joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c2e0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 0x455
jne 0x14005c447
call fcn.1400147e0
mov rcx, rax
mov edx, 0x455
call fcn.1400e8940
mov r8d, 0x259
lea rdx, str.CCustomizeLenovo::OnTimer
lea rcx, [0x14011bca8]
call fcn.140075db0
cmp dword [rdi + 0x2c], 0
je 0x14005c4f0
cmp dword [0x1401aa4a0], 0
je 0x14005c4f0
mov eax, dword [rdi + 0x28]
cmp eax, 5
jae 0x14005c4f0
inc eax
mov qword [rsp + 0x30], rbx
mov r8d, 0x25f
mov dword [rdi + 0x28], eax
lea rdx, str.CCustomizeLenovo::OnTimer
lea rcx, [0x14011bca8]
call fcn.140075db0
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x14005c3b9
cmp dword [0x1401b2668], 0
je 0x14005c3b9
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x14005c3a0
cmp dword [0x1401b266c], 0
je 0x14005c3b9
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x14005c3f4
nop word [rax + rax]
call fcn.140014660
call fcn.140014660
mov rdx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rdx, rdx
je 0x14005c3ef
lea rcx, [rdi - 0x18]
call fcn.14005b3b0
test rbx, rbx
jne 0x14005c3d0
call fcn.140014660
mov rbx, qword [rsp + 0x30]
sub dword [rax + 0x140], 1
mov ecx, dword [rax + 0x140]
jne 0x14005c420
mov rcx, qword [rax + 0x150]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp ecx, 0x32
jle 0x14005c4f0
mov r8d, 0x8b
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
add rsp, 0x20
pop rdi
jmp fcn.140075db0
cmp edx, 0x460
jne 0x14005c4f0
mov r8d, 0x26e
lea rdx, str.CCustomizeLenovo::OnTimer
lea rcx, [0x14011bca8]
call fcn.140075db0
mov r9d, dword [rdi + 0x24]
lea rdx, str.CCustomizeLenovo::OnTimer
mov r8d, 0x271
lea rcx, str._s__d_m_dwWaitTimerToChangeVolumeCnt___d
call fcn.140075db0
cmp dword [rdi + 0x24], 0
jle 0x14005c4f0
lea rcx, [rdi - 0x18]
call fcn.14005b980
dec dword [rdi + 0x24]
lea rdx, str.CCustomizeLenovo::OnTimer
mov r9d, dword [rdi + 0x24]
lea rcx, str._s__d_m_dwWaitTimerToChangeVolumeCnt___d
mov r8d, 0x276
call fcn.140075db0
cmp dword [rdi + 0x24], 0
jne 0x14005c4f0
mov r8d, 0x278
lea rdx, str.CCustomizeLenovo::OnTimer
lea rcx, str._s__d_kill_timer
call fcn.140075db0
call fcn.1400147e0
mov rcx, rax
mov edx, 0x460
call fcn.1400e8940
mov dword [rdi + 0x20], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14005cdc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
call fcn.140014310
mov ecx, 0x1854
cmp word [rax + 0x346], cx
jne 0x14005cf65
call fcn.140014310
mov ecx, 0x509
cmp word [rax + 0x344], cx
jne 0x14005cf65
lea r8d, [rdi + 0x6d]
mov qword [rsp + 0x60], rbx
lea rdx, str.CCustomizeLG::GetOrientationDefVal
lea rcx, str._s__d_for_LG_full_screen_project___when_orientation_locked__keep_latest_Orientation_L_R_channel_
call fcn.140075db0
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9d, [rdi + 0x11]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotationNonPreserve
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005ce99
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastAutoRequest
mov dword [rsp + 0x38], 0x63
mov dword [rsp + 0x3c], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea r8d, [rdi + 0x79]
lea rcx, str._s__d_Orientation_LastAutoRequest____d__lRes___d
jmp 0x14005cf13
lea rax, [rsp + 0x30]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005cf3e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastOrientation
mov dword [rsp + 0x38], 0x63
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r8d, 0x8c
lea rcx, str._s__d_Orientation_LastOrientation____d__lRes___d
mov r9d, dword [rsp + 0x38]
lea rdx, str.CCustomizeLG::GetOrientationDefVal
