joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e0e0
Capabilities:
Persist via run registry key

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [r11 - 0x20], 0
lea rax, [r11 - 0x48]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x28], rax
call fcn.140004f00
mov rcx, rax
test rax, rax
je 0x14007e28b
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbx, str.RtkAudUService
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400046a0
mov rdi, 0xffffffffffffffff
test al, al
jne 0x14007e17b
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14007e160
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140004940
nop
call fcn.140004f00
mov rcx, rax
test rax, rax
je 0x14007e280
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rbx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400046a0
test al, al
jne 0x14007e1d1
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14007e1b6
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140004940
nop
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14007c740
nop
mov r9, qword [rsp + 0x48]
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
lea rdx, str.CRegKeyMgr::CheckRtkAudUServiceRunKey
lea rcx, str._s__d__s
call fcn.14005be10
call fcn.1400065e0
mov rdx, rax
test rax, rax
mov rax, qword [rsp + 0x48]
jne 0x14007e221
mov ebx, edi
jmp 0x14007e24a
cmp dword [rax - 0x10], 0
jge 0x14007e22b
mov ebx, edi
jmp 0x14007e24a
mov rcx, rax
call fcn.1400bf970
mov rbx, rax
test rax, rax
mov rax, qword [rsp + 0x48]
jne 0x14007e244
mov ebx, edi
jmp 0x14007e24a
sub rbx, rax
sar rbx, 1
not ebx
shr ebx, 0x1f
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14007e266
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b96d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.140005030
nop
mov ecx, 0x80004005
call fcn.140005030
int3
Function at 0x14007f2c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14007f2f8
mov r8d, 0x16a
lea rdx, str.CRegPKeyReWriter::OnRemoveDevice
lea rcx, str._s__d_RETURN_ON_FALSE
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005be10
mov ecx, dword [rdx + 0x1ac]
mov qword [rsp + 0x30], rbx
lea eax, [rcx - 1]
test eax, 0xfffffffd
je 0x14007f37f
cmp ecx, 4
jne 0x14007f371
mov rbx, qword [rdx + 0x158]
call fcn.140006a80
mov rcx, rax
mov r8, rbx
mov rdx, 0xffffffff80000002
call fcn.14008dd90
test rax, rax
je 0x14007f342
lea rcx, [rax + 0x20]
lea rdx, [rsi - 8]
call fcn.14000b590
call fcn.14000b1e0
test dword [rax + reloc.OLEAUT32.dll_LPSAFEARRAY_UserUnmarshal], 0x100
jne 0x14007f368
call fcn.14000b1e0
test dword [rax + 0x128], 0x20000
je 0x14007f3f0
mov rbx, qword [rdi + 0x130]
jmp 0x14007f3c7
cmp ecx, 5
jne 0x14007f3f0
mov rbx, qword [rdx + 0x130]
jmp 0x14007f3c7
mov rbx, qword [rdx + 0x130]
call fcn.140006a80
mov rcx, rax
mov r8, rbx
mov rdx, 0xffffffff80000002
call fcn.14008dd90
test rax, rax
je 0x14007f3af
lea rcx, [rax + 0x20]
lea rdx, [rsi - 8]
call fcn.14000b590
call fcn.14000b1e0
test dword [rax + 0x1fc], 0x10000000
je 0x14007f3f0
mov rbx, qword [rdi + 0x158]
call fcn.140006a80
mov r8, rbx
mov rdx, 0xffffffff80000002
mov rcx, rax
call fcn.14008dd90
test rax, rax
je 0x14007f3f0
lea rdx, [rsi - 8]
lea rcx, [rax + 0x20]
call fcn.14000b590
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140080bc0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x140080bec
mov r8d, 0xa5
lea rdx, str.CRtkAudioDriverHelper::OnStateChangedDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.14005be10
cmp dword [0x140157e50], 0
je 0x140080c67
cmp dword [rdx + 0x170], 0
je 0x140080c67
cmp r8d, 1
jne 0x140080c67
mov r8d, 0xa8
lea rdx, str.CRtkAudioDriverHelper::OnStateChangedDevice
lea rcx, [0x1400ddaf0]
call fcn.14005be10
lea rcx, [rbx + 0x10]
mov dword [rsp + 0x38], 0
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [0x1400dc6d8]
call fcn.1400031c0
test eax, eax
jne 0x140080c67
mov r8d, 0xab
lea rdx, str.CRtkAudioDriverHelper::OnStateChangedDevice
lea rcx, [0x1400ddaf0]
call fcn.14005be10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140080ff0
add rsp, 0x20
pop rbx
ret
Function at 0x140080c80
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14000b4c0
mov rcx, rax
call fcn.14008a6f0
call fcn.14000b4c0
cmp dword [rax + 0x140], 0
jne 0x140080cd9
cmp dword [0x140156cb4], 0
je 0x140080cd9
cmp dword [0x140156cbc], 0
jne 0x140080cc0
mov rax, qword [0x140150140]
test byte [rax + 0x1c], 1
je 0x140080cd9
mov r8d, 0x3e
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.14005be10
call fcn.14000b4c0
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x140080d15
nop word [rax + rax]
call fcn.14000b4c0
call fcn.14000b4c0
test rbx, rbx
je 0x140080d65
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140080d10
call fcn.140080ff0
test rbx, rbx
jne 0x140080cf0
call fcn.14000b4c0
sub dword [rax + 0x140], 1
mov ecx, dword [rax + 0x140]
jne 0x140080d3c
mov rcx, qword [rax + 0x150]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp ecx, 0x32
jle 0x140080d5f
mov r8d, 0x80
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
add rsp, 0x20
pop rbx
jmp fcn.14005be10
add rsp, 0x20
pop rbx
ret
mov ecx, 0x80004005
call fcn.140005030
int3

Function at 0x140081710
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
test rdx, rdx
jne 0x140081748
mov r8d, 0x1c1
lea rdx, str.CRtkAudioDriverHelper::OnEndpointVolumeChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005be10
test rbx, rbx
jne 0x140081755
mov r8d, 0x1c2
jmp 0x14008172b
call fcn.14000b1e0
test byte [rax + 0xc8], 0x10
je 0x14008179b
call fcn.14000b4c0
mov rdx, rdi
call fcn.14008c260
test rax, rax
je 0x14008179b
cmp dword [rax + 0x170], 0
je 0x14008179b
cmp dword [rax + 0x178], 0
jne 0x14008179b
cmp dword [rax + 0x174], 0
jne 0x14008179b
mov edx, dword [rbx + 0x10]
mov rcx, rax
call fcn.140081580
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400817b0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x30], rcx
add rcx, 0x18
call fcn.140085150
nop
lea rax, vtable.CRtkAudioDriverHelperForNormalUser.0
mov qword [rbx], rax
lea rax, vtable.CRtkAudioDriverHelperForNormalUser.2.0
mov qword [rbx + 8], rax
lea rax, vtable.CRtkAudioDriverHelperForNormalUser.1.0
mov qword [rbx + 0x10], rax
xor ebp, ebp
mov dword [rbx + 0x20], ebp
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x38], rbp
mov dword [rbx + 0x40], ebp
call fcn.14000b1e0
movzx ecx, byte [rax + 0x12f]
and ecx, 1
mov dword [rbx + 0x20], ecx
call fcn.14000b1e0
test dword [rax + 0x1a4], 0x400
je 0x14008187e
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetSystemPowerStatus]
mov r8d, ebp
cmp byte [rsp + 0x40], bpl
setne r8b
mov dword [rbx + 0x40], r8d
lea rdx, str.CRtkAudioDriverHelperForNormalUser::CRtkAudioDriverHelperForNormalUser
lea rcx, str._s_PowerState_d
call fcn.14005be10
call fcn.140014060
lea rcx, [rax + 0x20]
mov rdx, rbx
call fcn.140006b40
cmp dword [rbx + 0x20], ebp
je 0x1400818ac
call fcn.140082080
call fcn.14000b630
lea rcx, [rax + 0x28]
lea rdx, [rbx + 0x10]
call fcn.140006b40
call fcn.14000b4c0
lea rcx, [rax + 0x10]
lea rdx, [rbx + 8]
call fcn.140006b40
mov qword [rbx + 0x30], rbp
call fcn.14000b1e0
test byte [rax + 0x1c0], 4
je 0x1400818df
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x140081ec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x50], rax
call fcn.14000b1e0
test byte [rax + 0xb8], 1
jne 0x14008190c
call fcn.14000b1e0
test byte [rax + 0xb8], 8
jne 0x14008190c
call fcn.14000b1e0
test dword [rax + 0x1f4], 0x1000
je 0x140081939
mov ecx, 0x20
call fcn.1400b9d04
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rcx, rax
call fcn.1400ac390
nop
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b96d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140081960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, r8d
mov rsi, rcx
call fcn.14000b1e0
cmp ebx, 0x2c
jne 0x140081a6b
cmp dword [0x140158850], 0
movups xmm0, xmmword [str._alsC]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x40], 0
movaps xmmword [rsp + 0x30], xmm0
jle 0x1400819ce
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
xor r8d, r8d
lea edx, [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140087360
jmp 0x1400819f3
xor r9d, r9d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
xor ecx, ecx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x38]
call fcn.1400872a0
mov ebx, dword [rsi + 0x40]
lea rdx, str.CRtkAudioDriverHelperForNormalUser::IsACPowerStateChanged
xor edi, edi
lea rcx, str._s_PowerStateChange_d_SysPowerState_d_DrvAcPowerState_d
cmp dword [rsp + 0x40], edi
mov r9d, ebx
sete dil
xor r8d, r8d
cmp ebx, edi
mov dword [rsp + 0x20], edi
setne r8b
call fcn.14005be10
cmp ebx, edi
mov dword [rsi + 0x40], edi
mov rdi, qword [rsp + 0x68]
je 0x140081a6b
call fcn.14000b4c0
mov edx, 1
call fcn.14008c790
mov r9, rsi
mov qword [rsp + 0x28], 0
lea r8, [0x140081a90]
mov qword [rsi + 0x38], rax
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rsi + 0x48], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b96d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
Function at 0x14008a770
Capabilities:
Print debug messages

Disassembly:
sub dword [rcx + 0x140], 1
mov eax, dword [rcx + 0x140]
jne 0x14008a78d
mov rcx, qword [rcx + 0x150]
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp eax, 0x32
jle 0x14008a7ab
mov r8d, 0x80
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
jmp fcn.14005be10
ret
Function at 0x14008a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
cmp edx, 0x3f5
jne 0x14008a86d
call fcn.14000b630
mov rcx, rax
mov edx, 0x3f5
call fcn.1400aeae0
lea rsi, [rbx + 0xa0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea r14, [rbx + 0x108]
mov rbx, qword [r14]
test rbx, rbx
je 0x14008a857
mov rdi, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rdi, rdi
je 0x14008a852
mov r9, qword [rdi + 0x10]
mov r8d, 0xaa
lea rdx, str.CMMPlatform::OnTimer
lea rcx, str._s__d_delete_AudDev_sEndPointId_s
call fcn.14005be10
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
test rbx, rbx
jne 0x14008a81c
mov rcx, r14
call fcn.14000c270
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
jmp 0x14008a9d3
cmp edx, 0x441
jne 0x14008a9d3
mov r8d, 0xb9
lea rdx, str.CMMPlatform::OnTimer
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__weak_up_from_s0i3
call fcn.14005be10
xor r9d, r9d
lea r8, str.s0i3
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.14007bbf0
mov esi, 0x63
xor eax, eax
mov qword [rsp + 0x50], rax
xor edi, edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x38], edi
lea r9d, [rsi - 0x62]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140026e10
test eax, eax
je 0x14008a919
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14005be10
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008a984
jmp 0x14008a97e
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.s0i3
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008a976
cmp dword [rsp + 0x40], 4
jne 0x14008a976
mov esi, dword [rsp + 0x38]
test rbx, rbx
je 0x14008a96f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, 1
jmp 0x14008a984
test rbx, rbx
je 0x14008a984
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rsp + 0x20], edi
mov r9d, esi
mov r8d, 0xbe
lea rdx, str.CMMPlatform::OnTimer
lea rcx, str._s__d_s0i3_d__bSuccess_d
call fcn.14005be10
test esi, esi
jne 0x14008a9d3
mov r8d, 0xc2
lea rdx, str.CMMPlatform::OnTimer
lea rcx, [0x1400ddaf0]
call fcn.14005be10
call fcn.14000b630
mov rcx, rax
mov edx, 0x441
call fcn.1400aeae0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b96d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14008d370
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rcx + 0x508]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x14008d3bf
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x14008d3ba
add rcx, 4
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x14008d5b8
test rbx, rbx
jne 0x14008d399
mov qword [rsp + 0x70], rbp
mov ecx, BSTR_UserUnmarshal
mov qword [rsp + 0x78], r14
call fcn.1400b9d04
xor edx, edx
mov r8d, BSTR_UserUnmarshal
mov rcx, rax
mov rbx, rax
call fcn.1400bffa0
lea rbp, [rbx + 4]
mov edx, 0x7f
mov rcx, rbp
sub rsi, rbp
nop word [rax + rax]
lea rax, [rdx + 0x7fffff7f]
test rax, rax
je 0x14008d424
movzx eax, word [rsi + rcx]
test ax, ax
je 0x14008d424
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14008d400
jmp 0x14008d429
test rdx, rdx
jne 0x14008d42d
sub rcx, 2
xor r14d, r14d
mov word [rcx], r14w
cmp dword [rdi + 0x4f8], r14d
je 0x14008d4cb
mov rcx, qword [rdi + 0x4e0]
mov r9, rbx
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008d4c1
mov eax, dword [rbx]
cmp eax, 4
je 0x14008d489
cmp eax, 0xb
jne 0x14008d4cb
lea r8, [rbx + 0x108]
mov rdx, rbp
lea rcx, [rdi + 0x4e0]
call fcn.14008e110
jmp 0x14008d4cb
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x108]
mov rcx, qword [rdi + 0x4e0]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
jmp 0x14008d4cb
mov dword [rbx + 0x110], 1
mov rsi, qword [rdi + 0x510]
mov rbp, qword [rsp + 0x70]
cmp qword [rdi + 0x528], r14
jne 0x14008d571
mov ecx, dword [rdi + 0x530]
test rcx, rcx
jne 0x14008d4f4
mov rcx, r14
jmp 0x14008d512
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 0x18
jb 0x14008d5cd
lea rcx, [rcx + rcx*2]
shl rcx, 3
add rcx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14008d5cd
mov rcx, qword [rdi + 0x520]
mov qword [rax], rcx
mov qword [rdi + 0x520], rax
mov r8d, dword [rdi + 0x530]
lea ecx, [r8 - 1]
lea rdx, [rcx*2 + 1]
add rdx, rcx
sub r8d, 1
lea rdx, [rax + rdx*8]
js 0x14008d571
mov rax, qword [rdi + 0x528]
mov qword [rdx], rax
mov qword [rdi + 0x528], rdx
sub rdx, 0x18
sub r8d, 1
jns 0x14008d556
mov rcx, qword [rdi + 0x528]
mov rax, qword [rcx]
mov qword [rcx + 0x10], rbx
mov qword [rdi + 0x528], rax
mov qword [rcx + 8], rsi
mov qword [rcx], r14
inc qword [rdi + 0x518]
mov rax, qword [rdi + 0x510]
test rax, rax
je 0x14008d5a5
mov qword [rax], rcx
jmp 0x14008d5ac
mov qword [rdi + 0x508], rcx
mov r14, qword [rsp + 0x78]
mov qword [rdi + 0x510], rcx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b96d0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x8007000e
call fcn.140005030
int3
Function at 0x14008d5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rcx + 0x508]
xor r15d, r15d
mov r14, rcx
mov ebp, r15d
test rsi, rsi
je 0x14008d7ad
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
test rbx, rbx
je 0x14008d7a4
mov edi, dword [rbx]
test edi, edi
jne 0x14008d65d
mov rcx, qword [r14 + 0x4e0]
lea rdx, [rbx + 4]
mov qword [rsp + 0x28], r15
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008d65d
mov edi, dword [rbx]
sub edi, 1
je 0x14008d78c
sub edi, 3
je 0x14008d706
cmp edi, 7
jne 0x14008d7a4
mov rcx, qword [r14 + 0x4e0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 4]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], r15
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008d7a4
cmp dword [rsp + 0x40], 0xb
jne 0x14008d7a4
mov rcx, qword [rsp + 0x38]
mov eax, r15d
cmp rcx, qword [rbx + 0x108]
setne al
cmp dword [rbx + 0x110], r15d
je 0x14008d6ea
mov dword [rbx + 0x110], r15d
lea eax, [rdi - 6]
test ebp, ebp
jne 0x14008d6f5
mov ebp, r15d
test eax, eax
je 0x14008d6fa
mov ebp, 1
mov qword [rbx + 0x108], rcx
jmp 0x14008d786
mov rcx, qword [r14 + 0x4e0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 4]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008d7a4
cmp dword [rsp + 0x44], 4
jne 0x14008d7a4
mov ecx, dword [rsp + 0x30]
mov eax, r15d
cmp ecx, dword [rbx + 0x108]
setne al
cmp dword [rbx + 0x110], r15d
je 0x14008d770
mov dword [rbx + 0x110], r15d
mov eax, 1
test ebp, ebp
jne 0x14008d77b
mov ebp, r15d
test eax, eax
je 0x14008d780
mov ebp, 1
mov dword [rbx + 0x108], ecx
test eax, eax
je 0x14008d7a4
jmp 0x14008d791
mov eax, 1
mov dword [rbx + 0x114], eax
mov rcx, qword [r14 + 0x4d0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test rsi, rsi
jne 0x14008d620
cmp dword [r14 + 0x4fc], r15d
je 0x14008d7c3
mov rcx, qword [r14 + 0x4c0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b96d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14008dc90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
xor r14d, r14d
mov rcx, rdx
mov esi, r14d
mov rbx, rdx
call fcn.140017280
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x154]
mov r8d, 0x104
call fcn.1400bffa0
xor edx, edx
mov dword [rsp + 0x40], 0x104
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400bffa0
mov rcx, qword [rbp + 0x4e0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov edx, esi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov rcx, rbx
mov edi, eax
inc esi
call fcn.140017350
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14008dd52
mov qword [rcx], rax
jmp 0x14008dd55
mov qword [rbx], rax
mov qword [rbx + 8], rax
test edi, edi
je 0x14008dcd0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400b96d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14008e110
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14014f010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov dword [rsp + 0x30], 8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14008e15c
cmp dword [rsp + 0x34], 0xb
mov ecx, SafeArrayDestroy
cmovne eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b96d0
add rsp, 0x48
ret
Function at 0x140090140
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [rcx + 0x194]
mov rbx, rcx
test al, al
jne 0x1400901c6
mov byte [rcx + 0x194], 1
call fcn.14000b630
mov rcx, rax
mov edx, 0x3f3
call fcn.1400aeae0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 0x88]
mov edx, 0xea60
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rdx, str.CRpcClientObject::StopRpcEventTunnel
cmp eax, 0x102
jne 0x1400901af
mov r9, rbx
lea r8d, [rax + 0xd]
lea rcx, str._s__d_WaitForSingleObject_hRpcEventTunnelTerminated__60000__timeout_CRpcClientObject_x
add rsp, 0x20
pop rbx
jmp fcn.14005be10
mov r8d, 0x113
lea rcx, [0x1400ddaf0]
add rsp, 0x20
pop rbx
jmp fcn.14005be10
add rsp, 0x20
pop rbx
ret