joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cbe10
Capabilities:
Delete registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.1400cbeb0
lea rcx, [rsp + 0x30]
or eax, 0xf003f
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rcx, rbx
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400cbe7d
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400cbe9a
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ede70
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400cbf50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0xb0]
mov r15, r9
mov rsi, qword [rsp + 0xb8]
mov r14, r8
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov rbx, rcx
call fcn.1400cbeb0
lea rcx, [rsp + 0x38]
or eax, 0x20019
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rcx, rbx
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400cbfe1
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400cc0d1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [rsp + 0x30]
mov ebx, eax
test rbp, rbp
je 0x1400cc021
cmp dword [rsi], edi
jae 0x1400cc021
mov ebx, 0xea
jmp 0x1400cc0c4
test eax, eax
jne 0x1400cc0c4
test rbp, rbp
je 0x1400cc0c2
mov r8d, dword [rsi]
xor edx, edx
mov rcx, rbp
call fcn.14010ef60
inc edi
mov ecx, edi
mov dword [rsp + 0x30], edi
call fcn.14010fa40
mov rdi, rax
test rax, rax
je 0x1400cc0bb
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.14010ef60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
jne 0x1400cc0b1
mov r8d, dword [rsi]
xor edx, edx
mov rcx, rbp
call fcn.14010ef60
mov r9d, dword [rsp + 0x30]
mov r8, rdi
mov edx, dword [rsi]
mov rcx, rbp
call fcn.1400c8130
mov eax, dword [rsp + 0x30]
mov dword [rsi], eax
mov rcx, rdi
call fcn.140117680
jmp 0x1400cc0c4
mov ebx, 0x7a
jmp 0x1400cc0c4
mov dword [rsi], edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ede70
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cc140
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xc0]
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov rbp, rcx
call fcn.1400cbeb0
mov edi, dword [rsp + 0xd0]
lea rcx, [rsp + 0x50]
or eax, edi
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov r9d, eax
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
je 0x1400cc1c0
lea rax, [rsp + 0x50]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x1400cc1fd
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
or edi, 2
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rdx, r14
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
jne 0x1400cc235
test rsi, rsi
je 0x1400cc228
mov eax, dword [rsp + 0xc8]
mov r9d, r12d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ede70
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cedd0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rbx, [rcx + 8]
cmp qword [rbx + 0x18], 0x10
jb 0x1400cee0e
mov r8, qword [rbx]
jmp 0x1400cee11
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexA]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x1400cee5b
cmp qword [rbx + 0x18], 0x10
jb 0x1400cee35
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.api_ms_win_core_synch_ansi_l1_1_0.dll_OpenMutexA]
mov rdi, rax
test rax, rax
jne 0x1400ceef5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x1400cee64
test rdi, rdi
jne 0x1400ceef5
mov edx, 0x28
lea rcx, [rsp + 0x70]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::__autoclassinit2_unsigned_long_long_unsigned___int64_____ptr64
mov edx, 0x20000001
lea rcx, [rsp + 0x70]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::constructor_enum_CConsolidatedErrorGenerated::ISDI2_ERRORS____ptr64
nop
mov dword [rsp + 0x78], esi
mov edx, esi
lea rcx, [rsp + 0x28]
call fcn.14001b480
nop
mov r8, rax
lea rdx, str.Failed_to_create_or_open_mutex._ErrorCode:
lea rcx, [rsp + 0x50]
call fcn.140019690
nop
mov rcx, rax
call fcn.14000c710
mov rdx, rax
lea rcx, [rsp + 0x70]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::AddDebugInformation_char_const____ptr64____ptr64
nop
lea rcx, [rsp + 0x50]
call fcn.14000c720
nop
lea rcx, [rsp + 0x28]
call fcn.14000c720
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::constructor_class_CConsolidatedError_const____ptr64____ptr64
lea rdx, [0x1401e22e0]
lea rcx, [rsp + 0x28]
call fcn.14010ee78
nop
mov rax, rdi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ede70
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400d3740
Capabilities:
Shutdown system

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::constructor_void____ptr64
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x48], 0xffffffffffffffff
lea r8, [rsp + 0x60]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400d382c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x48]
lea edx, [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400d382c
mov dword [rsp + 0x50], 1
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0x10]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400d382c
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x1400d3849
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea r9, str.Shutdown_request_failed.
mov r8d, eax
mov edx, 1
mov rcx, rbx
call sym.RstMwService.exe_public:_void___cdecl_CConsolidatedError::SetError_enum_CConsolidatedError::ISDI2_ERROR_TYPE__unsigned_long_int__wchar_t_const____ptr64____ptr64
mov dword [rsp + 0x5c], edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x1400d387d
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ede70
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400f1e6c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
je 0x1400f1e7f
add rsp, 0x48
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400f249c
lea rdx, [0x1401e29d8]
lea rcx, [rsp + 0x20]
call fcn.14010ee78
int3

Function at 0x1400fc9ac
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1401fb6bc]
xor edx, edx
jmp fcn.1400f1e6c

Function at 0x1400fd39c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1401fb6bc]
jmp fcn.1400f1e6c

Function at 0x140110374
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140188418]
xor ecx, ecx
lea r8, [0x140188410]
lea rdx, str.FlsAlloc
call fcn.14011019c
mov rbx, rax
test rax, rax
je 0x1401103b4
mov rcx, rax
call fcn.1400eeec4
mov rcx, rdi
call rbx
jmp 0x1401103ba
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14011041c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140188428]
mov ecx, 2
lea r8, [0x140188420]
lea rdx, str.FlsGetValue
call fcn.14011019c
mov rdi, rax
test rax, rax
je 0x14011045d
mov rcx, rax
call fcn.1400eeec4
mov ecx, ebx
call rdi
jmp 0x140110465
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140110470
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140188430]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140188428]
call fcn.14011019c
mov rsi, rax
test rax, rax
je 0x1401104bc
mov rcx, rax
call fcn.1400eeec4
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1401104c7
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002ab0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
lea r8, str.c:usersPublicMicTray.log
mov edx, 0x104
lea rcx, [0x14029ab70]
call fcn.1401ad828
lea rcx, [0x14029ab70]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteFileW]

Function at 0x140002af0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x14]
mov dword [rsp + 0x30], 4
mov qword [r11 - 0x20], rax
lea r9, [r11 - 0x18]
lea rax, [r11 + 0x20]
mov dword [rsp + 0x34], 4
mov esi, r8d
mov qword [r11 - 0x28], rax
xor r8d, r8d
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002b55
cmp dword [rsp + 0x30], 4
jne 0x140002b55
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [rsp + 0x68]
xor edx, edx
mov rbx, qword [rsp + 0x50]
test eax, eax
mov rsi, qword [rsp + 0x58]
cmovne ecx, edx
mov eax, ecx
add rsp, 0x40
pop rdi
ret
Function at 0x140003340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.140027d64
mov rsi, rax
test rax, rax
jne 0x140003375
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140003472
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140003472
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140003472
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400033fe
cmp rbx, rcx
jae 0x140003472
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400033e5
cmp rbx, rcx
jae 0x140003472
movzx edi, word [rbx]
test di, di
je 0x140003472
mov r10, qword [r14]
mov ebp, 1
movzx esi, di
mov ecx, ebp
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, esi
or ecx, eax
jge 0x140003439
mov edx, esi
mov rcx, r14
call fcn.140003a70
mov r10, qword [r14]
movzx edx, word [rbx]
lea r8, [rbx + 2]
movzx r9d, dx
movzx ebx, di
mov rcx, r10
mov edx, ebx
call fcn.1401b198c
xor ecx, ecx
test eax, eax
je 0x14000345e
cmp eax, 0xc
je 0x140003499
cmp eax, 0x50
jne 0x140003493
mov rax, qword [r14]
cmp esi, dword [rax - 0xc]
jg 0x14000349f
mov dword [rax - 0x10], esi
mov rax, qword [r14]
mov word [rax + rbx*2], cx
jmp 0x140003476
xor ecx, ecx
mov ebp, ecx
mov rbx, qword [rsp + 0x30]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.140026cfc
int3
call fcn.140026d20
int3
mov ecx, 0x80070057
call fcn.140002d20
int3
Function at 0x1400047e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
mov rdi, rcx
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], ebx
lea r8, [rsp + 0x30]
mov dword [rsp + 0x68], ebx
lea rdx, str.SOFTWAREConexantMicTrayBackVolume
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400048dd
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.InternalSpkVolumeL
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.InternalSpkVolumeR
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400048cd
movd xmm1, dword [rsp + 0x60]
lea r9d, [rbx + 1]
movd xmm2, dword [rsp + 0x68]
mov rcx, rdi
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [0x1401e1384]
mulss xmm2, dword [0x1401e1384]
call fcn.140004160
test eax, eax
je 0x1400048c8
mov r8d, eax
lea rdx, str.SetMultiStreamBackupBothChannelVolume_Failed_to_set_Volume_0x_x_n
lea ecx, [rbx + 5]
call fcn.140002ae0
jmp 0x1400048cd
mov ebx, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400048dd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400048f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rbp + 0x47], rax
cmp dword [0x14029b260], 0
mov rsi, rcx
jne 0x140004923
xor eax, eax
jmp 0x140004ab8
mov rcx, qword [rcx + 0x10]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0xa8], rbx
xor r9d, r9d
xor ebx, ebx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x2206b8
lea rax, [rbp + 0x27]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x1f], ebx
mov dword [rbp + 0x27], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140004a95
cmp dword [rbp + 0x27], ebx
je 0x140004988
lea edi, [rbx + 1]
lea rdx, str._Headphone_On__n
jmp 0x140004991
mov edi, ebx
lea rdx, str._Headphone_Off__n
mov ecx, 5
call fcn.140002ae0
lea r8, [rbp + 0x17]
mov qword [rbp + 0x17], rbx
lea rdx, str.SOFTWAREConexantMicTrayBackVolume
mov dword [rbp + 0xb], ebx
mov rcx, 0xffffffff80000002
mov dword [rbp + 0xf], ebx
mov dword [rbp + 7], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140004aa6
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0xb]
mov qword [rsp + 0x20], rax
test edi, edi
je 0x140004a03
lea rdx, str.InternalHPVolumeL
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.InternalHPVolumeR
jmp 0x140004a17
lea rdx, str.InternalSpkVolumeL
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.InternalSpkVolumeR
mov rcx, qword [rbp + 0x17]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0xf]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004a84
movd xmm1, dword [rbp + 0xb]
mov rcx, rsi
movd xmm2, dword [rbp + 0xf]
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [0x1401e1384]
mulss xmm2, dword [0x1401e1384]
call fcn.140003d20
test eax, eax
je 0x140004a7f
mov r8d, eax
lea rdx, str.SetClassicBackupBothChannelVolume_Failed_to_set_Volume_0x_x_n
mov ecx, 5
call fcn.140002ae0
jmp 0x140004a84
mov ebx, 1
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140004aa6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004aa6
lea rdx, str._IOCTL_MAXXAUDIO_GET_CURRENT_STATE_break__n
mov ecx, 5
call fcn.140002ae0
mov rdi, qword [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401a6080
mov rsi, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
Function at 0x140004f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x8070
call fcn.1401a60e0
sub rsp, rax
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x8060], rax
mov rbx, rcx
lea rdx, str.GetSettingsFromRegistry_n
mov ecx, 5
call fcn.140002ae0
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [rbx + 0xf8], rax
lea rdx, str.SOFTWAREConexantMicTrayHotkeyPNPID
mov qword [rbx + 0x100], rax
xor esi, esi
mov qword [rbx + 0x108], rax
mov rcx, 0xffffffff80000002
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x120], rax
mov qword [rbx + 0x128], rax
mov qword [rbx + 0x130], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r8d, eax
lea rdx, str.RegOpenKey_is__d
lea ecx, [rsi + 5]
mov edi, eax
call fcn.140002ae0
test edi, edi
jne 0x14000512a
xor edx, edx
mov dword [rsp + 0x48], 4
mov r8d, 0x7ffe
lea rcx, [rsp + 0x60]
call fcn.1401ab280
mov edx, dword [rbx + 0x138]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 0x3fff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x14000511a
nop dword [rax]
mov r8d, dword [rsp + 0x40]
lea rdx, str.PNPID_is_HI__x__LO__x
movzx r9d, r8w
mov ecx, 5
shr r8d, 0x10
call fcn.140002ae0
mov ecx, dword [rbx + 0x138]
lea rdx, str.TotalPNPID_num_is__d
mov eax, dword [rsp + 0x40]
mov dword [rbx + rcx*4 + 0xf8], eax
mov ecx, 5
inc dword [rbx + 0x138]
mov r8d, dword [rbx + 0x138]
call fcn.140002ae0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x7ffe
call fcn.1401ab280
mov edx, dword [rbx + 0x138]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 0x3fff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
je 0x140005070
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000512a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x8060]
xor rcx, rsp
call fcn.1401a6080
lea r11, [rsp + 0x8070]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140005e00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
cmp rdx, 0xffffffffffffffff
jne 0x140005e23
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor edx, edx
mov qword [rsp + 0x48], rdi
mov r8d, 0x80
mov qword [rsp + 0x50], r14
lea rdi, [rcx + 0x58]
xor r14d, r14d
mov qword [rcx + 0x58], r14
mov qword [rcx + 0x60], r14
add rcx, 0x78
call fcn.1401ab280
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x68], r14
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8d, 0x80
lea rdx, [rsi + 0x78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov byte [rsi + 0x4a], 1
test eax, eax
jne 0x140005ee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x3e5
lea rdx, str.HID_is_submitted_to_queue._Error_0x_x__ERROR_IO_PENDING_0x_x_n
mov r8d, eax
mov ecx, 5
mov ebx, eax
call fcn.140002ae0
cmp ebx, 0x3e5
je 0x140005ee1
mov r8d, ebx
lea rdx, str.HID_is_submitted_to_queue._Error_0x_x_n
mov ecx, 5
call fcn.140002ae0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret

Function at 0x140005f00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov ebx, r9d
mov rbp, r8
xor r9d, r9d
mov rsi, rdx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x30], 0
xorps xmm0, xmm0
mov qword [rsp + 0x48], rax
mov rdi, rax
movdqu xmmword [rsp + 0x38], xmm0
cmp rsi, 0xffffffffffffffff
jne 0x140005f65
lea rdx, str.HIDLED_deviceHandle_is_invalid_n
lea ecx, [rsi + 6]
call fcn.140002ae0
xor eax, eax
jmp 0x140005ff7
lea rax, [rsp + 0x30]
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, ebx
lea rdx, str.HIDLED_WriteData_Size__d_n
mov ecx, 5
mov esi, eax
call fcn.140002ae0
test esi, esi
je 0x140005fba
lea rdx, str.WriteData:_success_n
mov ecx, 5
call fcn.140002ae0
mov edx, 0x3e8
lea rbx, str.WriteData:_success_ret_0x_x_n
jmp 0x140005fdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140005fd0
lea rbx, str.WriteData_failed___08X__n
jmp 0x140005fe5
lea rbx, str.WriteData:_success_asynchronously_ret_0x_x_n
mov edx, 0xc8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, eax
mov rdx, rbx
mov ecx, 5
call fcn.140002ae0
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret