joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003abd0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
jne 0x14003abfa
lea r8d, [rdx + 0x4a]
lea rdx, str.CControlChangeEventNotify::OnAddDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140075db0
lea rcx, [rdx + 0xd0]
call fcn.1400195c0
mov r8, rax
test rax, rax
je case.default.0x14003ac2a
cmp dword [rax + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 0
jne case.default.0x14003ac2a
mov rcx, qword [rax]
lea rdx, [rbx - 8]
mov rax, qword [rcx + 0x38]
mov rcx, r8
add rsp, 0x20
pop rbx
jmp qword [case.0x14005eeb3.0]
add rsp, 0x20
pop rbx
ret

Function at 0x14003ac40
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
jne 0x14003ac6a
lea r8d, [rdx + 0x59]
lea rdx, str.CControlChangeEventNotify::OnRemoveDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140075db0
cmp qword [rdx + 0x118], 0
je 0x14003aca2
lea rcx, [rdx + 0xd0]
call fcn.1400195c0
mov r8, rax
test rax, rax
je 0x14003aca2
mov rcx, qword [rax]
lea rdx, [rbx - 8]
mov rax, qword [rcx + 0x40]
mov rcx, r8
add rsp, 0x20
pop rbx
jmp qword [case.0x14005eeb3.0]
add rsp, 0x20
pop rbx
ret

Function at 0x14003b620
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rsi, rcx
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x14003b684
cmp dword [0x1401b2668], 0
je 0x14003b684
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x14003b66b
cmp dword [0x1401b266c], 0
je 0x14003b684
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x14003b6da
mov qword [rsp + 0x20], rdi
nop word [rax + rax]
call fcn.140014660
call fcn.140014660
mov rdi, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rdi, rdi
je 0x14003b6d0
mov rcx, rdi
call fcn.140020820
test eax, eax
jne 0x14003b6d0
lea rcx, [rsi - 8]
mov r8, rdi
xor edx, edx
call fcn.14003ed40
test rbx, rbx
jne 0x14003b6a0
mov rdi, qword [rsp + 0x20]
call fcn.140014660
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
sub dword [rax + 0x140], 1
mov ecx, dword [rax + 0x140]
jne 0x14003b70a
mov rcx, qword [rax + 0x150]
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp ecx, 0x32
jle 0x14003b72c
mov r8d, 0x8b
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
add rsp, 0x28
jmp fcn.140075db0
add rsp, 0x28
ret
Function at 0x140043c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
test rdx, rdx
jne 0x140043c89
mov r8d, 0x417
lea rdx, str.CCustomizeASUS::GetGlobalNN
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.140075db0
xor eax, eax
jmp 0x140043dea
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x30], r14d
mov ebx, 1
mov r9d, ebx
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x140043cfd
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140043da5
jmp 0x140043d9f
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.GlobalNN
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140043d97
cmp dword [rsp + 0x38], 4
jne 0x140043d97
mov ebp, dword [rsp + 0x30]
test rdi, rdi
je 0x140043d53
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rsp + 0x20], ebx
mov r9d, ebp
mov r8d, 0x41c
lea rdx, str.CCustomizeASUS::GetGlobalNN
lea rcx, str._s__d_get_GlobalNN_from_registry___d___bSuccess___d_
call fcn.140075db0
cmp ebp, 1
jne 0x140043d7c
mov dword [rsi], ebx
jmp 0x140043de8
test ebp, ebp
jne 0x140043d85
mov dword [rsi], r14d
jmp 0x140043de8
mov r9d, ebp
mov r8d, 0x42b
lea rcx, str._s__d_get_GlobalNN_from_registry_error_____d_
jmp 0x140043dd9
test rdi, rdi
je 0x140043da5
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rsp + 0x20], r14d
mov r9d, 0x63
mov r8d, 0x41c
lea rdx, str.CCustomizeASUS::GetGlobalNN
lea rcx, str._s__d_get_GlobalNN_from_registry___d___bSuccess___d_
call fcn.140075db0
xor r9d, r9d
mov r8d, 0x431
lea rcx, str._s__d_get_GlobalNN_via_GetRegUI4Property_fail_____d_
lea rdx, str.CCustomizeASUS::GetGlobalNN
call fcn.140075db0
mov ebx, r14d
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140045000
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x140045086
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004510e
jmp 0x140045108
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140045100
cmp dword [rsp + 0x38], 4
jne 0x140045100
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x1400450dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x14004510e
mov r8d, 0x63
lea rdx, str.CCustomizeHonor::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.140075db0
mov eax, 1
jmp 0x140045110
test rbx, rbx
je 0x14004510e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140046430
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14004653b
call fcn.14003a6b0
mov rbx, rax
test rax, rax
jne 0x14004647e
mov r8d, 0x16f
lea rdx, str.CCustomizeHonor::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140075db0
lfence
mov edx, edi
mov rcx, rbx
call fcn.1400786b0
imul rcx, rdi, 0xb0
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x140046546
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x38]
call fcn.14000ec90
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004653b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3

Function at 0x1400468a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x1400468e4
call fcn.140045530
test eax, eax
je 0x140046934
call fcn.1400147e0
mov rcx, rax
mov edx, 0x42d
call fcn.1400e8940
mov r8d, 0x1ab
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, [0x14011bca8]
add rsp, 0x38
jmp fcn.140075db0
cmp edx, 0x432
jne 0x140046934
mov r8d, 0x1b1
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.140075db0
call fcn.1400147e0
mov rcx, rax
mov edx, 0x432
call fcn.1400e8940
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.1400986f0
add rsp, 0x38
ret

Function at 0x14004bd00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0xb0]
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], eax
mov r9d, edx
lea rcx, str._s__d_bSetGlobalNN___d__current_global_NN___d
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x611
call fcn.140075db0
mov rax, qword [0x1401aa490]
lea r8, str.GlobalNN
mov r9d, ebx
lea rdx, str.Others
lea rcx, [0x1401aa490]
mov rax, qword [rax + 0x28]
call qword [case.0x14005eeb3.0]
test eax, eax
jne 0x14004bd88
mov r9d, ebx
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x617
lea rcx, str._s__d_SetGloablNN_fail__bSetGloablNN___d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
cmp dword [rdi + 0xb0], ebx
je 0x14004bdae
mov dword [rdi + 0xb0], ebx
call fcn.1400147e0
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.1400e8700
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14004c520
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0xf0]
call qword [case.0x14005eeb3.0]
test eax, eax
jne 0x14004c575
mov r8d, 0x69a
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_not_support_customization_for_display_mode__return_Unknow_n
call fcn.140075db0
xor eax, eax
jmp 0x14004c6e3
mov ebx, 0x10
mov ecx, 0x2003
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov ebp, eax
mov r9d, eax
mov r8d, 0x6a2
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_slate_mode_reg___d
call fcn.140075db0
lea edi, [rbx + 0x53]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x30], r14d
lea r9d, [rbx - 0xf]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x14004c60f
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004c665
jmp 0x14004c65f
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Orientation
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14004c657
cmp dword [rsp + 0x38], 4
jne 0x14004c657
mov edi, dword [rsp + 0x30]
test rsi, rsi
je 0x14004c665
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r9d, edi
mov r8d, 0x6a6
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_Orientation_reg___d
call fcn.140075db0
cmp ebp, 0x63
je 0x14004c6c5
cmp ebp, 1
je 0x14004c6c5
lea eax, [rdi - 4]
cmp eax, 1
jbe 0x14004c6c0
cmp edi, 3
jne 0x14004c69d
lea ebx, [rdi + 2]
jmp 0x14004c6c5
cmp edi, 2
jne 0x14004c6a7
lea ebx, [rdi + 1]
jmp 0x14004c6c5
cmp edi, 1
jne 0x14004c6b1
lea ebx, [rdi + 3]
jmp 0x14004c6c5
mov ebx, r14d
mov eax, 2
test edi, edi
cmove ebx, eax
jmp 0x14004c6c5
mov ebx, 1
mov r9d, ebx
mov r8d, 0x6cb
lea rdx, str.CCustomizeHP::GetMachineDisplayMode
lea rcx, str._s__d_dwMachineDisplayMode___d
call fcn.140075db0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140052860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140014310
test byte [rax + 0x2dc], 0xf
je 0x1400529e0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 1
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400529f8
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea r9, str.HP_CONTROL
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x48]
call fcn.14000ec90
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400529ba
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400529ba
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.HP_CONTROL_DefVolumeLevelEnable
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
jne 0x1400529ba
mov rax, qword [0x1401aa490]
mov r9d, dword [rsp + 0x38]
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x1401aa490]
mov rax, qword [rax + 0x28]
call qword [case.0x14005eeb3.0]
mov ecx, dword [rsp + 0x38]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, 0x107c
lea rdx, str.CCustomizeHP::SyncHpControlDefaultVolume
lea rcx, str._s__d_bSuccess__d__dwForceRestore___d
call fcn.140075db0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400529e0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3
Function at 0x1400570e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x140057115
mov r8d, 0x1630
lea rdx, str.CCustomizeHP::OnNamedPipeEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140075db0
cmp dword [rdx], 0x30000003
jne 0x1400571a7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400571b2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdi, [0x14011c160]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14000c4c0
test al, al
jne 0x14005718b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140057170
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14000c750
nop
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.14000c3f0
nop
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1400efc20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3
Function at 0x140057800
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x38], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400579b5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbx, str.AutoLogon_Skype
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c4c0
mov rdi, 0xffffffffffffffff
test al, al
jne 0x14005789b
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140057880
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c750
nop
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400579aa
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rbx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c4c0
test al, al
jne 0x1400578fb
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400578e0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c750
nop
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140099200
nop
mov r9, qword [rsp + 0x40]
mov r8d, 0x16c1
lea rdx, str.CCustomizeHP::CheckAutoLogonSkypeRunKey
lea rcx, str._s__d__s
call fcn.140075db0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jge 0x140057944
mov ebx, edi
jmp 0x14005796a
lea rdx, str.AutoLogon_Skype.cmd
mov rcx, rax
call fcn.1400fa604
mov rbx, rax
test rax, rax
mov rax, qword [rsp + 0x40]
jne 0x140057964
mov ebx, edi
jmp 0x14005796a
sub rbx, rax
sar rbx, 1
not ebx
shr ebx, 0x1f
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140057990
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
int3
Function at 0x1400584b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x140058536
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400585be
jmp 0x1400585b8
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400585b0
cmp dword [rsp + 0x38], 4
jne 0x1400585b0
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x14005858c
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400585be
mov r8d, 0x74
lea rdx, str.CCustomizeHuawei::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.140075db0
mov eax, 1
jmp 0x1400585c0
test rbx, rbx
je 0x1400585be
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140059570
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14005967b
call fcn.14003a6b0
mov rbx, rax
test rax, rax
jne 0x1400595be
mov r8d, 0x169
lea rdx, str.CCustomizeHuawei::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140075db0
lfence
mov edx, edi
mov rcx, rbx
call fcn.1400786b0
imul rcx, rdi, 0xb0
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x140059686
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x38]
call fcn.14000ec90
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005967b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ce90
int3

