joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c07b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.140085ae0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2ee
lea rcx, str._s__d_hadRun_d
call fcn.140065460
cmp dword [rsp + 0x40], 1
jne 0x1400c0909
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2f1
lea rcx, str._s__d_hadRun_d
call fcn.140065460
call fcn.14000b9e0
mov rcx, rax
call fcn.140095b00
call fcn.14000b9e0
mov rcx, rax
call fcn.140095aa0
mov rbx, rax
test rbx, rbx
je 0x1400c08f7
call fcn.14000b9e0
call fcn.14000b9e0
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400c0846
cmp dword [rcx + 0x1ac], 1
jne 0x1400c0846
add rcx, 0xc8
mov qword [rsp + 0x48], rdi
call fcn.140010890
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.140085ae0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2fe
lea rcx, str._s__d_bMuted_d
call fcn.140065460
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
call qword [r9 + 0x10]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.140085c10
mov rdi, qword [rsp + 0x48]
call fcn.14000b9e0
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.140095b80
add rsp, 0x30
pop rbx
ret

Function at 0x1400c1400
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400c1486
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37a0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c14b0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14002c4e0
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400c1559
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400d37a0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400c17e0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400c1833
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400c1911
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400c190f
cmp eax, 3
jne 0x1400c1898
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400c1828
cmp dword [rsp + 0x3c], 1
je 0x1400c190f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400c192c
cmp dword [rsp + 0x3c], 3
je 0x1400c1845
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400c1828
cmp dword [rsp + 0x3c], 1
je 0x1400c190f
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400c1828
cmp dword [rsp + 0x3c], 1
je 0x1400c190f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400c192c
cmp dword [rsp + 0x3c], 1
jne 0x1400c18c0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37a0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400c1911
Function at 0x1400c1e50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.140065460
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400c1ed0]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d37a0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400c2af0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c2b7b
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d37a0
add rsp, 0x58
ret
Function at 0x1400c7680
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
cmp edx, 0x20
jb 0x1400c76ab
mov r8d, 0x291
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140065460
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call fcn.14002ce10
lea rcx, [rax + 0x10]
call fcn.140049450
call fcn.14002ce10
mov rcx, rax
mov edx, ebx
call fcn.140068d40
mov esi, eax
call fcn.14002ce10
mov rdi, rax
call fcn.1400c6800
test eax, eax
je 0x1400c76fd
imul rdx, rbx, 0xb0
test byte [rdx + rdi + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
je 0x1400c76fd
mov ebx, 1
jmp 0x1400c76ff
xor ebx, ebx
call fcn.14002ce10
mov rcx, rax
mov eax, 0xffffffff
lock xadd dword [rcx + 0x28], eax
mov eax, dword [rcx + 0x28]
mov rdi, qword [rsp + 0x38]
test eax, eax
jne 0x1400c7729
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400c774a
mov eax, dword [rcx + 0x28]
cmp eax, 0x32
jle 0x1400c774a
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.140065460
mov r8d, 0x297
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140119e10]
call fcn.140065460
cmp dword [0x1401ade90], 0
je 0x1400c77de
test esi, esi
je 0x1400c77b8
xor edx, edx
lea rcx, [0x140119b08]
call fcn.1400c6140
call fcn.14005b6d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x108]
test eax, eax
je 0x1400c77de
mov r8d, 0x2ab
mov dword [0x1401ade90], 0
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140119e10]
call fcn.140065460
jmp 0x1400c77de
call fcn.14005b6d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x88]
test eax, eax
jne 0x1400c77de
mov edx, 0x2000000
lea rcx, str._Ping
call fcn.1400c6140
mov rsi, qword [rsp + 0x30]
test ebx, ebx
je 0x1400c7839
mov r8d, 0x2ba
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_Detect_Plug_In_And_Handle_by_UWP__SET_PING_UWP_WHILE_PLUG_IN_EVENT_HAPPENED_2s_later
call fcn.140065460
mov dword [0x1401ade98], 0xa
call fcn.14000bb60
mov rcx, rax
mov edx, 0x40c
call fcn.1400c8d80
call fcn.14000bb60
mov rcx, rax
mov edx, 0x40c
mov r8d, 0x7d0
add rsp, 0x20
pop rbx
jmp fcn.1400c8b50
add rsp, 0x20
pop rbx
ret
Function at 0x1400c90b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x12c], 0
mov r14, rcx
jne 0x1400c92bf
nop dword [rax]
mov ecx, dword [r14 + 0x130]
lea rdx, [r14 + 0x138]
mov r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x1400c92b1
cmp qword [r14 + 0xe8], 0
je 0x1400c92b1
mov edx, dword [r14 + 0xf0]
xor ecx, ecx
test edx, edx
je 0x1400c913f
mov r9, qword [r14 + 0xe0]
nop dword [rax]
mov r8, qword [r9 + rcx*8]
test r8, r8
jne 0x1400c9150
inc ecx
cmp ecx, edx
jb 0x1400c9130
xor r8d, r8d
test r8, r8
je 0x1400c92b1
nop dword [rax + rax]
mov r11, r8
test r8, r8
je 0x1400c9194
mov rcx, qword [r8 + 0x10]
test rcx, rcx
jne 0x1400c9191
mov eax, dword [r8 + 0x18]
xor edx, edx
mov r10d, dword [r14 + 0xf0]
div r10d
inc edx
cmp edx, r10d
jae 0x1400c9191
mov rax, qword [r14 + 0xe0]
mov r9, qword [rax + rdx*8]
test r9, r9
cmovne rcx, r9
inc edx
test rcx, rcx
je 0x1400c9173
mov r8, rcx
mov rax, qword [r11 + 8]
test rax, rax
je 0x1400c91aa
cmp dword [rax + 0x18], ebx
jne 0x1400c91aa
mov rdi, qword [rax]
test rdi, rdi
jne 0x1400c91b4
test r8, r8
jne 0x1400c9150
jmp 0x1400c92b1
mov r15d, dword [rax + 8]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov r12d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov r8d, 0xb1
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r9d, eax
lea rcx, str._s__d___Thread_ID___d
call fcn.140065460
mov ecx, 1
lock xadd dword [rdi + 0xb4], ecx
mov rsi, qword [rdi + 0x50]
test rsi, rsi
je 0x1400c9271
cmp dword [rdi + 0xb0], 0
jne 0x1400c9271
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
test rsi, rsi
je 0x1400c92f4
cmp qword [rdi + 0x90], 0
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jbe 0x1400c9252
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400c9252
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400c9250
mov rax, qword [rax]
test rax, rax
jne 0x1400c9240
jmp 0x1400c9252
xor ebx, ebx
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400c926c
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
test rsi, rsi
jne 0x1400c9200
mov eax, 0xffffffff
lock xadd dword [rdi + 0xb4], eax
lea rcx, [rdi + 0x28]
call fcn.14000b8f0
cmp r12d, 1
jbe 0x1400c92ab
mov r9d, r12d
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r8d, SystemTimeToVariantTime
lea rcx, str._s__d_CoInitializeEx_hr_x
call fcn.140065460
jmp 0x1400c92b1
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
cmp dword [r14 + 0x12c], 0
je 0x1400c90e0
mov r8d, 0xdb
lea rdx, str.CTimerEventNotify::WorkThreadLoop
lea rcx, [0x140119e10]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140065460
mov ecx, 0x80004005
call fcn.140005560
int3
Function at 0x1400c9520
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140029f10
test eax, eax
je 0x1400c95a8
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140065460
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c9617
jmp 0x1400c9611
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_110
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c9609
cmp dword [rsp + 0x40], 4
jne 0x1400c9609
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400c95fe
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400c9617
mov eax, 1
jmp 0x1400c9619
test rbx, rbx
je 0x1400c9617
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400c9640
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140029f10
test eax, eax
je 0x1400c96c8
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140065460
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c9737
jmp 0x1400c9731
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_20
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c9729
cmp dword [rsp + 0x40], 4
jne 0x1400c9729
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400c971e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400c9737
mov eax, 1
jmp 0x1400c9739
test rbx, rbx
je 0x1400c9737
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400ca880
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140119e10]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r8d, 0x83
call fcn.140065460
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
test rbx, rbx
jne 0x1400ca8c5
mov r8d, 0x84
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140065460
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x86
mov qword [rsp + 0x20], rax
call fcn.140065460
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ca925
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x8a
mov qword [rsp + 0x20], rax
call fcn.140065460
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400ca470
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400caba0

Function at 0x1400ca940
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140119e10]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r8d, 0x96
call fcn.140065460
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
test rbx, rbx
jne 0x1400ca985
mov r8d, 0x97
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140065460
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x99
mov qword [rsp + 0x20], rax
call fcn.140065460
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ca9e5
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x9d
mov qword [rsp + 0x20], rax
call fcn.140065460
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400ca660
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400caba0
Function at 0x1400caa00
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140119e10]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r8d, 0xa9
call fcn.140065460
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
test rbx, rbx
jne 0x1400caa45
mov r8d, 0xaa
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140065460
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xac
mov qword [rsp + 0x20], rax
call fcn.140065460
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400caaa5
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xb0
mov qword [rsp + 0x20], rax
call fcn.140065460
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400ca470
mov rdx, rbx
call fcn.1400ca660
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400caba0

Function at 0x1400caad0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140119e10]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r8d, 0xbd
call fcn.140065460
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
test rbx, rbx
jne 0x1400cab15
mov r8d, 0xbe
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140065460
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xc0
mov qword [rsp + 0x20], rax
call fcn.140065460
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400cab75
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xc4
mov qword [rsp + 0x20], rax
call fcn.140065460
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400ca470
mov rdx, rbx
call fcn.1400ca660
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400caba0
Function at 0x1400cd420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r15, qword [rsp + 0x130]
xor edx, edx
mov rbp, qword [rsp + 0x138]
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov r14, r9
lea r8d, [rdx + 0x64]
call fcn.1400daa40
lea r8, [0x1401524d8]
mov edx, 0x67
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400cd661
mov rdx, rax
mov qword [rsp + 0x118], rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
xor r8d, r8d
mov dword [rsp + 0x24], 0x204d454d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov dword [rsp + 0x3c], edi
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioOpenW]
mov r9d, 0x20
mov dword [rsp + 0xb0], 0x45564157
mov rcx, rax
lea rdx, [rsp + 0xa8]
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioDescend]
mov rcx, rbx
test eax, eax
je 0x1400cd516
xor edx, edx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioClose]
mov r8d, 0xe6
jmp 0x1400cd602
mov r9d, 0x10
mov dword [rsp + 0x90], 0x20746d66
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioDescend]
mov rcx, rbx
test eax, eax
je 0x1400cd557
xor edx, edx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioClose]
mov r8d, 0xf3
jmp 0x1400cd602
xor r8d, r8d
lea rdx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioAscend]
mov r9d, 0x10
mov dword [rsp + 0xc0], 0x61746164
lea r8, [rsp + 0xa8]
mov rcx, rbx
lea rdx, [rsp + 0xc0]
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioDescend]
mov rcx, rbx
test eax, eax
je 0x1400cd5a9
xor edx, edx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioClose]
mov r8d, 0x100
jmp 0x1400cd602
xor r8d, r8d
lea rdx, [rsp + 0xc0]
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioAscend]
mov edx, dword [rsp + 0x9c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioSeek]
mov r8d, dword [rsp + 0x94]
lea rdi, [rsi + 0x104]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioRead]
cmp dword [rsp + 0x94], eax
je 0x1400cd63e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_mm_misc_l1_1_0.dll_mmioClose]
mov r8d, 0x10c
lea rdx, str.CWasapiPlayback::open_file
lea rcx, str._s__d
call fcn.140065460
mov rbx, qword [rsp + 0x118]
xor eax, eax
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400d37a0
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rsp + 0xc4]
xor edx, edx
mov qword [r14], rdi
mov r8d, 0x114
mov dword [r15], eax
movzx ecx, word [rsi + 0x110]
div ecx
mov dword [rbp], eax
jmp 0x1400cd602
mov r8d, 0xcd
lea rdx, str.CWasapiPlayback::open_file
lea rcx, str._s__d
call fcn.140065460
mov eax, 0x80004005
jmp 0x1400cd61f