joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026870
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov rbx, r8
mov rdi, rdx
call fcn.140055030
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400268e9
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegCreateKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002693a
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
mov rdx, rdi
test rbx, rbx
je 0x140026913
mov qword [rsp + 0x20], rbx
jmp 0x140026925
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x14002693e
mov ebx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002695d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140076320
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400270f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, r8
mov edi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rsp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14007eaa0
xor eax, eax
mov dword [rsp + 0x70], 0x68
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140026200
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
je 0x1400271e6
test edi, edi
je 0x1400271b8
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x1400271cb
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140076320
mov rbx, qword [rsp + 0x518]
add rsp, 0x500
pop rdi
ret
Function at 0x14002ccd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x54], 0
mov rbx, rdx
mov rdi, rcx
je 0x14002ce72
mov rax, qword [r8]
cmp rax, qword [0x1400920c8]
jne 0x14002cd0f
mov rax, qword [r8 + 8]
cmp rax, qword [0x1400920d0]
jne 0x14002cd0f
cmp dword [r8 + 0x10], 4
je 0x14002cd3b
mov rax, qword [r8]
cmp rax, qword [0x140092080]
jne 0x14002ce72
mov rax, qword [r8 + 8]
cmp rax, qword [0x140092088]
jne 0x14002ce72
cmp dword [r8 + 0x10], 6
jne 0x14002ce72
call fcn.140009a70
mov rdx, rbx
call fcn.140056ca0
cmp dword [rdi + 0x48], 0
mov rsi, rax
je 0x14002cda7
call fcn.140009810
cmp dword [rax + 8], 0
je 0x14002cd70
call fcn.140009810
mov rcx, rax
lea rdx, [rax + 0x264]
call fcn.140050d50
call fcn.140009810
test dword [rax + 0x264], 0x100
je 0x14002cda7
test rsi, rsi
je 0x14002cf20
cmp dword [rsi + 0x16c], 1
jne 0x14002cf20
mov rcx, rsi
call fcn.14000c7a0
test eax, eax
jne 0x14002cf20
mov r8d, 0x106
lea rdx, str.CIndependentVolumeMgr::OnPropertyValueChanged
lea rcx, [0x1400934a8]
call fcn.14002f950
mov dword [rdi + 0x38], 1
call fcn.140009ad0
mov edx, 0x3f7
mov rcx, rax
lea r8d, [rdx - 0xf]
call fcn.14006e470
test rsi, rsi
je 0x14002cf20
cmp dword [rsi + 0x148], 0
je 0x14002ce54
cmp dword [0x1400d9634], 0
je 0x14002cf20
cmp dword [0x1400d9630], 0
jne 0x14002ce54
mov r8d, 0x112
lea rdx, str.CIndependentVolumeMgr::OnPropertyValueChanged
lea rcx, [0x1400934a8]
call fcn.14002f950
call fcn.14002c5d0
cmp dword [0x1400d9630], 0
jne 0x14002ce54
mov r8d, BSTR_UserMarshal
lea rdx, str.CIndependentVolumeMgr::OnPropertyValueChanged
lea rcx, [0x1400934a8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002f950
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rdi - 0x18]
xor r9d, r9d
mov rdx, rsi
call fcn.14002e0a0
jmp 0x14002cf16
cmp dword [rcx + 0x58], 0
je 0x14002cf20
mov rax, qword [r8]
cmp rax, qword [0x140092098]
jne 0x14002cf20
mov rax, qword [r8 + 8]
cmp rax, qword [0x1400920a0]
jne 0x14002cf20
cmp dword [r8 + 0x10], 0x11
jne 0x14002cf20
mov r8d, 0x12a
lea rdx, str.CIndependentVolumeMgr::OnPropertyValueChanged
lea rcx, [0x1400934a8]
call fcn.14002f950
mov dword [rdi + 0x38], 1
call fcn.140009ad0
mov edx, 0x3f7
mov rcx, rax
lea r8d, [rdx - 0xf]
call fcn.14006e470
call fcn.140009a70
mov rdx, rbx
call fcn.140056ca0
mov rsi, rax
test rax, rax
je 0x14002cf20
cmp dword [rax + 0x148], 1
jne 0x14002cf01
cmp dword [0x1400d9634], 0
je 0x14002cf20
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
xor r9d, r9d
mov rdx, rsi
call fcn.14002eba0
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002d0e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x14002d148
cmp dword [rdx + 0x148], 1
jne 0x14002d148
cmp dword [0x1400d9630], 0
jne 0x14002d148
cmp dword [0x1400d9634], 0
je 0x14002d148
mov r8d, 0x17a
lea rdx, str.CIndependentVolumeMgr::OnAddDevice
lea rcx, [0x1400934a8]
call fcn.14002f950
call fcn.14002c5d0
cmp dword [0x1400d9630], 0
jne 0x14002d148
mov r8d, 0x17f
lea rdx, str.CIndependentVolumeMgr::OnAddDevice
lea rcx, [0x1400934a8]
add rsp, 0x28
jmp fcn.14002f950
add rsp, 0x28
ret
Function at 0x14002fbd0
Capabilities:
Print debug messages

Disassembly:
xor ecx, ecx
mov dword [0x1400d5290], 0
jmp 0x14002fbd0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea rcx, [0x1400d9648]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
xor edi, edi
cmp ebx, 1
jne 0x14002fc52
cmp dword [0x1400d9670], edi
mov dword [0x1400d963c], ebx
je 0x14002fc61
cmp dword [0x1400d513c], edi
je 0x14002fc43
mov rdx, qword [0x1400d9640]
test rdx, rdx
jne 0x14002fc27
call fcn.14002f2c0
mov rdx, qword [0x1400d9640]
test rdx, rdx
je 0x14002fcb7
mov rcx, qword [0x1400da608]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, qword [0x1400d9640]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x14002fc61
mov rcx, qword [0x1400da608]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
jmp 0x14002fc61
xor edx, edx
mov dword [0x1400d963c], edi
xor ecx, ecx
call fcn.14002f680
mov rax, qword [0x1400da608]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], edi
je 0x14002fcb7
cmp dword [rdx + 0x10], edi
jge 0x14002fc8d
cmp dword [rax - 0xc], edi
jl 0x14002fccf
mov dword [rax - 0x10], edi
mov rax, qword [0x1400da608]
mov word [rax], di
jmp 0x14002fcb7
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002fca3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [0x1400da608], rax
lea rcx, [0x1400d9648]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov ecx, 0x80070057
call fcn.140003ec0
int3
Function at 0x140036d50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x250]
mov rdi, rcx
mov esi, edx
lea rcx, [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x250]
cmp dword [rcx + 0x48], 0
jne 0x140036db4
mov r8d, 0x24e
lea rdx, str.CJackMgr::UpdateOneJack
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002f950
mov edx, esi
call fcn.140032180
test eax, eax
jne 0x140036dc7
mov r8d, 0x251
jmp 0x140036d92
mov rcx, qword [rdi + 0x250]
cmp esi, dword [rcx + 0x64]
jne 0x140036de5
mov edx, dword [rcx + 0x60]
mov r8d, 1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x250]
cmp esi, dword [rcx + 0x5c]
jne 0x140036e03
mov edx, dword [rcx + 0x58]
mov r8d, 1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140038590
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
xor r9d, r9d
lea rdx, [0x140038760]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov r8d, 0x51
lea rdx, str.CLowLevelKeyboardEventNotify::RegisterLLKeyboard
lea rcx, [0x1400934a8]
mov qword [rdi + 0xb0], rax
call fcn.14002f950
mov r8d, 0x21
lea rdx, str.CLowLevelKeyboardEventNotify::WorkThreadLoop
lea rcx, [0x1400934a8]
call fcn.14002f950
nop word [rax + rax]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400386f3
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [rsp + 0x28]
cmp eax, 0x10
je 0x1400386f9
cmp eax, 0x80c8
jne 0x140038610
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x140038610
inc dword [rdi + 0xac]
mov rsi, qword [rdi + 0x48]
test rsi, rsi
je 0x1400386df
nop
cmp dword [rdi + 0xa8], 0
jne 0x1400386df
lea rcx, [rdi + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
test rsi, rsi
je 0x140038751
cmp qword [rdi + 0x88], 0
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jbe 0x1400386b8
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x1400386b8
cmp qword [rax + 0x10], rbx
je 0x1400386b6
mov rax, qword [rax]
test rax, rax
jne 0x1400386a6
jmp 0x1400386b8
xor ebx, ebx
lea rcx, [rdi + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400386da
mov rax, qword [rbx]
mov rcx, rbx
mov r9d, dword [r14 + 4]
mov r8d, dword [r14]
mov edx, dword [rsp + 0x30]
call qword [rax]
test rsi, rsi
jne 0x140038670
dec dword [rdi + 0xac]
lea rcx, [rdi + 0x20]
call fcn.1400098a0
jmp 0x140038610
js 0x140038610
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x140038716
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rdi + 0xb0], 0
mov r8d, 0x5b
lea rdx, str.CLowLevelKeyboardEventNotify::UnregisterLLKeyboard
lea rcx, [0x1400934a8]
call fcn.14002f950
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140076320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140003ec0
int3
Function at 0x14003c2f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudioWOV
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003c41a
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x30]
lea rdx, str.EnableDefaultKeyword
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14003c3aa
cmp dword [rsp + 0x30], 4
jne 0x14003c3aa
cmp dword [rsp + 0x38], eax
je 0x14003c3aa
test rbx, rbx
je 0x14003c3a3
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor ebx, ebx
mov edi, 1
jmp 0x14003c3ee
mov edi, 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EnableDefaultKeyword
mov rcx, rbx
lea r9d, [rdi + 3]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test rbx, rbx
je 0x14003c3ec
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor ebx, ebx
xor edi, edi
test rbx, rbx
je 0x14003c3fc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140076320
add rsp, 0x58
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140076320
add rsp, 0x58
ret

Function at 0x14003c660
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.14003c510
xor ecx, ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x14003c6c0]
mov r9, rbx
mov dword [rsp + 0x20], ecx
xor edx, edx
mov dword [rbx + 0x88], ecx
mov dword [rsp + 0x30], ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x78], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140076320
add rsp, 0x40
pop rbx
ret
Function at 0x14003c980
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [rcx], 0
mov esi, edx
jne 0x14003c9b4
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140076320
add rsp, 0x40
pop rsi
ret
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
lea rdx, str.SOFTWARERealtekAudioWOV
xor edi, edi
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ca63
mov rbx, qword [rsp + 0x30]
lea r9d, [rdi + 4]
mov eax, edi
mov dword [rsp + 0x28], 4
test esi, esi
lea rdx, str.DefaultKeywordGlobalStatus
mov rcx, rbx
setne al
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14003ca3f
test rbx, rbx
je 0x14003ca63
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, edi
jmp 0x14003ca55
test rbx, rbx
je 0x14003ca50
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, rdi
mov edi, 1
test rbx, rbx
je 0x14003ca63
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140076320
add rsp, 0x40
pop rsi
ret
Function at 0x140040800
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
test rcx, rcx
jne 0x140040847
lea r8d, [rcx + 0x73]
lea rcx, str._s__d_RETURN_ON_FALSE
lea rdx, str.CNamedPipeHelper::SendPipeMessage
call fcn.14002f950
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140076320
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x30], 0
lea rcx, str..pipeRtkAudUServiceNamedPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov qword [rsp + 0x68], rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400408dc
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x208
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
lea rdx, str.CNamedPipeHelper::SendPipeMessage
mov r9d, dword [rbx]
mov r8d, 0x85
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x20], ecx
lea rcx, str._s__d_dwEventId_x_nIndex_d_dwWritten_d
call fcn.14002f950
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140040906
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r9, str..pipeRtkAudUServiceNamedPipe
mov r8d, 0x8c
lea rdx, str.CNamedPipeHelper::SendPipeMessage
mov dword [rsp + 0x20], eax
lea rcx, str._s__d_CreateFile__s__Err_d
call fcn.14002f950
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140076320
add rsp, 0x50
pop rbx
ret

Function at 0x140042040
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
je 0x1400420a7
movsxd rax, dword [rcx + 0x68]
mov byte [rax + rcx + 0x6c], sil
inc dword [rcx + 0x68]
cmp edx, 0xa
je 0x14004206e
cmp dword [rcx + 0x68], 0x200
jne 0x1400420b1
add rcx, 0x6c
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rdi + 0x6c]
mov r8d, 0x200
call fcn.14007eaa0
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov dword [rdi + 0x68], 0
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
add rcx, 0x6c
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004bdd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r9
mov r14, r8
mov rbp, rdx
test rdx, rdx
jne 0x14004be20
lea r8d, [rdx + 0x68]
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
xor eax, eax
jmp 0x14004bedd
test rsi, rsi
jne 0x14004be2b
lea r8d, [rsi + 0x69]
jmp 0x14004be06
xor eax, eax
mov qword [rsp + 0x50], rax
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], r15d
mov edi, 1
mov r9d, edi
mov r8, rbp
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14002a460
test eax, eax
je 0x14004be80
mov r9, rbp
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14002f950
jmp 0x14004bec5
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14004bec5
cmp dword [rsp + 0x40], 4
jne 0x14004bec5
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
jmp 0x14004bec8
mov edi, r15d
cmp qword [rsp + 0x48], 0
je 0x14004bedb
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140076320
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004bf00
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15d, r9d
mov r14, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14004bf56
mov r8d, 0x83
lea rdx, str.CRegClient::SetRegUI4Property
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
xor eax, eax
jmp 0x14004c03b
test r14, r14
jne 0x14004bf63
mov r8d, 0x84
jmp 0x14004bf3c
xor eax, eax
mov qword [rsp + 0x48], rax
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
call fcn.14004cbf0
test eax, eax
jne 0x14004bf9c
mov rdx, rsi
mov rcx, rbp
call fcn.14004c420
test eax, eax
jne 0x14004bf9c
mov r8d, 0x8d
jmp 0x14004c011
mov r9d, 2
mov r8, rsi
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.14002a460
test eax, eax
je 0x14004bfd6
mov r8d, 0x92
lea rdx, str.CRegClient::SetRegUI4Property
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
mov rbx, qword [rsp + 0x40]
jmp 0x14004c02b
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, r14
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14004c026
mov r8d, 0x96
lea rdx, str.CRegClient::SetRegUI4Property
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
jmp 0x14004c02b
mov edi, 1
test rbx, rbx
je 0x14004c039
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140076320
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004c060
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rsi
mov rax, qword [0x1400d5010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
test rdx, rdx
jne 0x14004c0b3
mov r8d, 0xc0
lea rdx, str.CRegClient::SetRegUI4PropertyNoCreateKey
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
xor eax, eax
jmp 0x14004c184
xor eax, eax
mov qword [rsp + 0x48], rax
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov rcx, 0xffffffff80000002
call fcn.14004cbf0
test eax, eax
je 0x14004c174
lea r9d, [rdi + 2]
mov r8, rsi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.14002a460
test eax, eax
je 0x14004c11c
mov r8d, 0xce
lea rdx, str.CRegClient::SetRegUI4PropertyNoCreateKey
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
mov rbx, qword [rsp + 0x40]
jmp 0x14004c174
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.JackStatus
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14004c16f
mov r8d, 0xd2
lea rdx, str.CRegClient::SetRegUI4PropertyNoCreateKey
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14002f950
jmp 0x14004c174
mov edi, 1
test rbx, rbx
je 0x14004c182
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140076320
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret