joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021750
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r14
sub rsp, 0x38
mov ebx, r8d
mov r14, rdx
test rdx, rdx
jne 0x140021787
mov r8d, 0x315
lea rdx, str.CCustomizeAcer::EnableAcerTrueHarmony
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x38
pop r14
pop rbx
jmp fcn.1400430e0
call fcn.140009c60
mov r9d, 1
mov ecx, dword [rax + 0x17c]
and ecx, 0x8000000
test ebx, ebx
je 0x140021906
mov qword [rsp + 0x58], rbp
test ecx, ecx
mov qword [rsp + 0x60], rsi
mov rcx, r14
mov qword [rsp + 0x30], rdi
je 0x1400217ec
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0
lea rdx, [0x1400afcc8]
call fcn.140002900
mov r8d, dword [rsp + 0x50]
lea rdx, [0x1400afd10]
mov r9d, 1
mov rcx, r14
jmp 0x1400217f6
mov r8d, r9d
lea rdx, [0x1400afd70]
call fcn.140002b60
xor r9d, r9d
lea r8, str.GFX_StereoEnhance_Enable
lea rdx, str.Acer
lea rcx, [0x140104a20]
call fcn.140004280
xor r9d, r9d
lea r8, str.RTK_VOICE_ENHANCE
lea rdx, str.Acer
mov ebx, eax
lea rcx, [0x140104a20]
call fcn.140004280
xor r9d, r9d
lea r8, str.GFX_VirtualBass_Enable
lea rdx, str.Acer
mov edi, eax
lea rcx, [0x140104a20]
call fcn.140004280
xor r9d, r9d
lea r8, str.RTK_MP3_ENHANCE
lea rdx, str.Acer
mov esi, eax
lea rcx, [0x140104a20]
call fcn.140004280
mov r9d, 1
lea rdx, [0x1400afd28]
mov r8d, ebx
mov rcx, r14
mov ebp, eax
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd58]
mov r8d, edi
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd40]
mov r8d, esi
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afce0]
mov r8d, ebp
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afcf8]
xor r8d, r8d
mov rcx, r14
call fcn.140002b60
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop r14
pop rbx
ret
test ecx, ecx
mov rcx, r14
je 0x140021952
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0
lea rdx, [0x1400afd10]
call fcn.140002900
mov r8d, dword [rsp + 0x50]
lea rdx, [0x1400afcc8]
mov r9d, 1
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd10]
mov rcx, r14
jmp 0x140021959
lea rdx, [0x1400afd70]
xor r8d, r8d
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd28]
xor r8d, r8d
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd58]
xor r8d, r8d
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afd40]
xor r8d, r8d
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afce0]
xor r8d, r8d
mov rcx, r14
call fcn.140002b60
mov r9d, 1
lea rdx, [0x1400afcf8]
mov r8d, r9d
mov rcx, r14
call fcn.140002b60
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x140022fe0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140017430
test byte [rax + 4], 1
je 0x140023052
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0
call fcn.140024470
test eax, eax
je 0x140023052
mov r9d, dword [rsp + 0x38]
lea r8, str.GlobalNN
mov dword [rbx + 0x4c], r9d
lea rdx, str.Others
mov rax, qword [0x140104a20]
lea rcx, [0x140104a20]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140023052
lea r8d, [rax + 0x5f]
lea rdx, str.CCustomizeASUS::InitFirstTimeForBgProc
lea rcx, str._s__d_WriteProfileInt_REG_OTHERS_GLOBAL_NN_fail
add rsp, 0x20
pop rbx
jmp fcn.1400430e0
add rsp, 0x20
pop rbx
ret
Function at 0x140024770
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x4c]
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], eax
mov r9d, edx
lea rcx, str._s__d_bSetGlobalNN___d__current_global_NN___d
lea rdx, str.CCustomizeASUS::SetGlobalNN
mov r8d, 0x2ab
call fcn.1400430e0
mov rax, qword [0x140104a20]
lea r8, str.GlobalNN
mov r9d, ebx
lea rdx, str.Others
lea rcx, [0x140104a20]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x1400247ee
mov r9d, ebx
lea rdx, str.CCustomizeASUS::SetGlobalNN
mov r8d, 0x2b1
lea rcx, str._s__d_SetGloablNN_fail__bSetGloablNN___d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400430e0
cmp dword [rdi + 0x4c], ebx
je 0x14002480e
mov dword [rdi + 0x4c], ebx
call fcn.140009f90
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.140087ab0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140024ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400ff010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov qword [r11 - 0x40], rcx
lea rax, vtable.CCustomizeGigabyte.0
mov qword [rcx], rax
lea rax, vtable.CCustomizeGigabyte.1.0
mov qword [rcx + 8], rax
xor ebx, ebx
mov qword [rcx + 0x10], rbx
cmp dword [0x140104a30], ebx
je 0x140024cc9
call fcn.140009c60
test dword [rax + 0x48], 0x200
je 0x140024cc9
mov ebp, 0x3e7
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x40], ebx
lea r9d, [rbx + 1]
lea r8, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.14001da70
test eax, eax
je 0x140024b93
lea r9, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.1400430e0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140024be9
jmp 0x140024be3
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.JackImpedance
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140024bdb
cmp dword [rsp + 0x48], 4
jne 0x140024bdb
mov ebp, dword [rsp + 0x40]
test rbx, rbx
je 0x140024be9
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.140009e20
mov rcx, rax
call fcn.14006b4e0
call fcn.140009e20
mov rcx, rax
call fcn.14006b480
mov rbx, rax
test rbx, rbx
je 0x140024c55
call fcn.140009e20
call fcn.140009e20
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140024c06
cmp dword [rcx + 0x184], 1
jne 0x140024c06
xor r9d, r9d
mov r8d, ebp
lea rdx, [0x1400afba8]
call fcn.140002b60
mov r9d, ebp
mov r8d, eax
lea rdx, str.CCustomizeGigabyte::CCustomizeGigabyte
lea rcx, str._s_bSuccess_d_dwHpMode_d
call fcn.1400430e0
call fcn.140009e20
mov rcx, rax
call fcn.14006b560
call fcn.1400053c0
mov rcx, rax
lea r8, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov rdx, 0xffffffff80000002
call fcn.14006d870
mov qword [rdi + 0x10], rax
test rax, rax
je 0x140024ca8
lea rdx, str.JackImpedance
mov rcx, rax
call fcn.14006d320
mov rcx, qword [rdi + 0x10]
add rcx, 0x20
lea rdx, [rdi + 8]
call fcn.140005480
jmp 0x140024cc9
lea r9, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov r8d, 0x30
lea rdx, str.CCustomizeGigabyte::CCustomizeGigabyte
lea rcx, str._s__d___RegKeyNotify_fail__path___s
call fcn.1400430e0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140091f30
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140025460
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1400ff010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.14001da70
test eax, eax
je 0x1400254e9
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.1400430e0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140025571
jmp 0x14002556b
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140025563
cmp dword [rsp + 0x40], 4
jne 0x140025563
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x14002553f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140025571
mov r8d, 0x5e
lea rdx, str.CCustomizeHonor::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.1400430e0
mov eax, 1
jmp 0x140025573
test rbx, rbx
je 0x140025571
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140091f30
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140026550
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14002664d
call fcn.14001f6c0
mov rbx, rax
test rax, rax
jne 0x1400265a8
mov r8d, 0x153
lea rdx, str.CCustomizeHonor::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.1400430e0
mov edx, edi
mov rcx, rbx
call fcn.140045290
imul rcx, rdi, 0xac
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140003db0
mov rcx, rax
test rax, rax
je 0x140026658
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400b0b48]
lea rcx, [rsp + 0x38]
call fcn.140005720
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x140104a28]
call fcn.1400604b0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002664d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003b40
int3

Function at 0x140026970
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x1400269b4
call fcn.140025900
test eax, eax
je 0x140026a04
call fcn.140009f90
mov rcx, rax
mov edx, 0x42d
call fcn.140087ca0
mov r8d, 0x18f
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, [0x1400b0e88]
add rsp, 0x38
jmp fcn.1400430e0
cmp edx, 0x432
jne 0x140026a04
mov r8d, 0x195
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.1400430e0
call fcn.140009f90
mov rcx, rax
mov edx, 0x432
call fcn.140087ca0
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.1400604b0
add rsp, 0x38
ret

Function at 0x140029b90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0xd0]
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], eax
mov r9d, edx
lea rcx, str._s__d_bSetGlobalNN___d__current_global_NN___d
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x436
call fcn.1400430e0
mov rax, qword [0x140104a20]
lea r8, str.GlobalNN
mov r9d, ebx
lea rdx, str.Others
lea rcx, [0x140104a20]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140029c11
mov r9d, ebx
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x43c
lea rcx, str._s__d_SetGloablNN_fail__bSetGloablNN___d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400430e0
cmp dword [rdi + 0xd0], ebx
je 0x140029c37
mov dword [rdi + 0xd0], ebx
call fcn.140009f90
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.140087ab0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14002d8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1400ff010]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.140009c60
test byte [rax + 0x264], 0xf
je 0x14002da62
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x40], 1
call fcn.140003db0
mov rcx, rax
test rax, rax
je 0x14002da7a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r9, str.HP_CONTROL
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400b0b48]
lea rcx, [rsp + 0x50]
call fcn.140005720
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002da46
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002da46
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.HP_CONTROL_DefVolumeLevelEnable
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
jne 0x14002da46
mov r9d, dword [rsp + 0x40]
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x140104a20]
mov rax, qword [0x140104a20]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, 0xb75
lea rdx, str.CCustomizeHP::SyncHpControlDefaultVolume
lea rcx, str._s__d_bSuccess__d__dwForceRestore___d
call fcn.1400430e0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002da62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140091f30
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003b40
int3
Function at 0x1400311f0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
test rdx, rdx
jne 0x14003122f
mov r8d, 0x10d4
lea rdx, str.CCustomizeHP::OnNamedPipeEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400430e0
cmp dword [rdx], 0x30000003
jne 0x1400312b7
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
call fcn.140003db0
mov rcx, rax
test rax, rax
je 0x1400312c2
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdi, [0x1400b1068]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140005580
test al, al
jne 0x14003129b
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x140031280
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140003840
nop
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.1400054e0
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14008ea00
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003b40
int3

Function at 0x140031b80
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1400ff010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.14001da70
test eax, eax
je 0x140031c09
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.1400430e0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140031c91
jmp 0x140031c8b
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140031c83
cmp dword [rsp + 0x40], 4
jne 0x140031c83
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x140031c5f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140031c91
mov r8d, 0x5e
lea rdx, str.CCustomizeHuawei::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.1400430e0
mov eax, 1
jmp 0x140031c93
test rbx, rbx
je 0x140031c91
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140091f30
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140032b40
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x140032c3d
call fcn.14001f6c0
mov rbx, rax
test rax, rax
jne 0x140032b98
mov r8d, 0x153
lea rdx, str.CCustomizeHuawei::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.1400430e0
mov edx, edi
mov rcx, rbx
call fcn.140045290
imul rcx, rdi, 0xac
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140003db0
mov rcx, rax
test rax, rax
je 0x140032c48
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400b0b48]
lea rcx, [rsp + 0x38]
call fcn.140005720
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x140104a28]
call fcn.1400604b0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032c3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003b40
int3

Function at 0x140032cc0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x140032d04
call fcn.140031fe0
test eax, eax
je 0x140032d54
call fcn.140009f90
mov rcx, rax
mov edx, 0x42d
call fcn.140087ca0
mov r8d, 0x18f
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, [0x1400b0e88]
add rsp, 0x38
jmp fcn.1400430e0
cmp edx, 0x432
jne 0x140032d54
mov r8d, 0x195
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.1400430e0
call fcn.140009f90
mov rcx, rax
mov edx, 0x432
call fcn.140087ca0
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.1400604b0
add rsp, 0x38
ret
Function at 0x140033ab0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.CDataAccessProtector::RequestAccess
lea rcx, [0x1400b0e88]
mov r8d, 0x32
call fcn.1400430e0
nop word [rax + rax]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov r8d, 0x3a
lea rdx, str.CDataAccessProtector::RequestAccess
mov r9d, eax
lea rcx, str._s__d_dwRet_d
call fcn.1400430e0
mov rax, qword [rbx]
mov rcx, rbx
xor edi, edi
call qword [rax]
cmp dword [rbx + 0x1c], edi
je 0x140033b21
mov edi, 1
jmp 0x140033b4e
mov rcx, qword [rbx + 0x10]
inc dword [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea r9, [0x1400bde80]
mov r8d, 0x2b
lea rdx, str.CDataAccessProtector::AvoidUpdate
lea rcx, str._s__d__s_m_hCanUpdate_
call fcn.1400430e0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.CDataAccessProtector::RequestAccess
test edi, edi
je 0x140033b74
mov r8d, 0x4e
lea rcx, str._s__d_goto_RE_WAIT
jmp 0x140033ad1
mov r9d, dword [rbx + 0x18]
lea rcx, str._s__d_m_nAudioDevListRef_d
mov r8d, 0x54
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400430e0

Function at 0x140033ba0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, [0x1400b0e88]
mov r8d, 0x5b
call fcn.1400430e0
dec dword [rbx + 0x18]
lea rdx, str.CDataAccessProtector::FinishAccess
mov r9d, dword [rbx + 0x18]
lea rcx, str._s__d_m_nAudioDevListRef_d
mov r8d, 0x61
call fcn.1400430e0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x140033c15
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
lea r9, [0x1400bdf18]
mov r8d, 0x2b
lea rdx, str.CDataAccessProtector::AvoidUpdate
lea rcx, str._s__d__s_m_hCanUpdate_
call fcn.1400430e0
jmp 0x140033c33
cmp eax, 0x32
jle 0x140033c33
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.1400430e0
mov r8d, 0x6e
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, [0x1400b0e88]
add rsp, 0x20
pop rbx
jmp fcn.1400430e0

Function at 0x1400353d0
Capabilities:
Query or enumerate registry value

Disassembly:
cmp edx, 0x40e
jne 0x140035448
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140009f90
mov rcx, rax
mov edx, 0x40e
call fcn.140087ca0
mov ebx, dword [rbx + 0x20]
call fcn.140009c60
movzx ecx, word [rax + 0x2ce]
mov eax, 0x103c
test ebx, ebx
je 0x14003542a
cmp cx, ax
jne 0x140035420
mov edx, 1
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.14002dd30
add rsp, 0x20
pop rbx
jmp fcn.140034a10
cmp cx, ax
jne 0x14003543e
xor edx, edx
lea ecx, [rdx + 1]
add rsp, 0x20
pop rbx
jmp fcn.14002dd30
call fcn.140034dc0
add rsp, 0x20
pop rbx
ret
Function at 0x1400396c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
cmp edx, 0x20
jb 0x1400396f7
mov r8d, 0x70
lea rdx, str.CJackRetaskCommandLineHelper::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400430e0
call fcn.14001f6c0
lea rcx, [rax + 0x10]
call fcn.140033ab0
cmp dword [rdi + 0x70], ebx
jne 0x14003973b
call fcn.14001f6c0
imul rdx, rbx, 0xac
test byte [rax + rdx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
jne 0x14003973b
call fcn.140009f90
mov rcx, rax
mov edx, 0x3f2
call fcn.140087ca0
lea rcx, [rdi - 0x10]
call fcn.140039880
call fcn.14001f6c0
lea rcx, [rax + 0x10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140033ba0