joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c3040
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
lea rax, vtable.CSimpleOrientationSensorManagerEvents.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], SafeArrayUnaccessData
mov dword [rcx + 0x58], ebp
mov dword [rcx + 0x5c], 0xa
mov qword [rcx + 0x60], rbp
mov qword [rcx + 0x68], rbp
mov dword [rcx + 0x3c], 0x3f400000
mov dword [rcx + 0x40], 0x3e800000
mov dword [rcx + 0x44], 0x40100000
mov qword [rcx + 0x48], 0x26
mov qword [rcx + 0x50], rbp
mov dword [rcx + 8], ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0xc], 1
mov ecx, pe_nt_image_headers64
call fcn.1400df6d0
mov rbx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400e5b40
mov r8, rdi
mov rcx, rbx
call fcn.1400cc450
nop
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x78], rbp
mov qword [rdi + 0x80], rbp
mov qword [rdi + 0x88], rbp
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.2.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.1.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.0
mov qword [rbx], rax
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
lea r8d, [rbp + 0xa]
lea rdx, [0x140148740]
lea rcx, [0x140102ba8]
call fcn.14006dd20
mov qword [rsp + 0x38], rbx
call fcn.1400a6ad0
mov rsi, rax
test rbx, rbx
je 0x1400c31bd
lea rcx, [rax + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rsi + 0xc8]
mov rax, qword [rcx]
test rax, rax
je 0x1400c31a6
cmp qword [rax + 0x10], rbx
je 0x1400c31b0
mov rax, qword [rax]
test rax, rax
jne 0x1400c3198
lea rdx, [rsp + 0x38]
call fcn.140006d60
lea rcx, [rsi + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x1400c3720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c3430
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140102ba8]
mov r8d, 0x27
call fcn.14006dd20
xor ebx, ebx
nop dword [rax + rax]
mov r8d, 0x2d
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140102ba8]
call fcn.14006dd20
mov ecx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov r8d, 0x31
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140102ba8]
call fcn.14006dd20
lea rcx, [rdi - 0x70]
call fcn.1400c34f0
test eax, eax
jne 0x1400c34b3
inc ebx
cmp ebx, 5
jl 0x1400c3460
jmp 0x1400c34cc
mov r8d, 0x34
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140102ba8]
call fcn.14006dd20
mov r8d, 0x38
lea rdx, str.CSensorsMgr::WorkThreadLoop
lea rcx, [0x140102ba8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14006dd20
Function at 0x1400cac30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.1400902e0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e6
lea rcx, str._s__d_hadRun_d
call fcn.14006dd20
cmp dword [rsp + 0x40], 1
jne 0x1400cadd9
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e9
lea rcx, str._s__d_hadRun_d
call fcn.14006dd20
call fcn.14000bd10
mov rcx, rax
call fcn.1400a1a60
call fcn.14000bd10
cmp dword [rax + 0x140], 0
jne 0x1400cacfc
cmp dword [0x140180270], 0
je 0x1400cacfc
cmp dword [0x140180274], 0
jne 0x1400cace3
mov rax, qword [0x140179638]
test byte [rax + 0x1c], 1
je 0x1400cacfc
mov r8d, 0x3e
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.14006dd20
call fcn.14000bd10
mov rbx, qword [rax + 0xe0]
nop dword [rax + rax]
test rbx, rbx
je 0x1400cadc7
call fcn.14000bd10
call fcn.14000bd10
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400cad10
cmp dword [rcx + 0x1ac], 1
jne 0x1400cad10
add rcx, 0xc8
mov qword [rsp + 0x48], rdi
call fcn.140010930
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.1400902e0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2f6
lea rcx, str._s__d_bMuted_d
call fcn.14006dd20
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
mov rax, qword [r9 + 0x10]
call qword [case.0x140050923.0]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.140090400
mov rdi, qword [rsp + 0x48]
call fcn.14000bd10
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.1400a1ae0
add rsp, 0x30
pop rbx
ret

Function at 0x1400cb910
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400cb996
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cb9c0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14002f3c0
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400cba69
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400cbd00
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400cbd53
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400cbe31
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400cbe2f
cmp eax, 3
jne 0x1400cbdb8
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400cbd48
cmp dword [rsp + 0x3c], 1
je 0x1400cbe2f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400cbe4c
cmp dword [rsp + 0x3c], 3
je 0x1400cbd65
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400cbd48
cmp dword [rsp + 0x3c], 1
je 0x1400cbe2f
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400cbd48
cmp dword [rsp + 0x3c], 1
je 0x1400cbe2f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400cbe4c
cmp dword [rsp + 0x3c], 1
jne 0x1400cbde0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400cbe31
Function at 0x1400cc360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.14006dd20
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400cc3e0]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400cd020
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400cd0ab
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400df340
add rsp, 0x58
ret
Function at 0x1400d2740
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
cmp edx, 0x20
jb 0x1400d276b
mov r8d, 0x291
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.14006dd20
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
lfence
call fcn.14002fcd0
lea rcx, [rax + 0x10]
call fcn.1400508c0
call fcn.14002fcd0
mov rcx, rax
mov edx, ebx
call fcn.140071650
mov esi, eax
call fcn.14002fcd0
mov rdi, rax
call fcn.1400d23c0
test eax, eax
je 0x1400d27c0
imul rdx, rbx, 0xb0
test byte [rdx + rdi + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
je 0x1400d27c0
mov ebx, 1
jmp 0x1400d27c2
xor ebx, ebx
call fcn.14002fcd0
mov rcx, rax
lock dec dword [rax + 0x28]
mov eax, dword [rax + 0x28]
mov rdi, qword [rsp + 0x38]
jne 0x1400d27e4
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400d2805
mov eax, dword [rcx + 0x28]
cmp eax, 0x32
jle 0x1400d2805
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.14006dd20
mov r8d, 0x297
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140102ba8]
call fcn.14006dd20
cmp dword [0x1401808b0], 0
je 0x1400d28ae
test esi, esi
je 0x1400d287e
xor edx, edx
lea rcx, [0x140103060]
call fcn.1400d0df0
call fcn.140063590
mov rcx, rax
mov rdx, qword [rax]
mov rax, qword [rdx + 0x108]
call qword [case.0x140050923.0]
test eax, eax
je 0x1400d28ae
mov r8d, 0x2ab
mov dword [0x1401808b0], 0
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140102ba8]
call fcn.14006dd20
jmp 0x1400d28ae
call fcn.140063590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x88]
mov rcx, rdx
call qword [case.0x140050923.0]
test eax, eax
jne 0x1400d28ae
mov edx, 0x2000000
lea rcx, str._Ping
call fcn.1400d0df0
mov rsi, qword [rsp + 0x30]
test ebx, ebx
je 0x1400d2909
mov r8d, 0x2ba
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_Detect_Plug_In_And_Handle_by_UWP__SET_PING_UWP_WHILE_PLUG_IN_EVENT_HAPPENED_2s_later
call fcn.14006dd20
mov dword [0x140180854], 0xa
call fcn.14000be90
mov rcx, rax
mov edx, 0x40c
call fcn.1400d4070
call fcn.14000be90
mov rcx, rax
mov edx, 0x40c
mov r8d, 0x7d0
add rsp, 0x20
pop rbx
jmp fcn.1400d3e30
add rsp, 0x20
pop rbx
ret
Function at 0x1400d4850
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x30], esi
lea r9d, [rsi + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.14002b400
test eax, eax
je 0x1400d48d4
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400d4943
jmp 0x1400d493d
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_110
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d4935
cmp dword [rsp + 0x38], 4
jne 0x1400d4935
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x1400d492a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400d4943
mov eax, 1
jmp 0x1400d4945
test rbx, rbx
je 0x1400d4943
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400d4970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x30], esi
lea r9d, [rsi + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.14002b400
test eax, eax
je 0x1400d49f4
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400d4a63
jmp 0x1400d4a5d
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_20
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d4a55
cmp dword [rsp + 0x38], 4
jne 0x1400d4a55
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x1400d4a4a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400d4a63
mov eax, 1
jmp 0x1400d4a65
test rbx, rbx
je 0x1400d4a63
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d5d30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r8d, 0x83
lea rcx, [0x140102ba8]
call fcn.14006dd20
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
test rbx, rbx
jne 0x1400d5d81
mov r8d, 0x84
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006dd20
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x86
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400d5de6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x8a
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400d5910
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d60b0
Function at 0x1400d5e10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r8d, 0x96
lea rcx, [0x140102ba8]
call fcn.14006dd20
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
test rbx, rbx
jne 0x1400d5e61
mov r8d, 0x97
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006dd20
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x99
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400d5ec6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x9d
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400d5b00
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d60b0

Function at 0x1400d5ef0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r8d, 0xa9
lea rcx, [0x140102ba8]
call fcn.14006dd20
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
test rbx, rbx
jne 0x1400d5f41
mov r8d, 0xaa
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006dd20
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xac
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400d5fa6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xb0
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400d5910
mov rdx, rbx
call fcn.1400d5b00
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d60b0
Function at 0x1400d5fd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r8d, 0xbd
lea rcx, [0x140102ba8]
call fcn.14006dd20
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
test rbx, rbx
jne 0x1400d6021
mov r8d, 0xbe
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006dd20
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xc0
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400d6086
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xc4
mov qword [rsp + 0x20], rax
call fcn.14006dd20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400d5910
mov rdx, rbx
call fcn.1400d5b00
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d60b0
Function at 0x1400de730
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [rcx + 8], 0
mov rbx, rcx
je 0x1400de757
lea r8, [0x1400de640]
jmp 0x1400de764
cmp dword [rcx + 0xc], 0
je 0x1400de79a
lea r8, [0x1400de6e0]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400df340
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [0x1400de5a0]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SubmitThreadpoolWork]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400df340
add rsp, 0x40
pop rbx
ret