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.140075db0
mov rcx, qword [rsp + 0x30]
test ebx, ebx
cmove edi, dword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x14005cf60
call fcn.14000ced0
mov r8d, 0x99
lea rdx, str.CCustomizeLG::GetOrientationDefVal
lea rcx, str._s__d_BuildNumber__d__open_Registry_fail
mov r9d, dword [rax + 0xc]
call fcn.140075db0
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f4410
add rsp, 0x50
pop rdi
ret
Function at 0x14005d4a0
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov ebx, edx
mov rsi, rcx
mov r9d, edx
mov r8d, 0x63
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d_dwTid_d
call fcn.140075db0
cmp ebx, 0x437
jne 0x14005d717
call fcn.1400147e0
mov rcx, rax
mov edx, ebx
call fcn.1400e8940
cmp dword [0x1401b2414], 0
jne 0x14005d744
call fcn.140014660
mov edx, 1
call fcn.1400acbc0
mov qword [rsi + 0x10], rax
mov r9, rax
mov r8d, 0x6b
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d_m_pAudDev_x
call fcn.140075db0
cmp dword [0x1401aa948], 0
jne 0x14005d692
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x14005d757
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [0x140136d28]
lea rcx, [rsp + 0x70]
call fcn.14000c4c0
test al, al
jne 0x14005d593
mov r8d, 3
lea rdx, [0x140136d28]
lea rcx, [rsp + 0x70]
call fcn.14000c750
nop
mov edx, 0xea60
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
call fcn.1400f1850
mov ebx, dword [rsp + 0x68]
mov ecx, ebx
call fcn.1400f47dc
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400fac10
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x14005d74c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [0x140136d28]
lea rcx, [rsp + 0x70]
call fcn.14000c4c0
test al, al
jne 0x14005d628
mov r8d, 3
lea rdx, [0x140136d28]
lea rcx, [rsp + 0x70]
call fcn.14000c750
nop
mov edx, 0xea60
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [rsp + 0x70]
call fcn.1400f1850
test eax, eax
je 0x14005d664
mov rdx, qword [rsi + 0x10]
add rdx, 0x10
mov r9d, dword [rsp + 0x68]
mov r8, rdi
lea rcx, vtable.CWasapiPlayback.0
call fcn.1400ecf50
mov rcx, rdi
call fcn.1400f4438
mov r8d, 0x85
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, [0x14011bca8]
call fcn.140075db0
cmp dword [0x1401aa948], 0
je 0x14005d744
mov r8d, 0x8a
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, [0x14011bca8]
call fcn.140075db0
mov r8d, 0x56
lea rdx, str.CWasapiPlayback::Play
lea rcx, [0x14011bca8]
call fcn.140075db0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, vtable.CWasapiPlayback.0
lea r8, [0x1400ed630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
call fcn.1400147e0
mov rcx, rax
mov edx, 0x436
mov r8d, 0xea60
call fcn.1400e8700
mov dword [0x1401b2414], 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
cmp ebx, 0x436
jne 0x14005d744
mov r8d, 0x95
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.140075db0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp fcn.14005d340
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3
mov ecx, 0x80004005
call fcn.14000ce90
int3
Function at 0x140060f20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x40e
jne 0x140060fad
call fcn.1400147e0
mov rcx, rax
mov edx, 0x40e
call fcn.1400e8940
cmp dword [rbx + 0x30], 0
jne 0x140060fe5
cmp dword [rbx + 0x38], 0
je 0x140060f81
call fcn.140014310
mov ecx, 0x103c
cmp word [rax + 0x342], cx
jne 0x140060f77
mov edx, 1
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.140052cb0
add rsp, 0x20
pop rbx
jmp fcn.1400603c0
call fcn.140014310
mov ecx, 0x103c
cmp word [rax + 0x342], cx
jne 0x140060fa3
xor edx, edx
lea ecx, [rdx + 1]
add rsp, 0x20
pop rbx
jmp fcn.140052cb0
add rsp, 0x20
pop rbx
jmp fcn.1400607b0
cmp edx, 0x435
jne 0x140060ff3
call fcn.1400147e0
mov rcx, rax
mov edx, 0x435
call fcn.1400e8940
cmp dword [rbx + 0x34], 0
je 0x140060fe0
call fcn.1400607b0
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140060d60
call fcn.1400603c0
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140060d60
add rsp, 0x20
pop rbx
ret

Function at 0x140066820
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [r8]
mov rdi, rdx
cmp rax, qword [0x140119518]
mov rbx, rcx
jne 0x1400668fe
mov rax, qword [r8 + 8]
cmp rax, qword [0x140119520]
jne 0x1400668fe
cmp dword [r8 + 0x10], 0
jne 0x1400668fe
call fcn.140014660
mov rdx, rdi
call fcn.1400ac390
mov rdi, rax
test rax, rax
jne 0x140066894
mov r8d, 0x14f
lea rdx, str.CJackImpedanceDetect::OnPropertyValueChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140075db0
mov eax, dword [rax + 0x1b4]
dec eax
test eax, 0xfffffffd
jne 0x1400668fe
cmp dword [rbx + 0x64], 0
je 0x1400668ef
mov qword [rsp + 0x30], rsi
call fcn.14006b0c0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x38]
mov rcx, rdx
call qword [case.0x14005eeb3.0]
cmp eax, 2
jne 0x1400668d1
mov r8d, dword [rbx + 0x70]
jmp 0x1400668d4
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbx - 0x18]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140065c90
cmp dword [rbx + 0x68], 0
je 0x1400668fe
lea rcx, [rbx - 0x18]
call fcn.140066270
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400674c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
cmp edx, 0x20
jb 0x1400674f7
mov r8d, 0x70
lea rdx, str.CJackRetaskCommandLineHelper::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140075db0
call fcn.14003a6b0
lea rcx, [rax + 0x10]
call fcn.14005ee50
cmp dword [rdi + 0xa8], ebx
jne 0x14006752a
call fcn.14003a6b0
imul rdx, rbx, 0xb0
test byte [rax + rdx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
jne 0x14006752a
mov ebx, 1
jmp 0x14006752c
xor ebx, ebx
call fcn.14003a6b0
mov rcx, rax
lock dec dword [rax + 0x28]
mov eax, dword [rax + 0x28]
jne 0x140067549
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x14006756a
mov eax, dword [rcx + 0x28]
cmp eax, 0x32
jle 0x14006756a
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.140075db0
test ebx, ebx
je 0x140067589
call fcn.1400147e0
mov rcx, rax
mov edx, 0x3f2
call fcn.1400e8940
lea rcx, [rdi - 0x10]
call fcn.1400676c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140067ba0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebp, r8d
mov esi, edx
mov edi, ecx
mov dword [rsp + 0x68], 0x1001
mov dword [rsp + 0x6c], ecx
mov word [rsp + 0x70], si
mov word [rsp + 0x72], bp
lea r9, str.RealtekAudioBackgroundProcessClass
lea r8, str.RealtekAudioBackgroundProcessClass
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r14, rax
mov qword [rsp + 0x58], SafeArrayDestroy
mov qword [rsp + 0x50], 0x2000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x50]
mov r8, qword [0x1401ba740]
mov edx, 0x4a
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x140067d52
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, 0xfd
lea r8, str.CJackRetaskCommandLineHelper::SendRetaskCommandToActiveRtkAudUService
lea rdx, str._s__d_hWnd_x_Wid_x_DevType_d_Seq_d_hr_x_LastErr_d
lea rcx, [rsp + 0x78]
call fcn.14000ec90
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
cmp dword [0x1401b2668], 0
je 0x140067d00
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x140067cc8
cmp dword [0x1401b266c], 0
je 0x140067d00
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov r9, r14
mov r8d, 0x101
lea rdx, str.CJackRetaskCommandLineHelper::SendRetaskCommandToActiveRtkAudUService
lea rcx, str._s__d_hWnd_x_Wid_x_DevType_d_Seq_d_hr_x_LastErr_d
call fcn.140075db0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140067d26
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov eax, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3
Function at 0x140068ee0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1788]
mov eax, 0x1888
call fcn.1400fdb80
sub rsp, rax
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rbp + 0x1770], rax
mov r14, r8
mov r15, rcx
mov r8, rdx
lea rcx, [rbp + 0x150]
mov edx, 0x208
mov rsi, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov edx, 0x104
test rsi, rsi
jne 0x140068f6b
mov r8, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea edx, [rbx + 0x2e]
lea rcx, [rsp + 0x40]
call fcn.1400fa554
test rax, rax
je 0x140068f74
lea edx, [rbx + 0x2e]
lea rcx, [rsp + 0x40]
call fcn.1400fa554
mov word [rax], bx
jmp 0x140068f74
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edi, dword [rbp + 0x17e0]
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
test edi, edi
lea r8, [0x14013d390]
mov edx, 0x800
lea rcx, [rbp + 0x770]
cmove r8, rax
call fcn.140039da0
cmp dword [rbp + 0x17e8], ebx
jne 0x1400690a1
test edi, edi
jne 0x140069010
lea r8, [0x14011c3b4]
mov edx, 0x208
lea rcx, [rbp + 0x150]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, r15
lea rcx, [rbp + 0x150]
mov edx, 0x208
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test r14, r14
je 0x140069010
lea r8, [0x14013d4ac]
mov edx, 0x208
lea rcx, [rbp + 0x150]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, r14
lea rcx, [rbp + 0x150]
mov edx, 0x208
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x770]
mov rcx, 0xffffffff80000002
mov edi, ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006908d
lea rcx, [rbp + 0x150]
call fcn.140068ab0
lea rcx, [rbp + 0x150]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140069057
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
sete bl
mov eax, ebx
jmp 0x140069106
call fcn.140014310
test dword [rax + 0xc0], 0x20000000
je 0x1400690c1
call fcn.140014310
movzx r8d, byte [rax + 0x1f3]
jmp 0x1400690c7
mov r8d, 0x1e
mov r9, r14
mov rcx, rsi
call fcn.1400696d0
mov r9, rsi
mov dword [rsp + 0x30], eax
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rbp + 0x560]
call fcn.140039da0
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x560]
call fcn.140069130
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbp + 0x1770]
xor rcx, rsp
call fcn.1400f4410
add rsp, 0x1888
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140069130
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov rdi, r8
mov rsi, rdx
call fcn.1400a9330
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400691aa
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegCreateKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400691f9
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
mov rdx, rsi
test rdi, rdi
je 0x1400691d4
mov qword [rsp + 0x20], rdi
jmp 0x1400691e6
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rdx, qword [rsp + 0x38]
mov eax, 0xffffffff
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140069224
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14006aa60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, byte [rdx + 1]
movabs rbx, 0x100000001b3
movzx r9d, byte [rdx]
mov r10, rdx
movzx r8d, byte [rdx + 4]
movabs rdi, 0xcbf29ce484222325
xor r9, rdi
xor r8, rdi
imul r9, rbx
imul r8, rbx
movzx ecx, byte [r10 + 0x10]
xor r9, rax
movzx eax, byte [rdx + 2]
xor rcx, rdi
