joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c2f0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44c3d0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00453510]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00453b10
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00453c60
jmp fcn.0044c2f0
Function at 0x465fe0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
neg rsi
imul rsi, rsi, 0x1c
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x4660bb
lea rsi, [rdx + rdx*2]
lea rdi, [0x005abfc0]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x466064
inc rdx
jmp 0x46603b
cmp r9, 0xffffffffffffffe0
jle 0x46606f
dec rdx
jmp 0x46603b
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00456610
nop
int3
Function at 0x484f70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x485040
jb 0x48509f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00485200
aeskeygenassist xmm1, xmm0, 1
call fcn.00485210
aeskeygenassist xmm1, xmm2, 2
call fcn.00485200
aeskeygenassist xmm1, xmm0, 2
call fcn.00485210
aeskeygenassist xmm1, xmm2, 4
call fcn.00485200
aeskeygenassist xmm1, xmm0, 4
call fcn.00485210
aeskeygenassist xmm1, xmm2, 8
call fcn.00485200
aeskeygenassist xmm1, xmm0, 8
call fcn.00485210
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00485200
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00485210
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00485200
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00485210
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00485200
jmp 0x48510d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00485170
aeskeygenassist xmm1, xmm2, 2
call fcn.004851c0
aeskeygenassist xmm1, xmm2, 4
call fcn.00485170
aeskeygenassist xmm1, xmm2, 8
call fcn.004851c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00485170
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004851c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00485170
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004851c0
jmp 0x48510d
aeskeygenassist xmm1, xmm0, 1
call fcn.00485140
aeskeygenassist xmm1, xmm0, 2
call fcn.00485140
aeskeygenassist xmm1, xmm0, 4
call fcn.00485140
aeskeygenassist xmm1, xmm0, 8
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00485140
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00485140
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x48511a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140003000
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1068
call fcn.140073ae0
sub rsp, rax
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbx, r9
mov r14, qword [rsp + 0x10d0]
mov edi, r8d
mov r15, qword [rsp + 0x10d8]
mov ebp, edx
mov rsi, rcx
cmp r8d, dword [rsp + 0x10c0]
jg 0x140003107
mov edx, 0x5c
call fcn.14005d810
test rax, rax
mov r8d, 0x800
lea rcx, [rax + 1]
cmovne rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14005db90
xor edx, edx
lea rcx, [rsp + 0x850]
mov r8d, 0x800
call fcn.14005db90
call fcn.140002db0
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x50]
mov r9, r14
mov qword [rsp + 0x20], 0
mov r8d, 0x800
mov rcx, qword [rax]
call fcn.1400619e4
cmp qword [rbx + 0x18], 0x10
jb 0x1400030c0
mov rbx, qword [rbx]
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
lea r9, str._s__s__d____d_:_trace__s_n
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x850]
mov dword [rsp + 0x30], ebp
mov edx, 0x800
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call fcn.140002dc0
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14003cd10
add rsp, 0x1068
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e6d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rdi
push r14
push r15
sub rsp, 0x48
lea rax, [r11 + 0x18]
mov dword [r11 + 0x18], 4
mov qword [r11 - 0x40], rax
lea r9, [r11 + 0x20]
lea rax, [r11 + 8]
mov r14d, edx
mov rdi, rcx
mov qword [r11 - 0x48], rax
mov rcx, qword [rcx + 0x20]
lea rdx, str.Mode
xor r15d, r15d
xor r8d, r8d
xor bl, bl
mov dword [r11 + 8], r15d
mov dword [r11 + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rdi + 0x18], bl
je 0x14000e819
mov qword [rsp + 0x78], rbp
mov ebp, dword [rsp + 0x70]
cmp dword [rdi + 0x1c], ebp
je 0x14000e814
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x70], r15d
call qword [sym.imp.MaxxAudioAPOShell64.dll_WavesFX_Preset_GetActive]
test al, al
je 0x14000e814
mov eax, ebp
mov qword [rsp + 0x40], rsi
mov ecx, r15d
sub eax, 1
je 0x14000e796
sub eax, 1
je 0x14000e791
sub eax, 1
je 0x14000e78a
cmp eax, 1
jne 0x14000e796
lea ecx, [rax + 1]
jmp 0x14000e796
mov ecx, 1
jmp 0x14000e796
mov ecx, 3
mov r8d, dword [rsp + 0x70]
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
lea eax, [rcx + rcx*4]
lea esi, [r8 + rax*2]
cmp dword [rsp + 0x80], r15d
jne 0x14000e7ca
cmp r8d, esi
je 0x14000e7ca
mov r9b, 1
jmp 0x14000e7cd
xor r9d, r9d
xor r8d, r8d
mov edx, esi
call fcn.14000e890
lea rax, str.Orientation_Sound_Mode_for_Output_Mode__0__has_been_changed_to__d
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r8, [0x1400a73c8]
mov r9d, 5
mov qword [rsp + 0x20], r15
mov edx, 0xb1
mov dword [rdi + 0x1c], ebp
lea rcx, str...SharedAutoOrientationControl_Lenovo.cpp
mov bl, 1
call fcn.140002f50
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
cmp byte [rdi + 0x18], r15b
je 0x14000e874
test r14d, r14d
je 0x14000e874
mov r9, qword [rdi + 0x28]
xor edx, edx
mov rcx, qword [rdi + 0x20]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x14000e874
mov dword [rsp + 0x30], eax
lea r8, [0x1400a73c8]
lea rax, str.Error:_Failed_to_register_for_registry_change_notification__Error_code___d_
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, str...SharedAutoOrientationControl_Lenovo.cpp
mov edx, 0xbc
mov qword [rsp + 0x20], r15
call fcn.140002f50
movzx eax, bl
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x14000eed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, str.CBaseThread::Start
mov qword [rsp + 0x30], rax
lea rsi, [0x1400868d0]
mov rbx, rcx
mov qword [rsp + 0x28], rsi
lea r8, [0x1400a73c8]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 3]
lea edx, [rdi + 0x25]
lea rcx, str...SharedBaseThread.cpp
call fcn.140002f50
mov byte [rbx + 0x1c], dil
cmp qword [rbx + 0x10], rdi
jne 0x14000ef6f
lea rax, str.CreateEvent
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 3]
mov qword [rsp + 0x28], rsi
lea r8, [0x1400a73c8]
lea edx, [rdi + 0x2b]
mov qword [rsp + 0x20], rdi
lea rcx, str...SharedBaseThread.cpp
call fcn.140002f50
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
cmp rax, rdi
je 0x14000efdb
cmp qword [rbx + 8], rdi
jne 0x14000efcd
mov r9d, 3
lea rax, [0x140087310]
mov qword [rsp + 0x30], rax
lea r8, [0x1400a73c8]
mov qword [rsp + 0x28], rsi
lea rcx, str...SharedBaseThread.cpp
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 0x30]
call fcn.140002f50
lea rax, [rbx + 0x18]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14000ee20]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
cmp qword [rbx + 0x10], rdi
je 0x14000efdb
mov al, 1
cmp qword [rbx + 8], rdi
jne 0x14000efdf
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000f150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000f183
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000f1ca
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000f1c5
nop
cmp rbx, rcx
jae 0x14000f1ca
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000f1b0
cmp rbx, rcx
jb 0x14000f1ce
xor eax, eax
jmp 0x14000f1da
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400178e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rax, str.CDirectShowCameraImp::Disconnect
xor esi, esi
mov qword [rsp + 0x30], rax
lea r8, [0x1400a73c8]
lea rax, [0x1400868d0]
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rcx, str...SharedDirectShowCamera.cpp
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rsi
mov edx, 0xf9
call fcn.140002f50
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2 + 0x60], si
jne 0x140017946
test rax, rax
je 0x140017992
lea rax, [rsp + 0x48]
mov r8d, 3
lea rdx, [rbx + 0x60]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.1400027e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x140017992
call fcn.14005fb6c
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400179a5
mov qword [rbx + 0x28], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400179b8
mov qword [rbx + 0x20], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400179cb
mov qword [rbx + 0x30], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400179de
mov qword [rbx + 0x18], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400179f1
mov qword [rbx + 0x10], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017a04
mov qword [rbx + 8], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbx + 0x40]
mov word [rbx + 0x38], si
xor r8d, r8d
lea rdx, [0x140088580]
call fcn.140017e30
mov word [rbx + 0x60], si
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14003cd10
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140017a50
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp qword [rcx + 0x20], 0
mov rbx, rcx
je 0x140017b9d
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140017b9d
cmp byte [rbx + 0x39], 0
je 0x140017b9d
mov rax, qword [rcx]
mov qword [rsp + 0xf8], rdi
call qword [rax + 0x38]
mov edi, eax
test eax, eax
jns 0x140017adb
mov dword [rsp + 0x30], eax
lea r8, [0x1400a73c8]
lea rax, str.Failed_at_pMediaControl__Run._Error_Code__0x_08x
mov r9d, 1
mov qword [rsp + 0x28], rax
lea rcx, str...SharedDirectShowCamera.cpp
mov edx, 0x118
mov qword [rsp + 0x20], 0
call fcn.140002f50
mov rcx, qword [rbx + 0x30]
test edi, edi
setns dil
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x140017b26
mov dword [rsp + 0x30], eax
lea r8, [0x1400a73c8]
lea rax, str.Failed_at_pMediaControl__Stop._Error_Code__0x_08x
mov r9d, 1
mov qword [rsp + 0x28], rax
lea rcx, str...SharedDirectShowCamera.cpp
mov edx, 0x11e
mov qword [rsp + 0x20], 0
call fcn.140002f50
lea rdx, [rbx + 0x60]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140017b30
test rax, rax
je 0x140017b78
lea rax, [rsp + 0x48]
mov r8d, 3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400027e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x140017b78
call fcn.14005fb6c
movzx eax, dil
mov rdi, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14003cd10
add rsp, 0xe0
pop rbx
ret
xor al, al
jmp 0x140017b84
Function at 0x1400190f0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rsi, r9
mov r14, r8
xor bl, bl
xor r15d, r15d
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp qword [rsp + 0x50], r15
je 0x1400192e9
lea rax, [rbp - 0x68]
mov qword [rbp - 0x70], rax
or rbx, 0xffffffffffffffff
test rsi, rsi
jne 0x140019191
mov edx, r15d
mov qword [rbp - 0x70], rdx
jmp 0x1400191fd
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], r15b
jne 0x140019194
inc edi
lea r8, [rbp - 0x68]
mov edx, edi
lea rcx, [rbp - 0x70]
call fcn.140002d00
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp - 0x70]
call fcn.140001490
test eax, eax
je 0x1400191f9
cmp eax, 0xc
je 0x1400191ee
cmp eax, 0x16
je 0x1400191e3
cmp eax, 0x22
je 0x1400191e3
cmp eax, 0x50
je 0x1400191f9
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rdx, qword [rbp - 0x70]
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x68], 0
cmp byte [rdx], 0
jne 0x140019220
mov rbx, r15
jmp 0x140019229
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140019220
mov r8, rbx
lea rcx, [rsp + 0x68]
call fcn.140002500
nop
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
cmp rcx, rax
je 0x140019249
call fcn.14005fb6c
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r15
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x1400192e9
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x1400192e4
test cl, 0x1f
je 0x1400192b7
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400192c6
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400192d5
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x1400192e1
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14003cd10
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c3a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.14001c230
cmp qword [rax + 0x18], 0x10
jb 0x14001c3ca
mov rax, qword [rax]
xor ecx, ecx
mov r9d, 0x20019
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rdx, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001c43e
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_17
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x14001c47e
mov rcx, qword [rsp + 0x48]
inc rax
cmp rax, 0x1000
jb 0x14001c479
test cl, 0x1f
jne 0x14001c494
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001c49a
sub rcx, rax
cmp rcx, 8
jb 0x14001c4a0
cmp rcx, 0x27
ja 0x14001c4a6
mov rcx, rax
call fcn.14003ccec
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003cd10
add rsp, 0x78
ret
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3

Function at 0x14001c5f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8b, 1
lea rdx, [rsp + 0x48]
call fcn.14001c230
cmp qword [rax + 0x18], 0x10
jb 0x14001c61a
mov rax, qword [rax]
xor ecx, ecx
mov r9d, 0x20019
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rdx, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001c68e
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x14001c6ce
mov rcx, qword [rsp + 0x48]
inc rax
cmp rax, 0x1000
jb 0x14001c6c9
test cl, 0x1f
jne 0x14001c6e4
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001c6ea
sub rcx, rax
cmp rcx, 8
jb 0x14001c6f0
cmp rcx, 0x27
ja 0x14001c6f6
mov rcx, rax
call fcn.14003ccec
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003cd10
add rsp, 0x78
ret
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
Function at 0x140022f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rcx, qword [0x1400a6be8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.HeadsetStatus
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x40], ebx
setne bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140022fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rcx, qword [0x1400a6be8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], ebx
lea rdx, str.HeadsetStatus
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x48], ebx
je 0x140023084
lea rax, [rsp + 0x58]
mov dword [rsp + 0x48], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x58], rbx
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140023080
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.LineOutMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x48]
mov edx, ebx
lea rcx, vtable.CJackSense.0
call fcn.1400230c0
mov r9, qword [0x1400a6bf0]
xor edx, edx
mov rcx, qword [0x1400a6be8]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
add rsp, 0x30
pop rbx
ret