joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025600
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
movzx ebp, r8b
mov qword [r11 + 0x20], rsi
mov r8d, 0x208
mov qword [r11 - 8], rdi
mov esi, edx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1401659c0
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140025654
test rax, rax
jne 0x1400256e0
mov qword [rsp + 0x278], r14
lea r14, [0x1402f38e0]
mov qword [rsp + 0x270], r15
lea r15, [0x1402302b0]
cmp ebx, 7
jae 0x1400256d0
lea rcx, [rbx + rbx*4]
cmp esi, dword [r14 + rcx*8]
jne 0x1400256b3
mov r8, qword [r14 + rcx*8 + 0x10]
lea r9, [0x1402302c0]
test bpl, bpl
lea rdx, str.SoundMode__s__s
lea rcx, [rsp + 0x50]
cmovne r9, r15
call fcn.140025980
inc ebx
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400256c1
test rax, rax
je 0x140025680
mov r14, qword [rsp + 0x278]
mov r15, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x2a8]
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
cmp edi, 0x16
jl 0x140025721
cmp edi, 0x19
jle 0x14002571a
lea eax, [rdi - 0x1b]
cmp eax, 3
ja 0x140025721
lea rdx, str.SOFTWAREWaves_Audio_MaxxPlayMaxxAudio_AGeneral
jmp 0x140025721
lea rdx, str.SOFTWAREWaves_Audio_TBMaxxAudio_AGeneral
mov rdi, qword [rsp + 0x280]
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140025735
test rax, rax
je 0x1400257d9
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0xffffffff
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400257bd
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140146480
add rsp, 0x288
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140146480
add rsp, 0x288
ret
Function at 0x1400297f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov dword [rsp + 0x28], 0x20019
mov r14, r8
mov dword [rsp + 0x40], ebp
mov rbx, rcx
mov qword [rsp + 0x58], rbp
lea r8, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x20], ebp
mov r15, r9
mov rsi, rdx
call fcn.14001f840
test eax, eax
jne 0x140029892
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MaxxAudioGUIType
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140029892
cmp dword [rsp + 0x48], 4
je 0x1400298f7
mov dword [rsp + 0x28], 0x20019
lea r8, str.SoftwareConexant
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], ebp
call fcn.14001f840
mov rdi, qword [rsp + 0x50]
test eax, eax
jne 0x140029917
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MaxxAudioGUIType
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140029917
cmp dword [rsp + 0x44], 4
jne 0x140029917
mov ecx, dword [rsp + 0x40]
movzx eax, cx
mov byte [rbx], cl
mov bl, 1
shr ax, 8
shr ecx, 0x10
mov byte [rsi], al
mov byte [r14], cl
shr cx, 8
mov byte [r15], cl
jmp 0x140029919
xor bl, bl
test rdi, rdi
je 0x140029927
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140146480
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a100
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, str.CBaseThread::Start
mov qword [rsp + 0x30], rax
lea rsi, [0x14022aa38]
mov rbx, rcx
mov qword [rsp + 0x28], rsi
lea r8, [0x140303c50]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 3]
lea edx, [rdi + 0x25]
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_basethread.cpp
call fcn.1400189f0
mov rax, qword [rbx + 0x10]
mov byte [rbx + 0x1c], dil
test rax, rax
jne 0x14002a1a2
lea rax, str.CreateEvent
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 3]
mov qword [rsp + 0x28], rsi
lea r8, [0x140303c50]
lea edx, [rdi + 0x2b]
mov qword [rsp + 0x20], rdi
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_basethread.cpp
call fcn.1400189f0
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14002a221
cmp qword [rbx + 8], rdi
jne 0x14002a204
mov r9d, 3
lea rax, [0x140231720]
mov qword [rsp + 0x30], rax
lea r8, [0x140303c50]
mov qword [rsp + 0x28], rsi
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_basethread.cpp
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 0x30]
call fcn.1400189f0
lea rax, [rbx + 0x18]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14002a050]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002a221
cmp qword [rbx + 8], rdi
je 0x14002a221
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14002aeb0
Capabilities:
Enumerate process modules

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1470
call fcn.1401472c0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x14a8], rbx
mov qword [rsp + 0x14b0], rsi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x1460], rax
mov rbx, rcx
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x40]
call fcn.1401659c0
mov dword [rsp + 0x30], esi
test rbx, rbx
je 0x14002b0d7
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x1250]
call fcn.1401659c0
mov rcx, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rcx + 1]
cmp word [rbx + rcx*2], si
jne 0x14002af40
lea rax, [rbx + rcx*2]
mov rdi, rsi
lea r15, [rcx*2 + 1]
shr r15, 1
cmp rbx, rax
cmova r15, rsi
test r15, r15
je 0x14002af8d
lea rsi, [rsp + 0x1250]
sub rsi, rbx
movzx ecx, word [rbx]
call fcn.14017d9d8
mov word [rsi + rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r15
jne 0x14002af73
xor esi, esi
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14002b0cc
mov eax, dword [rsp + 0x30]
shr eax, 2
test eax, eax
je 0x14002b0cc
lea r12, [rsp + 0x40]
mov r13d, eax
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14002b0be
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x1040]
call fcn.1401659c0
mov dword [rsp + 0x34], 0x104
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x1040]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
cmp si, word [rsp + 0x1040]
je 0x14002b0b5
lea rax, [rsp + 0x1040]
mov rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp word [rax + rcx*2], 0
jne 0x14002b030
lea rax, [rsp + 0x1040]
lea rax, [rax + rcx*2]
lea rbx, [rsp + 0x1040]
mov rdi, rsi
lea rsi, [rcx*2 + 1]
shr rsi, 1
lea rcx, [rsp + 0x1040]
cmp rcx, rax
mov eax, 0
cmova rsi, rax
test rsi, rsi
je 0x14002b08d
movzx ecx, word [rbx]
call fcn.14017d9d8
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, rsi
jne 0x14002b076
lea rdx, [rsp + 0x1250]
lea rcx, [rsp + 0x1040]
call fcn.14016467c
test rax, rax
mov eax, 1
cmovne r14d, eax
mov dword [rsp + 0x20], r14d
xor esi, esi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
add r12, 4
sub r13, 1
jne 0x14002afc1
mov eax, r14d
jmp 0x14002b0d9
mov eax, esi
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002b920
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x590
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov rbx, rcx
cmp dword [rcx + 0x88], 0
jl 0x14002bb57
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x270]
call fcn.1401659c0
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x270]
call fcn.140025980
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call fcn.1401659c0
lea r8, [rbp + 0x60]
mov edx, dword [rbx + 0x88]
mov ecx, dword [rbx + 0x78]
call fcn.1401bf6b0
mov rdx, qword [rbx + 0x90]
add rdx, 0x18
lea rcx, [rsp + 0x50]
call fcn.14001d8a0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
mov r8d, 3
lea rcx, [rbp - 0x60]
call fcn.140016ab0
nop
xor r15d, r15d
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], r15b
mov rdx, qword [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x14002ba20
lea rcx, [rbp + 0x40]
call fcn.140025820
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x14002ba46
call fcn.14016e4d0
nop
lea rcx, [rsp + 0x50]
call fcn.1400166e0
mov r14, qword [rbp + 0x50]
lea rdi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdi, qword [rbp + 0x40]
mov esi, 0x80004005
mov dword [rbp + 0x38], r15d
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14002badf
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
sete dil
cmp qword [rbx + 0x68], 0
je 0x14002bb48
mov rdx, qword [rbx + 0x90]
add rdx, 0x18
lea rcx, [rsp + 0x70]
call fcn.14001d8a0
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea rdx, [rbx + 0x58]
cmp qword [rdx + 0x18], 8
jb 0x14002bb1f
mov rdx, qword [rdx]
mov dword [rsp + 0x20], r15d
mov r9d, dword [rbx + 0x88]
mov rcx, 0xffffffff80000002
call fcn.14001fd70
test eax, eax
setne dil
lea rcx, [rsp + 0x70]
call fcn.1400166e0
nop
lea rcx, [rbp + 0x40]
call fcn.1400168e0
movzx eax, dil
jmp 0x14002bb59
xor al, al
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002bb90
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x4b0
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
cmp dword [rcx + 0x88], 0
mov rbx, rcx
jl 0x14002bd24
mov qword [r11 + 0x10], rsi
lea rcx, [r11 - 0x228]
xor edx, edx
mov qword [r11 + 0x18], rdi
mov r8d, 0x208
call fcn.1401659c0
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rsp + 0x290]
call fcn.140025980
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call fcn.1401659c0
mov edx, dword [rbx + 0x88]
lea r8, [rsp + 0x80]
mov ecx, dword [rbx + 0x78]
call fcn.1401bf6b0
xor ecx, ecx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov esi, 0x80004005
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002bc8f
lea rdx, [rsp + 0x290]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x70]
mov esi, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rdx, qword [rbx + 0x90]
lea rcx, [rsp + 0x50]
add rdx, 0x18
call fcn.14001d8a0
cmp qword [rsp + 0x68], 8
lea r8, [rsp + 0x50]
lea rdx, [rbx + 0x58]
cmovae r8, qword [rsp + 0x50]
cmp qword [rdx + 0x18], 8
jb 0x14002bcc3
mov rdx, qword [rdx]
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.14001fae0
test eax, eax
lea rcx, [rsp + 0x50]
setne dil
call fcn.1400166e0
test esi, esi
mov rsi, qword [rsp + 0x4c8]
je 0x14002bd16
test dil, dil
jne 0x14002bd16
xor al, al
mov rdi, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140146480
add rsp, 0x4b0
pop rbx
ret
mov dword [rbx + 0x88], 0xffffffff
mov al, 1
jmp 0x14002bcf5
xor al, al
jmp 0x14002bcfd
Function at 0x14003f950
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, edx
movaps xmm6, xmm2
mov rbx, rcx
sub eax, 0xe6
je 0x14003fb29
sub eax, 2
je 0x14003fb1f
cmp eax, 1
je 0x14003f99b
call fcn.14004f550
jmp 0x14003fb31
lea rax, str.CDellOptimizer::SetGlobalNXPower
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x30], rax
lea r8, [0x140303c50]
xor edi, edi
lea rax, [0x14022aa38]
mov qword [rsp + 0x28], rax
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shareddelloptimizer.cpp
mov edx, 0xad
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 3]
call fcn.1400189f0
lea r8, str.NXEnabled
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
call fcn.140020e50
test eax, eax
jne 0x14003fa80
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003fa80
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.NXEnabled
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cvttsd2si rax, xmm6
xor r9d, r9d
mov qword [rsp + 0x58], rdi
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xb8]
test rcx, rcx
je 0x14003fb12
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.NXPower
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movaps xmm1, xmm6
mov rcx, rbx
call fcn.140058970
jmp 0x14003fb31
movaps xmm1, xmm6
call fcn.14003ff70
jmp 0x14003fb31
movaps xmm1, xmm6
call fcn.14003fc90
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140146480
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
ret
Function at 0x14003ff70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm6, xmm1
mov r15, rcx
lea rax, str.CDellOptimizer::SetGlobalVoiceProfile
mov qword [rsp + 0x30], rax
lea rax, [0x14022aa38]
mov qword [rsp + 0x28], rax
xor r12d, r12d
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 3]
lea r8, [0x140303c50]
mov edx, 0x90
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shareddelloptimizer.cpp
call fcn.1400189f0
cvttsd2si rax, xmm6
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140040078
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.VoiceProfile
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea rcx, [r15 + 0x5d0]
lea rdx, [rsp + 0x68]
call fcn.140030f40
mov rbx, r12
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
sub r14, rbp
add r14, 7
shr r14, 3
cmp rbp, qword [rsp + 0x70]
cmova r14, r12
mov rdi, rbp
test r14, r14
je 0x140040106
mov rcx, qword [rdi]
cmp dword [rcx + 0x10], 1
jne 0x1400400fa
mov rsi, r12
xor edx, edx
call fcn.14002dc10
test rax, rax
je 0x1400400e6
mov rdx, rax
mov rcx, r15
call fcn.140056ef0
mov rsi, rax
movaps xmm3, xmm6
mov r8d, 0xfffffffd
mov rdx, rsi
mov rcx, r15
call fcn.140058660
add rdi, 8
inc rbx
cmp rbx, r14
jne 0x1400400c0
test rbp, rbp
je 0x140040140
mov rdx, qword [rsp + 0x78]
sub rdx, rbp
and rdx, 0xfffffffffffffff8
mov rax, rbp
cmp rdx, 0x1000
jb 0x140040138
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040173
mov rcx, rbp
call fcn.140146bac
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14016e380
int3
Function at 0x140056a30
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x148
lea rdx, [rcx + 0x13df80]
cmp qword [rdx + 0x18], 0x10
jb 0x140056a48
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r8d, 3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140021580
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x140056a98
call fcn.14016e4d0
add rsp, 0x148
ret

Function at 0x140057760
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rcx + 0x13dee8]
shr rax, 0x1e
test al, 1
jne 0x140057818
xor eax, eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400577fd
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.DoNotShowJackSenseDialog
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
jne 0x140057818
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140146480
add rsp, 0x58
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140146480
add rsp, 0x58
ret
Function at 0x14005ca00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm6, xmm2
mov rsi, rcx
sub edx, 1
je 0x14005cb27
cmp edx, 1
jne 0x14005cb5a
cvttsd2si ecx, xmm2
mov qword [rsp + 0x78], rdi
xor dil, dil
test ecx, ecx
je 0x14005caf3
sub ecx, edx
je 0x14005ca6c
sub ecx, edx
je 0x14005ca62
cmp ecx, edx
jne 0x14005cb1c
lea ebx, [rdx + 8]
jmp 0x14005caf5
mov ebx, 4
jmp 0x14005caf5
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 3
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14005cae9
lea rax, [rsp + 0x3c]
mov ebx, 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastOutputMode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, dword [rsp + 0x38]
test ebx, ebx
js 0x14005cb1c
jmp 0x14005caf5
xor ebx, ebx
mov r8d, ebx
lea rdx, str.APORenderA
mov rcx, rsi
call fcn.14005d230
mov r8d, ebx
lea rdx, str.APORenderB
mov rcx, rsi
movzx edi, al
call fcn.14005d230
movzx eax, dil
mov rdi, qword [rsp + 0x78]
jmp 0x14005cb9a
movsd xmm0, qword [0x140289c70]
ucomisd xmm0, xmm6
jp 0x14005cb61
jne 0x14005cb61
lea rdx, str.Skype.exe
call fcn.1400685c0
lea rdx, str.communicator.exe
movzx ebx, al
call fcn.1400685c0
test bl, bl
jne 0x14005cb5e
test al, al
jne 0x14005cb5e
xor al, al
jmp 0x14005cb9a
movaps xmm2, xmm6
lea rdx, str.APORenderA
call fcn.14005cbc0
movaps xmm2, xmm6
lea rdx, str.APORenderB
call fcn.14005cbc0
movaps xmm2, xmm6
lea rdx, str.APOMVCaptureA
call fcn.14005cbc0
movaps xmm2, xmm6
lea rdx, str.APOMVCaptureB
call fcn.14005cbc0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rsi
ret