imul r9, rbx
imul rcx, rbx
xor r9, rax
movzx eax, byte [rdx + 3]
imul r9, rbx
xor r9, rax
movzx eax, byte [rdx + 5]
movzx edx, byte [rdx + 6]
xor r8, rax
movzx eax, byte [r10 + 7]
xor rdx, rdi
imul rdx, rbx
imul r9, rbx
imul r8, rbx
xor rdx, rax
movzx eax, byte [r10 + 0x11]
xor rcx, rax
movzx eax, byte [r10 + 0x12]
imul rcx, rbx
imul rdx, rbx
xor rcx, rax
movzx eax, byte [r10 + 0x13]
imul rcx, rbx
xor rcx, rax
imul rcx, rbx
lea rax, [rcx + rcx]
xor rax, rdx
add rax, rax
xor rax, r8
add rax, rax
xor rax, r9
lea r9, [r10 + 8]
add r10, 0x10
cmp r9, r10
je 0x14006ab5f
mov r11d, 0x9e3779b9
movzx edx, byte [r9]
mov r8, rax
xor rdx, rdi
shr r8, 2
imul rdx, rbx
mov rcx, rax
inc r9
shl rcx, 6
add rdx, rcx
lea rcx, [r8 + r11]
add rdx, rcx
xor rax, rdx
cmp r9, r10
jne 0x14006ab31
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140072760
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepHPVol
lea rcx, [0x14011bca8]
mov r8d, 0x49
call fcn.140075db0
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x1400727d8
cmp dword [0x1401b2668], 0
je 0x1400727d8
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x1400727bf
cmp dword [0x1401b266c], 0
je 0x1400727d8
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x140072818
call fcn.140014660
call fcn.140014660
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400727e4
cmp dword [rcx + 0x1b4], 1
jne 0x1400727e4
cmp dword [rcx + 0x180], 0
jne 0x1400727e4
mov edx, edi
call fcn.140072f40
call fcn.140014660
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400aa490
Function at 0x140072830
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov r8d, 0x86
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepUsbHPVol
lea rcx, [0x14011bca8]
call fcn.140075db0
cmp dword [0x1401b2658], 0
je 0x140072a00
cmp dword [0x1401b265c], 1
je 0x140072a00
mov qword [rsp + 0x30], rdi
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x1400728bf
cmp dword [0x1401b2668], 0
je 0x1400728bf
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x1400728a6
cmp dword [0x1401b266c], 0
je 0x1400728bf
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rdi, qword [rax + 0xe0]
test rdi, rdi
je 0x1400729e5
mov qword [rsp + 0x40], rbx
nop dword [rax]
call fcn.140014660
call fcn.140014660
mov rbx, qword [rdi + 0x10]
mov rdi, qword [rdi]
test rbx, rbx
je 0x140072961
mov eax, dword [rbx + 0x1b4]
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepUsbHPVol
mov r9, qword [rbx + 0x170]
lea rcx, str._s__d___EndPoint___s__FormFactor___d
mov r8d, 0x94
mov dword [rsp + 0x20], eax
call fcn.140075db0
cmp dword [rbx + 0x180], 0
je 0x140072961
mov eax, dword [rbx + 0x1b4]
dec eax
test eax, 0xfffffffd
jne 0x140072961
mov r9d, dword [rbx + 0x18c]
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepUsbHPVol
mov r8d, 0xa0
lea rcx, str._s__d___pAudDev__m_dwDeviceState___d
call fcn.140075db0
cmp dword [rbx + 0x18c], 1
je 0x14007296c
test rdi, rdi
jne 0x1400728e0
jmp 0x1400729e0
mov r8d, 0xa7
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepUsbHPVol
lea rcx, [0x14011bca8]
call fcn.140075db0
mov rcx, rbx
call fcn.140073670
test eax, eax
je 0x1400729e0
mov r8d, 0xac
lea rdx, str.CIndependentVolumeMgr::InitForAllIndepUsbHPVol
lea rcx, [0x14011bca8]
call fcn.140075db0
mov rax, qword [0x1401aa490]
lea r8, str.InitUsbHpSpkVol
mov r9d, 1
mov dword [0x1401b265c], 1
lea rdx, str.Others
lea rcx, [0x1401aa490]
mov rax, qword [rax + 0x28]
call qword [case.0x14005eeb3.0]
mov rbx, qword [rsp + 0x40]
call fcn.140014660
mov rcx, rax
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.1400aa490
add rsp, 0x38
ret