joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024350
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
jne 0x14002437a
lea r8d, [rdx + 0x4a]
lea rdx, str.CControlChangeEventNotify::OnAddDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.14004c3d0
lea rcx, [rdx + 0xc8]
call fcn.14000f590
test rax, rax
je 0x14002439e
mov r8, qword [rax]
lea rdx, [rbx - 8]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [r8 + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x1400243b0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
jne 0x1400243da
lea r8d, [rdx + 0x59]
lea rdx, str.CControlChangeEventNotify::OnRemoveDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.14004c3d0
cmp qword [rdx + 0x110], 0
je 0x140024408
lea rcx, [rdx + 0xc8]
call fcn.14000f590
test rax, rax
je 0x140024408
mov r8, qword [rax]
lea rdx, [rbx - 8]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [r8 + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x140025ef0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r14
sub rsp, 0x38
mov ebx, r8d
mov r14, rdx
test rdx, rdx
jne 0x140025f27
mov r8d, 0x315
lea rdx, str.CCustomizeAcer::EnableAcerTrueHarmony
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x38
pop r14
pop rbx
jmp fcn.14004c3d0
call fcn.14000ac00
mov r9d, 1
mov ecx, dword [rax + 0x17c]
and ecx, 0x8000000
test ebx, ebx
je 0x1400260a7
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rdi
test ecx, ecx
je 0x140025f8a
lea rcx, [r14 + 0x10]
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x1400c2dc0]
call fcn.140002920
mov r8d, dword [rsp + 0x50]
lea rdx, [0x1400c2dd8]
mov r9d, 1
jmp 0x140025f94
mov r8d, r9d
lea rdx, [0x1400c2e50]
mov rcx, r14
call fcn.140002a40
xor r9d, r9d
lea r8, str.GFX_StereoEnhance_Enable
lea rdx, str.Acer
lea rcx, [0x1401267f0]
call fcn.140004da0
xor r9d, r9d
lea r8, str.RTK_VOICE_ENHANCE
lea rdx, str.Acer
mov ebx, eax
lea rcx, [0x1401267f0]
call fcn.140004da0
xor r9d, r9d
lea r8, str.GFX_VirtualBass_Enable
lea rdx, str.Acer
mov edi, eax
lea rcx, [0x1401267f0]
call fcn.140004da0
xor r9d, r9d
lea r8, str.RTK_MP3_ENHANCE
lea rdx, str.Acer
mov esi, eax
lea rcx, [0x1401267f0]
call fcn.140004da0
mov r9d, 1
lea rdx, [0x1400c2e08]
mov r8d, ebx
mov rcx, r14
mov ebp, eax
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2e20]
mov r8d, edi
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2e38]
mov r8d, esi
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2da8]
mov r8d, ebp
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2df0]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop r14
pop rbx
ret
test ecx, ecx
je 0x1400260f1
lea rcx, [r14 + 0x10]
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x1400c2dd8]
call fcn.140002920
mov r8d, dword [rsp + 0x50]
lea rdx, [0x1400c2dc0]
mov r9d, 1
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2dd8]
jmp 0x1400260f8
lea rdx, [0x1400c2e50]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2e08]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2e20]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2e38]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2da8]
xor r8d, r8d
mov rcx, r14
call fcn.140002a40
mov r9d, 1
lea rdx, [0x1400c2df0]
mov r8d, r9d
mov rcx, r14
call fcn.140002a40
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x140029b80
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
test rdx, rdx
jne 0x140029bd2
mov r8d, 0x2dc
lea rdx, str.CCustomizeASUS::GetGlobalNN
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14004c3d0
xor eax, eax
jmp 0x140029d13
mov esi, 0x63
xor eax, eax
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x38], ebp
mov ebx, 1
mov r9d, ebx
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140021cb0
test eax, eax
je 0x140029c40
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14004c3d0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140029ca8
jmp 0x140029ca2
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.GlobalNN
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140029c9a
cmp dword [rsp + 0x40], 4
jne 0x140029c9a
mov esi, dword [rsp + 0x38]
test rdi, rdi
je 0x140029c96
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, ebx
jmp 0x140029caa
test rdi, rdi
je 0x140029ca8
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, ebp
mov dword [rsp + 0x20], edi
mov r9d, esi
mov r8d, 0x2e1
lea rdx, str.CCustomizeASUS::GetGlobalNN
lea rcx, str._s__d_get_GlobalNN_from_registry___d___bSuccess___d_
call fcn.14004c3d0
test edi, edi
je 0x140029cf3
cmp esi, 1
jne 0x140029cd8
mov dword [r14], ebx
jmp 0x140029d11
test esi, esi
jne 0x140029ce1
mov dword [r14], ebp
jmp 0x140029d11
mov r9d, esi
mov r8d, 0x2f0
lea rcx, str._s__d_get_GlobalNN_from_registry_error_____d_
jmp 0x140029d03
xor r9d, r9d
mov r8d, 0x2f6
lea rcx, str._s__d_get_GlobalNN_via_GetRegUI4Property_fail_____d_
lea rdx, str.CCustomizeASUS::GetGlobalNN
call fcn.14004c3d0
mov ebx, ebp
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a4020
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14002a0c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov qword [r11 - 0x40], rcx
lea rax, vtable.CCustomizeGigabyte.1.0
mov qword [rcx], rax
lea rax, vtable.CCustomizeGigabyte.0
mov qword [rcx + 8], rax
xor ebx, ebx
mov qword [rcx + 0x10], rbx
cmp dword [0x140126800], ebx
je 0x14002a2c9
call fcn.14000ac00
test dword [rax + 0x48], 0x200
je 0x14002a2c9
mov ebp, 0x3e7
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x40], ebx
lea r9d, [rbx + 1]
lea r8, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140021cb0
test eax, eax
je 0x14002a193
lea r9, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14004c3d0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002a1e9
jmp 0x14002a1e3
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.JackImpedance
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a1db
cmp dword [rsp + 0x48], 4
jne 0x14002a1db
mov ebp, dword [rsp + 0x40]
test rbx, rbx
je 0x14002a1e9
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.14000adc0
mov rcx, rax
call fcn.140077520
call fcn.14000adc0
mov rcx, rax
call fcn.1400774c0
mov rbx, rax
test rbx, rbx
je 0x14002a255
call fcn.14000adc0
call fcn.14000adc0
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x14002a206
cmp dword [rcx + 0x1ac], 1
jne 0x14002a206
xor r9d, r9d
mov r8d, ebp
lea rdx, [0x1400c2c28]
call fcn.140002a40
mov r9d, ebp
mov r8d, eax
lea rdx, str.CCustomizeGigabyte::CCustomizeGigabyte
lea rcx, str._s_bSuccess_d_dwHpMode_d
call fcn.14004c3d0
call fcn.14000adc0
mov rcx, rax
call fcn.1400775a0
call fcn.140005ff0
mov rcx, rax
lea r8, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov rdx, 0xffffffff80000002
call fcn.14007a020
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14002a2a8
lea rdx, str.JackImpedance
mov rcx, rax
call fcn.140079520
mov rcx, qword [rdi + 0x10]
add rcx, 0x20
lea rdx, [rdi + 8]
call fcn.1400060b0
jmp 0x14002a2c9
lea r9, str.SOFTWARESAVITECHSVLoadSenseGIGABYTEJDSenseJackPlug
mov r8d, 0x30
lea rdx, str.CCustomizeGigabyte::CCustomizeGigabyte
lea rcx, str._s__d___RegKeyNotify_fail__path___s
call fcn.14004c3d0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400a4020
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002aac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140021cb0
test eax, eax
je 0x14002ab49
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14004c3d0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002abd1
jmp 0x14002abcb
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002abc3
cmp dword [rsp + 0x40], 4
jne 0x14002abc3
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x14002ab9f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x14002abd1
mov r8d, 0x5e
lea rdx, str.CCustomizeHonor::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.14004c3d0
mov eax, 1
jmp 0x14002abd3
test rbx, rbx
je 0x14002abd1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a4020
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14002bc80
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x14002bd7d
call fcn.140023e80
mov rbx, rax
test rax, rax
jne 0x14002bcd8
mov r8d, 0x153
lea rdx, str.CCustomizeHonor::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.14004c3d0
mov edx, edi
mov rcx, rbx
call fcn.14004e8a0
imul rcx, rdi, 0xac
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x14002bd88
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400c3fc8]
lea rcx, [rsp + 0x38]
call fcn.140006190
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x1401267f8]
call fcn.14006a7f0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002bd7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004670
int3

Function at 0x14002c0a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x14002c0e4
call fcn.14002af60
test eax, eax
je 0x14002c134
call fcn.14000af30
mov rcx, rax
mov edx, 0x42d
call fcn.140098be0
mov r8d, 0x18f
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, [0x1400c4050]
add rsp, 0x38
jmp fcn.14004c3d0
cmp edx, 0x432
jne 0x14002c134
mov r8d, 0x195
lea rdx, str.CCustomizeHonor::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.14004c3d0
call fcn.14000af30
mov rcx, rax
mov edx, 0x432
call fcn.140098be0
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.14006a7f0
add rsp, 0x38
ret

Function at 0x14002f300
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0xc0]
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], eax
mov r9d, edx
lea rcx, str._s__d_bSetGlobalNN___d__current_global_NN___d
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x456
call fcn.14004c3d0
mov rax, qword [0x1401267f0]
lea r8, str.GlobalNN
mov r9d, ebx
lea rdx, str.Others
lea rcx, [0x1401267f0]
call qword [rax + 0x28]
test eax, eax
jne 0x14002f381
mov r9d, ebx
lea rdx, str.CCustomizeHP::SetGlobalNN
mov r8d, 0x45c
lea rcx, str._s__d_SetGloablNN_fail__bSetGloablNN___d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14004c3d0
cmp dword [rdi + 0xc0], ebx
je 0x14002f3a7
mov dword [rdi + 0xc0], ebx
call fcn.14000af30
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.1400989d0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400339e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.14000ac00
test byte [rax + 0x264], 0xf
je 0x140033b52
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x40], 1
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x140033b6a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r9, str.HP_CONTROL
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400c3fc8]
lea rcx, [rsp + 0x50]
call fcn.140006190
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140033b36
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140033b36
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.HP_CONTROL_DefVolumeLevelEnable
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
jne 0x140033b36
mov r9d, dword [rsp + 0x40]
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x1401267f0]
mov rax, qword [0x1401267f0]
call qword [rax + 0x28]
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, 0xd2d
lea rdx, str.CCustomizeHP::SyncHpControlDefaultVolume
lea rcx, str._s__d_bSuccess__d__dwForceRestore___d
call fcn.14004c3d0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033b52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a4020
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004670
int3
Function at 0x140037820
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
test rdx, rdx
jne 0x14003785f
mov r8d, 0x12ca
lea rdx, str.CCustomizeHP::OnNamedPipeEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14004c3d0
cmp dword [rdx], 0x30000003
jne 0x1400378e7
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x1400378f2
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdi, [0x1400c4360]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140003d00
test al, al
jne 0x1400378cb
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400378b0
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140003f80
nop
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.140003bc0
nop
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400a0900
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004670
int3

Function at 0x140038230
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.140021cb0
test eax, eax
je 0x1400382b9
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14004c3d0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140038341
jmp 0x14003833b
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SkipActionForS0
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140038333
cmp dword [rsp + 0x40], 4
jne 0x140038333
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x14003830f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140038341
mov r8d, 0x5e
lea rdx, str.CCustomizeHuawei::SkipActionForS0
lea rcx, str._s__d_mute_function_is_disable
call fcn.14004c3d0
mov eax, 1
jmp 0x140038343
test rbx, rbx
je 0x140038341
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a4020
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400391e0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsxd rdi, r8d
mov dword [rsp + 0x30], 0
cmp edi, 0xf
jg 0x1400392dd
call fcn.140023e80
mov rbx, rax
test rax, rax
jne 0x140039238
mov r8d, 0x153
lea rdx, str.CCustomizeHuawei::OnDriverEvent
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.14004c3d0
mov edx, edi
mov rcx, rbx
call fcn.14004e8a0
imul rcx, rdi, 0xac
movzx ebx, word [rcx + rbx + reloc.OLEAUT32.dll_BSTR_UserUnmarshal]
shr ebx, 1
and ebx, 1
mov qword [rsp + 0x38], 0
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x1400392e8
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r9, str.Others
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400c3fc8]
lea rcx, [rsp + 0x38]
call fcn.140006190
mov r9d, ebx
lea r8, str.JackStatus
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [0x1401267f8]
call fcn.14006a7f0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400392dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004670
int3

Function at 0x140039360
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp edx, 0x42d
jne 0x1400393a4
call fcn.140038690
test eax, eax
je 0x1400393f4
call fcn.14000af30
mov rcx, rax
mov edx, 0x42d
call fcn.140098be0
mov r8d, 0x18f
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, [0x1400c4050]
add rsp, 0x38
jmp fcn.14004c3d0
cmp edx, 0x432
jne 0x1400393f4
mov r8d, 0x195
lea rdx, str.CCustomizeHuawei::OnTimer
lea rcx, str._s__d_SkipActionForS0_set_0
call fcn.14004c3d0
call fcn.14000af30
mov rcx, rax
mov edx, 0x432
call fcn.140098be0
xor r9d, r9d
lea r8, str.SkipActionForS0
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.14006a7f0
add rsp, 0x38
ret
Function at 0x14003a410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
mov r9d, edx
lea rcx, str._s__d_dwTid_d
lea rdx, str.CCustomizeMSI::OnTimer
mov r8d, 0x7b
call fcn.14004c3d0
cmp ebx, 0x437
jne 0x14003a57e
call fcn.14000af30
mov rcx, rax
mov edx, ebx
call fcn.140098be0
cmp dword [0x140125a24], 0
jne 0x14003a5a4
call fcn.14000adc0
mov edx, 1
call fcn.140078b40
mov r9, rax
mov qword [rdi + 0x10], rax
mov r8d, 0x84
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d_m_pAudDev_x
call fcn.14004c3d0
cmp dword [0x1401271a4], 0
jne 0x14003a4fc
mov r8d, 0x88
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.14004c3d0
mov rdx, qword [rdi + 0x10]
lea rcx, [0x140127080]
add rdx, 0x10
mov dword [rsp + 0x28], 1
mov r8d, 0x6f
call fcn.14009ce60
mov r8d, 0x8b
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.14004c3d0
cmp dword [0x1401271a4], 0
je 0x14003a5a4
mov r8d, 0x8f
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.14004c3d0
mov r8d, 0x3e
lea rdx, str.CWasapiPlayback::Play
lea rcx, [0x1400c4050]
call fcn.14004c3d0
xor eax, eax
lea r9, [0x140127080]
mov qword [rsp + 0x28], rax
lea r8, [0x14009d260]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
call fcn.14000af30
mov rcx, rax
mov edx, 0x436
mov r8d, 0xea60
call fcn.1400989d0
mov dword [0x140125a24], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0x436
jne 0x14003a5a4
mov r8d, 0x9d
lea rdx, str.CCustomizeMSI::OnTimer
lea rcx, str._s__d
call fcn.14004c3d0
call fcn.14003a2c0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003b040
Capabilities:
Print debug messages

Disassembly:
sub dword [rcx + 0x18], 1
mov eax, dword [rcx + 0x18]
jne 0x14003b054
mov rcx, qword [rcx + 0x10]
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp eax, 0x32
jle 0x14003b072
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
jmp fcn.14004c3d0
ret
Function at 0x14003ce20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x40e
jne 0x14003cea6
call fcn.14000af30
mov rcx, rax
mov edx, 0x40e
call fcn.140098be0
cmp dword [0x140125a2c], 0
jne 0x14003cede
mov ebx, dword [rbx + 0x2c]
call fcn.14000ac00
movzx ecx, word [rax + 0x2ce]
mov eax, 0x103c
test ebx, ebx
je 0x14003ce88
cmp cx, ax
jne 0x14003ce7e
mov edx, 1
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.140033e00
add rsp, 0x20
pop rbx
jmp fcn.14003c3a0
cmp cx, ax
jne 0x14003ce9c
xor edx, edx
lea ecx, [rdx + 1]
add rsp, 0x20
pop rbx
jmp fcn.140033e00
add rsp, 0x20
pop rbx
jmp fcn.14003c750
cmp edx, 0x435
jne 0x14003ceec
call fcn.14000af30
mov rcx, rax
mov edx, 0x435
call fcn.140098be0
cmp dword [rbx + 0x20], 0
je 0x14003ced9
call fcn.14003c750
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.14003ccb0
call fcn.14003c3a0
lea rcx, [rbx - 0x10]
add rsp, 0x20
pop rbx
jmp fcn.14003ccb0
add rsp, 0x20
pop rbx
ret