Function at 0x14005a390
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x14005a3d4
call fcn.1400589a0
test eax, eax
je 0x14005a424
call fcn.1400147e0
mov rcx, rax
mov edx, 0x42d
call fcn.1400e8940
mov r8d, 0x2ce
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, [0x14011bca8]
add rsp, 0x38
jmp fcn.140075db0
cmp edx, 0x432
jne 0x14005a424
mov r8d, 0x2d4
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.140075db0
call fcn.1400147e0
mov rcx, rax
mov edx, 0x432
call fcn.1400e8940
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.1400986f0
add rsp, 0x38
ret
Function at 0x14005a990
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x24], 0
mov rdi, rdx
mov rbx, rcx
je 0x14005ab01
cmp dword [0x1401aa4a0], 0
je 0x14005ab01
mov r8d, 0x97
mov qword [rsp + 0x30], rbp
lea rdx, str.CCustomizeLenovo::OnEndpointVolumeChanged
lea rcx, [0x14011bca8]
call fcn.140075db0
call fcn.14005b590
lea rdx, str.CCustomizeLenovo::OnEndpointVolumeChanged
mov rbp, rax
test rax, rax
jne 0x14005aa0a
mov r8d, 0x9c
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140075db0
mov r9, qword [rax + 0x170]
lea rcx, str._s__d_Rtk_Int_Speaker_Endpoint_Id___s
mov r8d, 0x9e
mov qword [rsp + 0x38], rsi
call fcn.140075db0
test rdi, rdi
jne 0x14005aa31
xor eax, eax
jmp 0x14005aa4a
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14005aa40
mov r8d, eax
lea rcx, [rbx + 0x10]
mov rdx, rdi
call fcn.14000c750
mov rdx, qword [rbp + 0x170]
test rdx, rdx
je 0x14005aaf7
mov rcx, qword [rbx + 0x10]
cmp dword [rcx - 0x10], 0
jl 0x14005aaf7
call fcn.1400fa604
test rax, rax
je 0x14005aaf7
sub rax, qword [rbx + 0x10]
sar rax, 1
test eax, eax
js 0x14005aaf7
cmp dword [rbx + 0x18], 0
mov dword [rbx + 0x1c], 0x32
jne 0x14005aaf7
mov r8d, 0xa6
lea rdx, str.CCustomizeLenovo::OnEndpointVolumeChanged
lea rcx, [0x14011bca8]
call fcn.140075db0
mov r9d, dword [rbx + 0x1c]
lea rdx, str.CCustomizeLenovo::OnEndpointVolumeChanged
mov r8d, 0xa7
lea rcx, str._s__d_m_dwWaitTimerToChangeVolumeCnt___d
call fcn.140075db0
lea rcx, [rbx - 0x20]
call fcn.14005b980
mov dword [rbx + 0x18], 1
call fcn.1400147e0
mov rcx, rax
mov edx, 0x460
mov r8d, SafeArrayUnaccessData
call fcn.1400e8700
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret