joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033460
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14003355d
call fcn.14002a380
mov rbx, rax
test rax, rax
jne 0x1400334b8
mov r8d, 0x160
lea rdx, str.CCustomizeHonor::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.14005f240
mov edx, edi
mov rcx, rbx
call fcn.1400617a0
imul rcx, rdi, 0xb0
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140033568
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e4b68]
lea rcx, [rsp + 0x38]
call fcn.140006bc0
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x140164318]
call fcn.14007f600
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003355d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3

Function at 0x140033890
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x1400338d4
call fcn.140032890
test eax, eax
je 0x140033924
call fcn.14000b690
mov rcx, rax
mov edx, 0x42d
call fcn.1400b6360
mov r8d, 0x19c
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, [0x1400e4bf0]
add rsp, 0x38
jmp fcn.14005f240
cmp edx, 0x432
jne 0x140033924
mov r8d, 0x1a2
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.14005f240
call fcn.14000b690
mov rcx, rax
mov edx, 0x432
call fcn.1400b6360
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.14007f600
add rsp, 0x38
ret

Function at 0x140037af0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0xb0]
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], eax
mov r9d, edx
lea rcx, str._s__d_bSetGlobalNN___d__current_global_NN___d
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x5d2
call fcn.14005f240
mov rax, qword [0x140164310]
lea r8, str.GlobalNN
mov r9d, ebx
lea rdx, str.Others
lea rcx, [0x140164310]
call qword [rax + 0x28]
test eax, eax
jne 0x140037b71
mov r9d, ebx
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x5d8
lea rcx, str._s__d_SetGloablNN_fail__bSetGloablNN___d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14005f240
cmp dword [rdi + 0xb0], ebx
je 0x140037b97
mov dword [rdi + 0xb0], ebx
call fcn.14000b690
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.1400b6130
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140038190
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jne 0x1400381e7
mov r8d, 0x653
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_not_support_customization_for_display_mode__return_Unknow_n
call fcn.14005f240
xor eax, eax
jmp 0x140038354
mov ebx, 0x10
mov ecx, 0x2003
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov ebp, eax
mov r9d, eax
mov r8d, 0x65b
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_slate_mode_reg___d
call fcn.14005f240
lea edi, [rbx + 0x53]
xor eax, eax
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x38], r14d
lea r9d, [rbx - 0xf]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140027bc0
test eax, eax
je 0x140038280
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14005f240
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400382d6
jmp 0x1400382d0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Orientation
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400382c8
cmp dword [rsp + 0x40], 4
jne 0x1400382c8
mov edi, dword [rsp + 0x38]
test rsi, rsi
je 0x1400382d6
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r9d, edi
mov r8d, 0x65f
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_Orientation_reg___d
call fcn.14005f240
cmp ebp, 0x63
je 0x140038336
cmp ebp, 1
je 0x140038336
lea eax, [rdi - 4]
cmp eax, 1
jbe 0x140038331
cmp edi, 3
jne 0x14003830e
lea ebx, [rdi + 2]
jmp 0x140038336
cmp edi, 2
jne 0x140038318
lea ebx, [rdi + 1]
jmp 0x140038336
cmp edi, 1
jne 0x140038322
lea ebx, [rdi + 3]
jmp 0x140038336
mov ebx, r14d
mov eax, 2
test edi, edi
cmove ebx, eax
jmp 0x140038336
mov ebx, 1
mov r9d, ebx
mov r8d, 0x684
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_dwMachineDisplayMode___d
call fcn.14005f240
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14003cea0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.14000b240
test byte [rax + 0x2dc], 0xf
je 0x14003d012
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x40], 1
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x14003d02a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r9, str.HP_CONTROL
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e4b68]
lea rcx, [rsp + 0x50]
call fcn.140006bc0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003cff6
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14003cff6
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.HP_CONTROL_DefVolumeLevelEnable
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
jne 0x14003cff6
mov r9d, dword [rsp + 0x40]
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x140164310]
mov rax, qword [0x140164310]
call qword [rax + 0x28]
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, 0x1014
lea rdx, str.CCustomizeHP::SyncHpControlDefaultVolume
lea rcx, str._s__d_bSuccess__d__dwForceRestore___d
call fcn.14005f240
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003d012
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x140040940
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
test rdx, rdx
jne 0x14004097f
mov r8d, 0x156d
lea rdx, str.CCustomizeHP::OnNamedPipeEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14005f240
cmp dword [rdx], 0x30000003
jne 0x140040a07
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140040a12
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdi, [0x1400e4fe8]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140004660
test al, al
jne 0x1400409eb
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400409d0
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400048e0
nop
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.140004520
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400bcae0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x140041080
Capabilities:
Persist via run registry key

