joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c81e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm6, xmm2
mov rsi, rcx
sub edx, 1
je 0x1400c8307
cmp edx, 1
jne 0x1400c833a
cvttsd2si ecx, xmm2
mov qword [rsp + 0x78], rdi
xor dil, dil
test ecx, ecx
je 0x1400c82d3
sub ecx, edx
je 0x1400c824c
sub ecx, edx
je 0x1400c8242
cmp ecx, edx
jne 0x1400c82fc
lea ebx, [rdx + 8]
jmp 0x1400c82d5
mov ebx, 4
jmp 0x1400c82d5
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 3
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rsp + 0x30], rbx
xor r8d, r8d
lea rdx, [0x140320430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400c82c9
lea rax, [rsp + 0x3c]
mov ebx, 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastOutputMode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, dword [rsp + 0x38]
test ebx, ebx
js 0x1400c82fc
jmp 0x1400c82d5
xor ebx, ebx
mov r8d, ebx
lea rdx, str.APORenderA
mov rcx, rsi
call fcn.1400c8fc0
mov r8d, ebx
lea rdx, str.APORenderB
mov rcx, rsi
movzx edi, al
call fcn.1400c8fc0
movzx eax, dil
mov rdi, qword [rsp + 0x78]
jmp 0x1400c837a
movsd xmm0, qword [0x1403a98f0]
ucomisd xmm0, xmm6
jp 0x1400c8341
jne 0x1400c8341
lea rdx, str.Skype.exe
call fcn.1400dd0d0
lea rdx, str.communicator.exe
movzx ebx, al
call fcn.1400dd0d0
test bl, bl
jne 0x1400c833e
test al, al
jne 0x1400c833e
xor al, al
jmp 0x1400c837a
movaps xmm2, xmm6
lea rdx, str.APORenderA
call fcn.1400c83a0
movaps xmm2, xmm6
lea rdx, str.APORenderB
call fcn.1400c83a0
movaps xmm2, xmm6
lea rdx, str.APOMVCaptureA
call fcn.1400c83a0
movaps xmm2, xmm6
lea rdx, str.APOMVCaptureB
call fcn.1400c83a0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rsi
ret
Function at 0x1400cbd20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp + 0x400], rax
movaps xmm0, xmmword [0x140320430]
mov rbx, rcx
movaps xmm1, xmmword [0x140320440]
lea rcx, [rbp + 0x2e]
mov eax, dword [0x140320478]
xor edx, edx
movaps xmmword [rbp - 0x20], xmm0
mov r8d, 0x1ba
movaps xmm0, xmmword [0x140320450]
movaps xmmword [rbp], xmm0
movsd xmm0, qword [0x140320470]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x140320460]
mov dword [rbp + 0x28], eax
movzx eax, word [0x14032047c]
movsd qword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm1
mov word [rbp + 0x2c], ax
call fcn.140222790
lea rax, [rbp - 0x40]
mov dword [rbp - 0x38], 5
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x40], 0
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400cbe19
lea rax, [rbp - 0x34]
mov dword [rbp - 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x38]
xor r8d, r8d
lea rdx, str.SerialPortID
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x208
call fcn.140222790
mov eax, dword [rbp - 0x38]
lea r9, str.NuvotonHiFi3
mov dword [rsp + 0x28], eax
lea r8, str._s__s_d
lea rax, [0x140345278]
mov edx, 0x104
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call fcn.140063040
lea rax, [rsp + 0x38]
mov r8d, 3
lea rdx, [rbp + 0x1f0]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.1400429f0
mov rcx, qword [rsp + 0x30]
lea r8, [0x14032847b]
xor edx, edx
call fcn.1400912e0
mov rcx, qword [rsp + 0x30]
mov qword [rbx + 0x140840], rax
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x1400cbeae
call fcn.1402384fc
cmp qword [rbx + 0x140840], 0
setne al
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0x528]
add rsp, 0x510
pop rbp
ret
Function at 0x1400cd650
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor bl, bl
mov edi, r8d
mov rsi, rdx
test rdx, rdx
je 0x1400cd77c
test r8d, r8d
js 0x1400cd77c
xor r8d, r8d
mov dword [rsp + 0x58], 0xffffffff
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140093870
cmp edi, dword [rsp + 0x58]
je 0x1400cd6bf
mov r8d, 0xffffffff
mov edx, edi
mov rcx, rsi
call fcn.1400935c0
movzx ebx, al
cmp edi, 3
je 0x1400cd6d0
lea ecx, [rdi - 0x14]
cmp ecx, 0x4f
ja 0x1400cd77c
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x64]
call fcn.140222790
mov r8d, 0x3e9
lea rdx, [0x140329a08]
lea rcx, [rsp + 0x70]
call fcn.1400cd7b0
xor ecx, ecx
mov dword [rsp + 0x60], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
lea rdx, [0x140320430]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400cd77c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400d64c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdx, [0x140320430]
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d654b
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.TrackingMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret

Function at 0x1400d6770
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
lea rdx, [0x140320430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d6801
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.JackSenseActive_App
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret
Function at 0x1400d6820
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [r11 - 0x28]
movzx edi, dl
mov qword [r11 - 0x48], rax
lea rdx, [0x140320430]
xor r14d, r14d
mov dword [rsp + 0x58], edi
lea rax, [r11 - 0x38]
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x50], rax
mov rbp, rcx
mov qword [r11 - 0x58], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [r11 - 0x68], r14d
mov esi, 0x80004005
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400d68cf
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [r14 + 4]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.WavesNxAppState
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov esi, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rax, str.CWavesNxClient::SetNxAppRunningState____bResult_d
test esi, esi
mov r9d, 3
lea r8, [0x1404675c0]
sete bl
mov edx, 0x480
movzx ecx, bl
mov dword [rsp + 0x30], ecx
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedwavesnxclient.cpp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.140039f30
test esi, esi
jne 0x1400d6929
mov rcx, qword [rbp + 0x140898]
test rcx, rcx
je 0x1400d6929
xor dil, 1
movzx edx, dil
call fcn.1400ded90
jmp 0x1400d692c
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400d94d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
call fcn.1400d92d0
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0
lea rdx, [0x140320430]
mov qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d9577
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rdx, qword [rsp + 0x40]
mov eax, 0xffffffff
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d959f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140202880
add rsp, 0x60
pop rbx
ret
Function at 0x1400f6790
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
mov qword [rsp + 0x90], rdi
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
call fcn.14006c1e0
lea rax, [rbp - 0x50]
xor edi, edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x50], rdi
lea rdx, [0x140320430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400f68b5
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x38], edi
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.SoloModeEnabledState
mov dword [rbp - 0x3c], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x50]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp ebx, 2
je 0x1400f68b5
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x48], rdi
lea rdx, [0x140320430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400f68b0
lea rax, [rbp - 0x34]
mov dword [rbp - 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.SoloModeEnabledState
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, dword [rbp - 0x40]
jmp 0x1400f68d4
mov rcx, qword [rbp - 0x18]
mov rax, rcx
shr rax, 0x27
test al, 1
je 0x1400f68cb
mov ebx, 1
jmp 0x1400f68d4
shr rcx, 0x33
mov ebx, 3
mov rdx, qword [rbp - 0x10]
lea rax, vtable.CMaxxAudioOptions.0
mov qword [rbp - 0x28], rax
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
mov rdi, qword [rsp + 0x90]
sub ecx, 1
jg 0x1400f690e
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140202880
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x1400ff650
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ff6db
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.LastOsVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret

Function at 0x1400ff700
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
mov dword [rsp + 0x38], eax
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ff78b
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.LastOsUBRVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140202880
add rsp, 0x58
ret
Function at 0x140101c10
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rcx
movdqa xmm0, xmmword [0x1403a9ab0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 7
lea rdx, str.MicGain
lea rcx, [r11 - 0x40]
call fcn.14005e050
mov rdi, qword [rbp + 0x108]
mov rbx, qword [rdi + 8]
mov rsi, rdi
cmp byte [rbx + 0x19], 0
jne 0x140101ca5
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x68]
call fcn.140096e20
test al, al
je 0x140101c99
mov rbx, qword [rbx + 0x10]
jmp 0x140101c9f
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140101c81
cmp rdi, rsi
je 0x140101cbc
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140096e20
test al, al
je 0x140101cbf
mov rdi, rsi
lea rcx, [rsp + 0x68]
call fcn.140046190
cmp rdi, qword [rbp + 0x108]
je 0x140101dd2
lea rdx, [rdi + 0x40]
cmp qword [rdx + 0x10], 0
je 0x140101dd2
lea rcx, [rsp + 0x68]
call fcn.140045fb0
nop
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call fcn.14024719c
imul edi, eax, 0x64
mov dword [rsp + 0x60], edi
mov ebx, 0x80004005
xor ecx, ecx
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSpeech_OneCoreAudioInputMicWiz
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140101d9d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DefaultDefaultMicGain
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
sete bl
lea rcx, [rbp + 0xb0]
mov dword [rsp + 0x20], edi
lea r9, str.Write_registry:_MicGain___d
movzx r8d, bl
mov edx, 1
call fcn.14011e570
nop
lea rcx, [rsp + 0x68]
call fcn.140046190
movzx eax, bl
jmp 0x140101dd4
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140118310
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [rcx]
lea r9, str.CCapxEndpointRegistration::GetFile_n
xor r8d, r8d
xor edx, edx
mov rax, qword [rax]
call qword [case.0x14004487d.0]
mov rcx, qword [rbx + 0x18]
cmp dword [rcx - 0x10], 0
je 0x1401183d6
test rcx, rcx
je 0x1401183d6
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jae 0x1401183d6
mov rdx, qword [rbx + 0x18]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x14011846f
cmp dword [rdi + 0x10], 0
jl 0x1401183c5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1401183c5
call fcn.14003c400
mov rbp, rax
mov ebx, 0xffffffff
lock xadd dword [rdi + 0x10], ebx
sub ebx, 1
jg 0x1401183b9
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
lea rax, [rbp + 0x18]
mov qword [rsi], rax
jmp 0x14011846f
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.14003beb0
jmp 0x14011846f
lea rcx, [r14 + 0x10]
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0x60]
call fcn.140120350
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
mov ebx, 0xffffffff
cmp rcx, rdi
je 0x14011844c
cmp dword [rdi + 0x10], 0
jl 0x14011843f
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14011843f
call fcn.14003c400
mov rbp, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140118436
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
lea rax, [rbp + 0x18]
mov qword [rsi], rax
jmp 0x14011844c
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.14003beb0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14011846f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov rax, qword [r14]
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rcx
lea r9, str.CCapxEndpointRegistration::GetFile_____s_n
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x14004487d.0]
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
je 0x1401184b1
test rcx, rcx
je 0x1401184b1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jae 0x1401184b1
mov al, 1
jmp 0x1401184b3
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14011f080
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, rdx
mov rax, qword [rdx]
mov r14d, dword [rax - 0x10]
mov edi, r14d
xor r13d, r13d
test r14d, r14d
cmovns edi, r13d
lea r12, [0x140334e88]
mov rbp, 0xffffffffffffffff
mov rbx, rbp
nop
inc rbx
cmp word [r12 + rbx*2], r13w
jne 0x14011f0d0
mov r15d, r14d
test ebx, ebx
jle 0x14011f160
add r14d, ebx
js 0x14011f290
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14011f107
mov edx, r14d
mov rcx, rsi
call fcn.14003b630
mov r9, qword [rsi]
sub r15d, edi
inc r15d
movsxd rdx, r15d
add rdx, rdx
movsxd rax, edi
lea rdi, [r9 + rax*2]
movsxd rbx, ebx
add rax, rbx
lea rcx, [r9 + rax*2]
mov r9, rdx
mov r8, rdi
call fcn.140056b80
lea rdx, [rbx + rbx]
mov r9, rdx
mov r8, r12
mov rcx, rdi
call fcn.140056af0
mov rax, qword [rsi]
cmp r14d, dword [rax - 0xc]
jg 0x14011f285
mov dword [rax - 0x10], r14d
movsxd rcx, r14d
mov rax, qword [rsi]
mov word [rax + rcx*2], r13w
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011f24a
test al, 0x10
jne 0x14011f24a
test al, 1
je 0x14011f18c
and eax, 0xfffffffe
mov edx, eax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x14011f1a0
mov edi, r13d
jmp 0x14011f1a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsi]
cmp dword [rcx - 8], 1
jle 0x14011f1bc
mov edx, dword [rcx - 0x10]
mov rcx, rsi
call fcn.14003b6e0
mov rcx, qword [rsi]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rcx
lea rax, str.CCoInstallerCapabilities::DeleteOrMoveFile____DeleteFile__s_file__return_code___d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 2
lea r8, [0x1404675c0]
lea edx, [r9 + 0x73]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedintelopenvinocoinstaller.cpp
call fcn.140039f30
test ebx, ebx
jne 0x14011f221
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.14003c400
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x90]
call fcn.14011f2a0
test ebx, ebx
setne bl
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14011f245
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
movzx eax, bl
jmp 0x14011f26d
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14011f26b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
int3