joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099af0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, str.CDellOptimizer::SetGlobalRemoveMyBackgroundNoise
xor edi, edi
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
lea rax, [0x14031b830]
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_shareddelloptimizer.cpp
lea r9d, [rdi + 3]
mov qword [rsp + 0x20], rdi
mov edx, 0x214
movaps xmm6, xmm1
call fcn.140039f30
xorps xmm0, xmm0
ucomisd xmm6, xmm0
jp 0x140099b5f
mov eax, edi
je 0x140099b64
mov eax, 1
mov dword [rsp + 0x58], eax
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140099be9
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.RemoveMyBackgroundNoise
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r8d, dword [rbx + 0x13f140]
movaps xmm1, xmm6
mov rcx, rbx
call fcn.1400bd340
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
ret
Function at 0x140099c20
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, str.CDellOptimizer::SetGlobalRemoveOthersBackgroundNoise
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
lea rax, [0x14031b830]
mov edx, 0x21e
mov qword [rsp + 0x28], rax
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_shareddelloptimizer.cpp
lea r9d, [rbx + 3]
mov qword [rsp + 0x20], rbx
movaps xmm6, xmm1
call fcn.140039f30
xorps xmm0, xmm0
ucomisd xmm6, xmm0
jp 0x140099c88
mov eax, ebx
je 0x140099c8d
mov eax, 1
mov dword [rsp + 0x58], eax
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140099d12
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.RemoveOthersBackgroundNoise
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movaps xmm1, xmm6
call fcn.1400bd4b0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
ret
Function at 0x140099d40
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm6, xmm1
mov r14, rcx
movsd qword [rsp + 0x30], xmm1
lea rax, str.CDellOptimizer::SetGlobalVoiceQualityMonitorActive__g
mov qword [rsp + 0x28], rax
xor r15d, r15d
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 3]
lea r8, [0x1404675c0]
mov edx, 0x231
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_shareddelloptimizer.cpp
call fcn.140039f30
cvttsd2si rax, xmm6
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140099e45
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 4]
xor r8d, r8d
lea rdx, str.VQMPower
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor sil, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
lea rcx, [r14 + 0x5c8]
lea r8, [rsp + 0x68]
mov edx, 1
call fcn.14007f840
mov rdi, r15
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
sub rbp, rbx
add rbp, 7
shr rbp, 3
cmp rbx, qword [rsp + 0x70]
cmova rbp, r15
test rbp, rbp
je 0x140099f04
movsd xmm8, qword [0x1403a98f0]
xorps xmm7, xmm7
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x140099ef8
xor edx, edx
call fcn.14007c630
test rax, rax
je 0x140099ef8
mov rdx, rax
mov rcx, r14
call fcn.1400bb620
ucomisd xmm8, xmm6
jp 0x140099ecd
mov ecx, 0x1000
je 0x140099ed0
mov ecx, r15d
ucomisd xmm7, xmm6
jp 0x140099ede
mov r9d, 0x1000
je 0x140099ee1
mov r9d, r15d
mov dword [rsp + 0x20], ecx
mov edx, 0xfffffffd
mov r8d, edx
mov rcx, rax
call fcn.140094c90
movzx esi, al
add rbx, 8
inc rdi
cmp rdi, rbp
jne 0x140099ea0
lea rcx, [rsp + 0x68]
call fcn.14003d760
movzx eax, sil
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009bb20
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, edx
movaps xmm6, xmm2
mov rbx, rcx
sub eax, 0xae
je 0x14009bd20
sub eax, 2
je 0x14009bcd8
sub eax, 0x2a
je 0x14009bc74
sub eax, 2
je 0x14009bc1a
cmp eax, 0x54
je 0x14009bb7d
call fcn.1400b2380
jmp 0x14009bd7a
cvttsd2si rax, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov ebx, 0x80004005
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x50], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14009bc10
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.MaxxSensePower
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
sete al
jmp 0x14009bd7a
movaps xmmword [rsp + 0x70], xmm7
lea r8, [rsp + 0x50]
xorps xmm7, xmm7
mov edx, 0x97
movsd qword [rsp + 0x50], xmm7
call fcn.1400b3f60
test al, al
je 0x14009bc5a
ucomisd xmm7, qword [rsp + 0x50]
jp 0x14009bc5a
jne 0x14009bc5a
movsd xmm2, qword [0x1403a98f0]
mov edx, 0x97
mov rcx, rbx
call fcn.1400b2380
movaps xmm2, xmm6
mov edx, 0xdc
mov rcx, rbx
call fcn.1400b2380
movaps xmm7, xmmword [rsp + 0x70]
jmp 0x14009bd7a
cvttsd2si eax, xmm6
mov r8d, 0xffffffff
test eax, eax
js 0x14009bcc1
mov r10, qword [rcx + 0x13f590]
mov rcx, qword [rcx + 0x13f598]
movsxd r9, eax
sub rcx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jae 0x14009bcc1
lea rax, [r9 + r9*2]
add rax, rax
mov r8d, dword [r10 + rax*8]
mov edx, dword [rbx + 0x13ef70]
mov rcx, qword [rbx + 0x5a8]
call fcn.1400935c0
jmp 0x14009bd7a
xor eax, eax
lea r9, [0x14031f690]
cvttsd2si edx, xmm6
mov rcx, r9
lea r8d, [rax - 1]
nop dword [rax]
cmp dword [rcx], edx
je 0x14009bd0c
inc eax
add rcx, 8
cmp eax, 0x13
jb 0x14009bcf0
mov edx, r8d
mov rcx, rbx
call fcn.1400b7c80
jmp 0x14009bd7a
mov eax, eax
mov rcx, rbx
mov r8d, dword [r9 + rax*8 + 4]
mov edx, r8d
call fcn.1400b7c80
jmp 0x14009bd7a
xorps xmm0, xmm0
ucomisd xmm0, xmm6
jp 0x14009bd30
jne 0x14009bd30
xor r9b, r9b
jmp 0x14009bd33
mov r9b, 1
cmp dword [rcx + 0x13ef48], 0xffffffff
mov dl, 1
je 0x14009bd4f
mov rax, qword [rcx + 0x600]
mov ecx, dword [rax + 0x18]
shr ecx, 0x1f
test cl, cl
je 0x14009bd77
cmp byte [rbx + 0x13ef0c], 0
jne 0x14009bd77
mov r8d, dword [rbx + 0x13ef70]
xor eax, eax
mov rdx, qword [rbx + 0x5a8]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400b7150
movzx edx, al
movzx eax, dl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
ret
Function at 0x1400a7c60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r8, qword [rcx + 0x600]
mov ebx, edx
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
call fcn.14007a8f0
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov ebx, 0x80004005
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400a7d2b
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SpatialAudioSoundModeAutoDetect
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, qword [rsp + 0x58]
test ebx, ebx
mov ecx, 0xffffffff
sete bl
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400a7d58
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x1400a7d80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov edi, edx
add rcx, 0x13ef20
movabs rdx, 0x80000000000000
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
test al, al
je 0x1400a7f16
mov rax, qword [rbx]
lea r8, [rsp + 0x50]
xorps xmm0, xmm0
mov edx, 0x92
mov rcx, rbx
movsd qword [rsp + 0x50], xmm0
mov rax, qword [rax + 0x20]
call qword [case.0x14004487d.0]
cmp edi, 2
jne 0x1400a7f0c
movsd xmm0, qword [0x1403a98f0]
ucomisd xmm0, qword [rsp + 0x50]
jp 0x1400a7f0c
jne 0x1400a7f0c
mov r8, qword [rbx + 0x600]
lea rdx, [rsp + 0x30]
xor edi, edi
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
call fcn.14007a8f0
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0x1869f
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a7ea7
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.SpatialAudioLastSoundMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rdx, qword [rsp + 0x38]
mov eax, 0xffffffff
mov edi, dword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a7ed3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
cmp edi, 0x1869f
jne 0x1400a7ee2
mov edx, 1
jmp 0x1400a7f0e
mov rcx, qword [rbx + 0x5a8]
mov r8d, edi
mov edx, 0xffffffff
call fcn.1400935c0
mov rcx, qword [rbx + 0x5b8]
mov r8d, edi
mov edx, 0xffffffff
call fcn.1400935c0
jmp 0x1400a7f16
xor edx, edx
mov rcx, rbx
call fcn.1400a7c60
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400bace0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x148
lea rdx, [rcx + 0x13f008]
cmp qword [rdx + 0x18], 0x10
jb 0x1400bacf8
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r8d, 3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14003d5c0
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x1400bad48
call fcn.1402384fc
add rsp, 0x148
ret

Function at 0x1400bbee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
add rcx, 0x13ef20
mov edx, 0x40000000
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
test al, al
jne 0x1400bbfa7
xor eax, eax
lea rdx, [0x140320430]
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400bbf8c
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.DoNotShowJackSenseDialog
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
jne 0x1400bbfa7
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret
Function at 0x1400bd4b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, str.CMaxxAudioClientEx::SetGlobalRemoveOthersBackgroundNoise
xor edi, edi
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
lea rax, [0x14031b830]
mov edx, 0x180e
mov qword [rsp + 0x28], rax
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedmaxxaudioclientex.cpp
lea r9d, [rdi + 3]
mov qword [rsp + 0x20], rdi
movaps xmm6, xmm1
call fcn.140039f30
xorps xmm0, xmm0
ucomisd xmm6, xmm0
jp 0x1400bd51c
mov eax, edi
je 0x1400bd521
mov eax, 1
mov dword [rsp + 0x58], eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov ebx, 0x80004005
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400bd5ad
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.RemoveOthersBackgroundNoise
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
ret
Function at 0x1400be320
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [rcx + 0x13f08b], 0x10
mov rbx, rcx
jb 0x1400be43f
lea r8, str.SoloModeEnabledState
mov rcx, 0xffffffff80000002
lea rdx, [0x140320430]
call fcn.140058280
cmp eax, 1
jne 0x1400be3f7
xor eax, eax
lea rdx, [0x140320430]
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400be3e0
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.SoloModeEnabledState
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x50
pop rbx
ret
mov rax, qword [rbx + 0x13ef20]
lea rcx, [rbx + 0x13ef20]
movabs rdx, 0x8000000000
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
test al, al
jne 0x1400be43f
mov rax, qword [rbx + 0x13ef20]
lea rcx, [rbx + 0x13ef20]
movabs rdx, 0x8000000000000
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
mov eax, 3
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x50
pop rbx
ret
Function at 0x1400bf200
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm6, xmm2
mov rdi, rdx
test rdx, rdx
je 0x1400bf392
mov qword [r11 + 8], rbx
lea rax, [r11 - 0x38]
xor ebx, ebx
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov qword [r11 - 0x38], rbx
lea rdx, [0x140320430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400bf2a7
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.NxDRAState
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movsd xmm0, qword [0x1403a98f0]
ucomisd xmm0, xmm6
jp 0x1400bf362
jne 0x1400bf362
cmp dword [rsp + 0x60], ebx
je 0x1400bf362
xorps xmm2, xmm2
mov edx, 0x901
mov rcx, rdi
call fcn.140092c30
lea rax, [rsp + 0x64]
mov dword [rsp + 0x58], 2
mov qword [rsp + 0x40], rax
lea rdx, [0x140320430]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400bf362
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.NxDRAState
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movaps xmm2, xmm6
mov edx, 0x973
mov rcx, rdi
call fcn.140092c30
movaps xmm2, xmm6
mov edx, 0x974
mov rcx, rdi
movzx ebx, al
call fcn.140092c30
movzx eax, bl
mov rbx, qword [rsp + 0x90]
jmp 0x1400bf394
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
ret
Function at 0x1400c30f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [r11 - 0x30], rax
lea rdx, [r11 - 0x40]
call fcn.1400bf660
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
sub rcx, rbx
movabs r14, 0xfa9d9d1fd102728b
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
jne 0x1400c318a
mov rax, qword [rdi]
movsd xmm2, qword [0x1403a98f0]
mov edx, 0x164
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
jmp 0x1400c325d
lea rcx, [rdi + 0x13ef20]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
movabs rcx, 0x8000000000000
test rcx, rax
je 0x1400c31b6
lea rdx, str.SOFTWAREWaves_AudioNextGen
jmp 0x1400c31d5
movabs rcx, 0x8000000000
test rcx, rax
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
lea rax, [0x14031b7bc]
cmove rdx, rax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c324c
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.SoloModePower
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r8d, dword [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.1400c32e0
nop
test rbx, rbx
je 0x1400c32b1
mov rcx, qword [rsp + 0x58]
sub rcx, rbx
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x82c
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400c32a9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c32cf
mov rcx, rbx
call fcn.140202ee8
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
call fcn.140238390
int3