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [r11 - 0x20], 0
lea rax, [r11 - 0x48]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x28], rax
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140041221
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbx, str.AutoLogon_Skype
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140004660
mov rdi, 0xffffffffffffffff
test al, al
jne 0x14004111b
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041100
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400048e0
nop
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140041216
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rbx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140004660
test al, al
jne 0x140041171
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041156
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400048e0
nop
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140080150
nop
mov r9, qword [rsp + 0x48]
mov r8d, 0x15f5
lea rdx, str.CCustomizeHP::CheckAutoLogonSkypeRunKey
lea rcx, str._s__d__s
call fcn.14005f240
mov rax, qword [rsp + 0x48]
cmp dword [rax - 0x10], 0
jge 0x1400411ba
mov ebx, edi
jmp 0x1400411e0
lea rdx, str.AutoLogon_Skype.cmd
mov rcx, rax
call fcn.1400c6bb0
mov rbx, rax
test rax, rax
mov rax, qword [rsp + 0x48]
jne 0x1400411da
mov ebx, edi
jmp 0x1400411e0
sub rbx, rax
sar rbx, 1
not ebx
shr ebx, 0x1f
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400411fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004fd0
nop
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x1400417f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140027bc0
test eax, eax
je 0x140041879
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14005f240
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140041901
jmp 0x1400418fb
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400418f3
cmp dword [rsp + 0x40], 4
jne 0x1400418f3
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400418cf
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140041901
mov r8d, 0x6d
lea rdx, str.CCustomizeHuawei::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.14005f240
mov eax, 1
jmp 0x140041903
test rbx, rbx
je 0x140041901
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140042590
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14004268d
call fcn.14002a380
mov rbx, rax
test rax, rax
jne 0x1400425e8
mov r8d, 0x162
lea rdx, str.CCustomizeHuawei::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.14005f240
mov edx, edi
mov rcx, rbx
call fcn.1400617a0
imul rcx, rdi, 0xb0
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140042698
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e4b68]
lea rcx, [rsp + 0x38]
call fcn.140006bc0
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x140164318]
call fcn.14007f600
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004268d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3

Function at 0x140043270
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x1400432b4
call fcn.140041b90
test eax, eax
je 0x140043304
call fcn.14000b690
mov rcx, rax
mov edx, 0x42d
call fcn.1400b6360
mov r8d, 0x2ae
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, [0x1400e4bf0]
add rsp, 0x38
jmp fcn.14005f240
cmp edx, 0x432
jne 0x140043304
mov r8d, 0x2b4
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.14005f240
call fcn.14000b690
mov rcx, rax
mov edx, 0x432
call fcn.1400b6360
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.14007f600
add rsp, 0x38
ret
Function at 0x140044490
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, edx
mov rbp, rcx
mov r9d, edx
mov r8d, 0x63
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d_dwTid_d
call fcn.14005f240
cmp ebx, 0x437
jne 0x140044749
call fcn.14000b690
mov rcx, rax
mov edx, ebx
call fcn.1400b6360
cmp dword [0x140162b44], 0
jne 0x14004476f
call fcn.14000b520
mov edx, 1
call fcn.140090880
mov qword [rbp + 0x10], rax
mov r9, rax
mov r8d, 0x6b
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d_m_pAudDev_x
call fcn.14005f240
cmp dword [0x140164cb4], 0
jne 0x1400446c1
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], rax
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140044785
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea r14, [0x1400fb9b8]
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.140004660
mov rdi, 0xffffffffffffffff
test al, al
jne 0x1400445af
mov rax, rdi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140044590
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.1400048e0
nop
mov edx, 0xea60
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x80]
call fcn.1400be070
mov ebx, dword [rsp + 0x78]
mov ecx, ebx
call fcn.1400c0f4c
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400c71e0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], rax
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x14004477a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.140004660
test al, al
jne 0x14004464f
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140044630
mov r8d, edi
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.1400048e0
nop
mov edx, 0xea60
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [rsp + 0x80]
call fcn.1400be070
test eax, eax
je 0x14004468e
mov rdx, qword [rbp + 0x10]
add rdx, 0x10
mov r9d, dword [rsp + 0x78]
mov r8, rsi
lea rcx, [0x140164b90]
call fcn.1400ba380
test rsi, rsi
je 0x14004469b
mov rcx, rsi
call fcn.1400c094c
mov r8d, 0x85
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, [0x1400e4bf0]
call fcn.14005f240
cmp dword [0x140164cb4], 0
je 0x14004476f
mov r8d, 0x8a
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, [0x1400e4bf0]
call fcn.14005f240
mov r8d, 0x54
lea rdx, str.CWasapiPlayback::Play
lea rcx, [0x1400e4bf0]
call fcn.14005f240
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x140164b90]
lea r8, [0x1400bab00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
call fcn.14000b690
mov rcx, rax
mov edx, 0x436
mov r8d, 0xea60
call fcn.1400b6130
mov dword [0x140162b44], 1
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebx, 0x436
jne 0x14004476f
mov r8d, 0x95
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.14005f240
call fcn.140044310
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x140045460
Capabilities:
Print debug messages

Disassembly:
sub dword [rcx + 0x18], 1
mov eax, dword [rcx + 0x18]
jne 0x140045474
mov rcx, qword [rcx + 0x10]
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp eax, 0x32
jle 0x140045492
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
jmp fcn.14005f240
ret
Function at 0x140047370
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x40e
jne 0x1400473f3
call fcn.14000b690
mov rcx, rax
mov edx, 0x40e
call fcn.1400b6360
cmp dword [rbx + 0x30], 0
jne 0x14004742b
mov ebx, dword [rbx + 0x38]
call fcn.14000b240
movzx ecx, word [rax + 0x342]
mov eax, 0x103c
test ebx, ebx
je 0x1400473d5
cmp cx, ax
jne 0x1400473cb
mov edx, 1
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.14003d2c0
add rsp, 0x20
pop rbx
jmp fcn.140046770
cmp cx, ax
jne 0x1400473e9
xor edx, edx
lea ecx, [rdx + 1]
add rsp, 0x20
pop rbx
jmp fcn.14003d2c0
add rsp, 0x20
pop rbx
jmp fcn.140046b90
cmp edx, 0x435
jne 0x140047439
call fcn.14000b690
mov rcx, rax
mov edx, 0x435
call fcn.1400b6360
cmp dword [rbx + 0x34], 0
je 0x140047426
call fcn.140046b90
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.1400471c0
call fcn.140046770
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.1400471c0
add rsp, 0x20
pop rbx
ret

Function at 0x14004b870
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [r8]
mov rdi, rdx
cmp rax, qword [0x1400e3938]
mov rbx, rcx
jne 0x14004b944
mov rax, qword [r8 + 8]
cmp rax, qword [0x1400e3940]
jne 0x14004b944
cmp dword [r8 + 0x10], 0
jne 0x14004b944
call fcn.14000b520
mov rdx, rdi
call fcn.140090350
mov rdi, rax
test rax, rax
jne 0x14004b8e4
mov r8d, 0x14f
lea rdx, str.CJackImpedanceDetect::OnPropertyValueChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005f240
mov eax, dword [rax + 0x1ac]
dec eax
test eax, 0xfffffffd
jne 0x14004b944
cmp dword [rbx + 0x64], 0
je 0x14004b935
mov qword [rsp + 0x30], rsi
call fcn.1400569d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x38]
cmp eax, 2
jne 0x14004b917
mov r8d, dword [rbx + 0x70]
jmp 0x14004b91a
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbx - 0x18]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14004b220
cmp dword [rbx + 0x68], 0
je 0x14004b944
lea rcx, [rbx - 0x18]
call fcn.14004b4f0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004c3c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
cmp edx, 0x20
jb 0x14004c3f7
mov r8d, 0x70
lea rdx, str.CJackRetaskCommandLineHelper::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005f240
call fcn.14002a380
lea rcx, [rax + 0x10]
call fcn.140045400
cmp dword [rdi + 0xa8], ebx
jne 0x14004c42a
call fcn.14002a380
imul rdx, rbx, 0xb0
test byte [rax + rdx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
jne 0x14004c42a
mov ebx, 1
jmp 0x14004c42c
xor ebx, ebx
call fcn.14002a380
sub dword [rax + 0x28], 1
mov ecx, dword [rax + 0x28]
jne 0x14004c446
mov rcx, qword [rax + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x14004c464
cmp ecx, 0x32
jle 0x14004c464
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.14005f240
test ebx, ebx
je 0x14004c483
call fcn.14000b690
mov rcx, rax
mov edx, 0x3f2
call fcn.1400b6360
lea rcx, [rdi - 0x10]
call fcn.14004c5b0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret