joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9d40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.1400985d0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2cc
lea rcx, str._s__d_hadRun_d
call fcn.140075db0
cmp dword [rsp + 0x40], 1
jne 0x1400d9ee9
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2cf
lea rcx, str._s__d_hadRun_d
call fcn.140075db0
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x1400d9e0c
cmp dword [0x1401b2668], 0
je 0x1400d9e0c
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x1400d9df3
cmp dword [0x1401b266c], 0
je 0x1400d9e0c
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rbx, qword [rax + 0xe0]
nop dword [rax + rax]
test rbx, rbx
je 0x1400d9ed7
call fcn.140014660
call fcn.140014660
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400d9e20
cmp dword [rcx + 0x1b4], 1
jne 0x1400d9e20
add rcx, 0xd0
mov qword [rsp + 0x48], rdi
call fcn.1400195c0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.1400985d0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2dc
lea rcx, str._s__d_bMuted_d
call fcn.140075db0
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
mov rax, qword [r9 + 0x10]
call qword [case.0x14005eeb3.0]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.1400986f0
mov rdi, qword [rsp + 0x48]
call fcn.140014660
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.1400aa490
add rsp, 0x30
pop rbx
ret

Function at 0x1400dad80
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400dae06
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dae30
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140039da0
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400daed9
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400db170
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400db1c3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400db2a1
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400db29f
cmp eax, 3
jne 0x1400db228
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400db1b8
cmp dword [rsp + 0x3c], 1
je 0x1400db29f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400db2bc
cmp dword [rsp + 0x3c], 3
je 0x1400db1d5
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400db1b8
cmp dword [rsp + 0x3c], 1
je 0x1400db29f
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400db1b8
cmp dword [rsp + 0x3c], 1
je 0x1400db29f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400db2bc
cmp dword [rsp + 0x3c], 1
jne 0x1400db250
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400db2a1
Function at 0x1400db7d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.140075db0
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400db850]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400dc490
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400dc51b
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f4410
add rsp, 0x58
ret
Function at 0x1400e01a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
call fcn.140014660
mov rcx, rax
call fcn.1400aa410
call fcn.140014660
cmp dword [rax + 0x140], 0
jne 0x1400e01fc
cmp dword [0x1401b2668], 0
je 0x1400e01fc
mov rax, qword [0x1401ab9a8]
test byte [rax + 0x1c], 1
jne 0x1400e01e3
cmp dword [0x1401b266c], 0
je 0x1400e01fc
mov r8d, 0x49
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.140075db0
call fcn.140014660
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x1400e024c
mov qword [rsp + 0x20], rdi
call fcn.140014660
call fcn.140014660
mov rdi, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rdi, rdi
je 0x1400e0242
mov edx, 1
mov rcx, rdi
call fcn.1400e02a0
mov edx, 1
mov rcx, rdi
call fcn.1400e07d0
test rbx, rbx
jne 0x1400e0212
mov rdi, qword [rsp + 0x20]
call fcn.140014660
mov rbx, qword [rsp + 0x30]
sub dword [rax + 0x140], 1
mov ecx, dword [rax + 0x140]
jne 0x1400e0277
mov rcx, qword [rax + 0x150]
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp ecx, 0x32
jle 0x1400e0299
mov r8d, 0x8b
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
add rsp, 0x28
jmp fcn.140075db0
add rsp, 0x28
ret

Function at 0x1400e0da0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
lea rdx, str.CSounzReal2AutoSwitch::OnAddDevice
jne 0x1400e0dcc
mov r8d, 0x103
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140075db0
mov r8d, 0x104
lea rcx, [0x14011bca8]
call fcn.140075db0
xor edx, edx
mov rcx, rbx
call fcn.1400e02a0
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400e07d0

Function at 0x1400e0e00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
lea rdx, str.CSounzReal2AutoSwitch::OnStateChangedDevice
mov r8d, 0x10c
lea rcx, [0x14011bca8]
call fcn.140075db0
lea rdx, str.CSounzReal2AutoSwitch::OnStateChangedDevice
test rbx, rbx
jne 0x1400e0e5e
mov r8d, 0x10d
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
mov r9, qword [rbx + 0x170]
lea rcx, str._s__d_EndpointId_s__dwNewState__d_
mov r8d, 0x10e
mov dword [rsp + 0x20], edi
call fcn.140075db0
cmp edi, 1
jne 0x1400e0e92
mov rax, qword [rsi]
mov rdx, rbx
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14005eeb3.0]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e6f10
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
cmp edx, 0x20
jb 0x1400e6f3b
mov r8d, 0x291
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140075db0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
lfence
call fcn.14003a6b0
lea rcx, [rax + 0x10]
call fcn.14005ee50
call fcn.14003a6b0
mov rcx, rax
mov edx, ebx
call fcn.140079940
mov esi, eax
call fcn.14003a6b0
mov rdi, rax
call fcn.1400e6b90
test eax, eax
je 0x1400e6f90
imul rdx, rbx, 0xb0
test byte [rdx + rdi + reloc.OLEAUT32.dll_BSTR_UserUnmarshal], 2
je 0x1400e6f90
mov ebx, 1
jmp 0x1400e6f92
xor ebx, ebx
call fcn.14003a6b0
mov rcx, rax
lock dec dword [rax + 0x28]
mov eax, dword [rax + 0x28]
mov rdi, qword [rsp + 0x38]
jne 0x1400e6fb4
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400e6fd5
mov eax, dword [rcx + 0x28]
cmp eax, 0x32
jle 0x1400e6fd5
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.140075db0
mov r8d, 0x297
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x14011bca8]
call fcn.140075db0
cmp dword [0x1401b9718], 0
je 0x1400e707e
test esi, esi
je 0x1400e704e
xor edx, edx
lea rcx, [0x14011c160]
call fcn.1400e55c0
call fcn.14006b0c0
mov rcx, rax
mov rdx, qword [rax]
mov rax, qword [rdx + 0x108]
call qword [case.0x14005eeb3.0]
test eax, eax
je 0x1400e707e
mov r8d, 0x2ab
mov dword [0x1401b9718], 0
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x14011bca8]
call fcn.140075db0
jmp 0x1400e707e
call fcn.14006b0c0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x88]
mov rcx, rdx
call qword [case.0x14005eeb3.0]
test eax, eax
jne 0x1400e707e
mov edx, 0x2000000
lea rcx, str._Ping
call fcn.1400e55c0
mov rsi, qword [rsp + 0x30]
test ebx, ebx
je 0x1400e70f6
call fcn.14006b0c0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x190]
mov rcx, rdx
call qword [case.0x14005eeb3.0]
mov r8d, 0x2bb
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
mov r9d, eax
lea rcx, str._s__d_Detect_Plug_In_And_Handle_by_UWP__SET_PING_UWP_WHILE_PLUG_IN_EVENT_HAPPENED__d_ms_later
mov ebx, eax
call fcn.140075db0
mov dword [0x1401b9684], 0xa
call fcn.1400147e0
mov rcx, rax
mov edx, 0x40c
call fcn.1400e8940
call fcn.1400147e0
mov rcx, rax
mov r8d, ebx
mov edx, 0x40c
add rsp, 0x20
pop rbx
jmp fcn.1400e8700
add rsp, 0x20
pop rbx
ret
Function at 0x1400e9160
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x30], esi
lea r9d, [rsi + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x1400e91e4
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400e9253
jmp 0x1400e924d
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_110
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e9245
cmp dword [rsp + 0x38], 4
jne 0x1400e9245
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x1400e923a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400e9253
mov eax, 1
jmp 0x1400e9255
test rbx, rbx
je 0x1400e9253
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400e9280
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x30], esi
lea r9d, [rsi + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140035040
test eax, eax
je 0x1400e9304
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140075db0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400e9373
jmp 0x1400e936d
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_20
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e9365
cmp dword [rsp + 0x38], 4
jne 0x1400e9365
mov edi, dword [rsp + 0x30]
test rbx, rbx
je 0x1400e935a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400e9373
mov eax, 1
jmp 0x1400e9375
test rbx, rbx
je 0x1400e9373
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400ea660
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r8d, 0x83
lea rcx, [0x14011bca8]
call fcn.140075db0
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
test rbx, rbx
jne 0x1400ea6b1
mov r8d, 0x84
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x86
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ea716
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x8a
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400ea240
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400ea9e0
Function at 0x1400ea740
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r8d, 0x96
lea rcx, [0x14011bca8]
call fcn.140075db0
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
test rbx, rbx
jne 0x1400ea791
mov r8d, 0x97
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x99
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ea7f6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x9d
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400ea430
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400ea9e0

Function at 0x1400ea820
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r8d, 0xa9
lea rcx, [0x14011bca8]
call fcn.140075db0
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
test rbx, rbx
jne 0x1400ea871
mov r8d, 0xaa
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xac
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ea8d6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xb0
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400ea240
mov rdx, rbx
call fcn.1400ea430
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400ea9e0
Function at 0x1400ea900
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r8d, 0xbd
lea rcx, [0x14011bca8]
call fcn.140075db0
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
test rbx, rbx
jne 0x1400ea951
mov r8d, 0xbe
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075db0
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xc0
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400ea9b6
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xc4
mov qword [rsp + 0x20], rax
call fcn.140075db0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
call fcn.1400ea240
mov rdx, rbx
call fcn.1400ea430
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400ea9e0
Function at 0x1400f3800
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [rcx + 8], 0
mov rbx, rcx
je 0x1400f3827
lea r8, [0x1400f3710]
jmp 0x1400f3834
cmp dword [rcx + 0xc], 0
je 0x1400f386a
lea r8, [0x1400f37b0]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f4410
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [0x1400f3670]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SubmitThreadpoolWork]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f4410
add rsp, 0x40
pop rbx
ret