
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
jmp 0x140006168
test byte [rbx + 0x270], 1
je 0x14000612d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r8, str.Metering::SetNLDValue___Reg_OpenKeyEx_fail_lasterr__x_r_n
mov edx, 0x400
mov r9d, eax
lea rcx, [rsp + 0x40]
call fcn.140001140
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140006166
mov eax, dword [rbx + 0x270]
test al, 1
je 0x140006155
lea rcx, str.Metering::SetNLDValue___OpenFxPropertyKey_fail_r_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov eax, dword [rbx + 0x270]
test al, 4
je 0x140006166
lea rcx, str.Leave_Metering::SetNLDValue_r_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rdi
ret
Function at 0x140006650
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x858
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call fcn.140011520
lea rbp, [rsp + 0x898]
call fcn.140003e70
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov r9, 0xffffffffffffffff
mov r8d, 0x400
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call fcn.140017aec
test dword [rdi + 0x270], esi
je 0x1400066de
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x858
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140006700
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, r8
lea rcx, [rsp + 0x60]
mov edi, edx
mov r8d, 0x800
xor edx, edx
call fcn.140011520
lea rsi, [rsp + 0x8a8]
call fcn.140003e70
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x60]
xor esi, esi
mov r8d, 0x400
mov qword [rsp + 0x28], rsi
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
lea r9, [rsi - 1]
call fcn.140017aec
lea rdx, str.FMService_EventLog
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400067d1
mov rcx, qword [rsp + 0x8a0]
lea edx, [rsi + 1]
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rsi
lea rcx, [0x1400438fc]
mov qword [rsp + 0x58], rcx
xor r9d, r9d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], dx
movzx edx, di
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x870
pop rdi
pop rsi
pop rbx
ret
Function at 0x140008450
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov qword [rsp + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
jne 0x140008494
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
jmp 0x1400084a5
cmp r9d, 1
jne 0x14000855a
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017e40
lea r8, [0x1400436ec]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.140017ea8
lea r8, str.FxProperties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008527
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
jmp 0x14000855c
test byte [rdi + 0x270], 1
je 0x14000855a
mov r9d, eax
lea r8, str.Cannot_Open_Property_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140001140
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000c610
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140008590
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x14000860c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140008606
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
Function at 0x140008620
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov dword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x1400086aa
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400086a4
mov eax, dword [rsp + 0x3c]
mov dword [rdi], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret

Function at 0x1400086c0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
xor r9d, r9d
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x14000873f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140008739
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret

Function at 0x140008760
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
xor r9d, r9d
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x1400087df
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_202
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400087d9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
Function at 0x140008800
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov dword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
xor r9d, r9d
call fcn.140008450
test al, al
je 0x14000888d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140008887
mov eax, dword [rsp + 0x3c]
mov dword [rdi], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret

Function at 0x1400088b0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x14000892c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140008926
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret

Function at 0x140008940
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov dword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x1400089ca
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400089c4
mov eax, dword [rsp + 0x3c]
mov dword [rdi], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x50
pop rdi
ret
Function at 0x1400089e0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
mov r9d, 1
lea r8, [rsp + 0x30]
call fcn.140008450
test al, al
je 0x140008a62
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_7
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140008a5c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
add rsp, 0x58
ret

Function at 0x140008a80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
test r9d, r9d
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov rbx, rdx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov rsi, rcx
cmovne r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017e40
lea r8, [0x1400436ec]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
mov r8, rbx
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.140017ea8
lea r8, str.Properties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140017ea8
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008b4d
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov al, 1
jmp 0x140008b82
test byte [rsi + 0x270], 1
je 0x140008b80
mov r9d, eax
lea r8, str.Cannot_Open_EndpointProperty_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140001140
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000c610
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret