joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b8510
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x140303c78], eax
inc eax
cmp eax, 1
jne 0x1400b855d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140303c7c], eax
test dil, dil
je 0x1400b8570
xor eax, eax
lock xadd dword [0x140303c7c], eax
test eax, eax
jne 0x1400b8594
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
lea rdx, str.winsock
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0
call fcn.1400776e0
int3

Function at 0x1400d9e60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, r8d
mov ebx, edx
sub r11d, edx
jne 0x1400d9e78
mov eax, edx
add rsp, 0x20
pop rbx
ret
cmp r11d, 0xffffffff
jne 0x1400d9e8b
call fcn.1400da680
add eax, ebx
add rsp, 0x20
pop rbx
ret
lea r8d, [r11 + 1]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov eax, 0xffffffff
div r8d
mov r8, qword [rcx + 0x9c0]
cmp edx, r11d
lea edi, [rax + 1]
cmovne edi, eax
nop
cmp r8, 0x270
jne 0x1400d9ec5
call fcn.1400dca50
mov r8, qword [rcx + 0x9c0]
mov edx, dword [rcx + r8*4]
mov eax, edx
shr eax, 0xb
inc r8
xor edx, eax
mov qword [rcx + 0x9c0], r8
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
xor edx, edx
div edi
cmp eax, r11d
ja 0x1400d9eb0
mov rdi, qword [rsp + 0x30]
add eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400da680
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x9c0]
cmp rax, 0x270
jne 0x1400da69f
call fcn.1400dca50
mov rax, qword [rcx + 0x9c0]
mov edx, dword [rcx + rax*4]
inc rax
mov qword [rcx + 0x9c0], rax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x28
ret
Function at 0x1400dca50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
xor r8d, r8d
cmp dword [0x1402f2098], 2
jl 0x1400dcb10
movdqa xmm4, xmmword [0x14028a030]
mov eax, 1
movdqa xmm5, xmmword [0x14028a060]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqa xmm7, xmmword [0x14028a070]
movaps xmmword [rsp], xmm8
movdqa xmm8, xmmword [0x140289e20]
movd xmm6, eax
nop dword [rax]
movdqu xmm2, xmmword [rcx + r8*4 + 4]
movdqu xmm0, xmmword [rcx + r8*4]
movdqa xmm3, xmm4
movdqa xmm1, xmm5
pand xmm1, xmm0
pand xmm3, xmm2
por xmm3, xmm1
movdqa xmm0, xmm8
pand xmm0, xmm2
psrld xmm3, xmm6
pmulld xmm0, xmm7
pxor xmm3, xmm0
movdqu xmm0, xmmword [rcx + r8*4 + 0x634]
pxor xmm3, xmm0
movdqu xmmword [rcx + r8*4], xmm3
add r8, 4
cmp r8, 0xdc
jb 0x1400dcaa0
movaps xmm8, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm6, xmmword [rsp + 0x20]
cmp r8, 0xde
jae 0x1400dcb50
mov eax, dword [rcx + r8*4 + 4]
mov edx, eax
xor edx, dword [rcx + r8*4]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + r8*4]
shr edx, 1
xor edx, eax
xor edx, dword [rcx + r8*4 + 0x634]
mov dword [rcx + r8*4], edx
inc r8
cmp r8, 0xde
jb 0x1400dcb10
nop word [rax + rax]
mov r9d, dword [rcx + 0x37c]
mov eax, r9d
mov r10d, dword [rcx + 0x380]
and eax, 1
mov r8d, dword [rcx + 0x378]
xor r8d, r9d
imul edx, eax, 0x9908b0df
and r8d, 0x7ffffffe
mov eax, r10d
xor r8d, dword [rcx + 0x378]
and eax, 1
shr r8d, 1
xor r8d, edx
imul edx, eax, 0x9908b0df
xor r8d, dword [rcx + 0x9ac]
mov dword [rcx + 0x378], r8d
mov r8d, r10d
xor r8d, r9d
and r8d, 0x7ffffffe
xor r8d, r9d
mov r9d, dword [rcx + 0x384]
shr r8d, 1
mov eax, r9d
xor r8d, edx
and eax, 1
xor r8d, dword [rcx + 0x9b0]
mov dword [rcx + 0x37c], r8d
mov r8d, r9d
xor r8d, r10d
imul edx, eax, 0x9908b0df
and r8d, 0x7ffffffe
xor r8d, r10d
mov r10d, dword [rcx + 0x388]
shr r8d, 1
mov eax, r10d
and eax, 1
xor r8d, edx
imul edx, eax, 0x9908b0df
xor r8d, dword [rcx + 0x9b4]
mov eax, dword [rcx + 0x38c]
mov dword [rcx + 0x380], r8d
mov r8d, r10d
xor r8d, r9d
and r8d, 0x7ffffffe
xor r8d, r9d
shr r8d, 1
xor r8d, edx
mov edx, eax
xor r8d, dword [rcx + 0x9b8]
xor edx, r10d
and edx, 0x7ffffffe
mov dword [rcx + 0x384], r8d
xor edx, r10d
and eax, 1
imul eax, eax, 0x9908b0df
mov r8d, 0xe3
shr edx, 1
xor edx, eax
xor edx, dword [rcx + 0x9bc]
mov dword [rcx + 0x388], edx
nop word [rax + rax]
mov eax, dword [rcx + r8*4 + 4]
mov edx, eax
xor edx, dword [rcx + r8*4]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + r8*4]
shr edx, 1
xor edx, eax
xor edx, dword [rcx + r8*4 - 0x38c]
mov dword [rcx + r8*4], edx
inc r8
cmp r8, 0x26f
jb 0x1400dcc70
mov eax, dword [rcx]
mov edx, eax
xor edx, dword [rcx + 0x9bc]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + 0x9bc]
shr edx, 1
mov qword [rcx + 0x9c0], 0
xor edx, eax
xor edx, dword [rcx + 0x630]
mov dword [rcx + 0x9bc], edx
add rsp, 0x38
ret
Function at 0x1400e5d50
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rcx
movdqa xmm0, xmmword [0x140289e10]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 7
lea rdx, str.MicGain
lea rcx, [r11 - 0x40]
call fcn.140025820
mov rdi, qword [rbp + 0x108]
mov rbx, qword [rdi + 8]
mov rsi, rdi
cmp byte [rbx + 0x19], 0
jne 0x1400e5de5
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x68]
call fcn.1400745c0
test al, al
je 0x1400e5dd9
mov rbx, qword [rbx + 0x10]
jmp 0x1400e5ddf
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400e5dc1
cmp rdi, rsi
je 0x1400e5dfc
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400745c0
test al, al
je 0x1400e5dff
mov rdi, rsi
lea rcx, [rsp + 0x68]
call fcn.1400168e0
cmp rdi, qword [rbp + 0x108]
je 0x1400e5f07
lea rdx, [rdi + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140016350
nop
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call fcn.14017d424
imul edi, eax, 0x64
mov dword [rsp + 0x60], edi
mov ebx, 0x80004005
xor ecx, ecx
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSpeech_OneCoreAudioInputMicWiz
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400e5ed2
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DefaultDefaultMicGain
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
sete bl
lea rcx, [rbp + 0xb0]
mov dword [rsp + 0x20], edi
lea r9, str.Write_registry:_MicGain___d
movzx r8d, bl
mov edx, 1
call fcn.1400e4380
nop
lea rcx, [rsp + 0x68]
call fcn.1400168e0
movzx eax, bl
jmp 0x1400e5f09
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400e7020
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, qword [rdx]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov rsi, rdx
mov ebx, 0x80004005
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
test rdi, rdi
jne 0x1400e70b1
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x38], rcx
lea rcx, [r11 - 0x20]
mov qword [r11 - 0x40], rcx
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400e7131
lea rdx, str.MaxxAudioFXLib
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
jmp 0x1400e7129
lea rcx, [rsp + 0x64]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
cmp qword [rsp + 0x50], 0
je 0x1400e7131
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.MaxxAudioFXLib
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rdx, qword [rsi]
test ebx, ebx
mov ecx, 0xffffffff
sete bl
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400e7156
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400e8170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor esi, esi
mov dword [rsp + 0x28], 0x20019
mov rdi, rcx
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rsi
lea r8, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x20], esi
call fcn.14001f840
test eax, eax
jne 0x1400e820e
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MaxxAudioGUIType
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e820e
cmp dword [rsp + 0x48], 4
je 0x1400e8273
mov dword [rsp + 0x28], 0x20019
lea r8, str.SoftwareConexant
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x20], esi
call fcn.14001f840
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1400e8291
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MaxxAudioGUIType
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e8291
cmp dword [rsp + 0x50], 4
jne 0x1400e8291
movzx esi, byte [rsp + 0x40]
test rbx, rbx
je 0x1400e8286
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp sil, 2
je 0x1400e829f
jmp 0x1400e834e
test rbx, rbx
je 0x1400e829f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r9d, 2
lea r8, str.SoundMode_COMMUNICATION_Render
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
mov r9d, 3
lea r8, str.SoundMode_NOTIFICATION_Render
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
mov r9d, 1
lea r8, str.SoundMode_MEDIA_Render
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
xor r9d, r9d
lea r8, str.SoundMode_MOVIE_Render
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
xor r9d, r9d
lea r8, str.SoundMode_COMMUNICATION_Capture
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
mov r9d, 7
lea r8, str.SoundMode_SPEECH_Capture
mov rcx, rdi
call fcn.1400e80f0
test al, al
je 0x1400e834e
mov edx, 1
lea rcx, [rdi + 0xb0]
mov r8d, edx
lea r9, str.Write_ProcessMode_SoundMode_Mapping_registry
call fcn.1400e4380
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400ec380
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, qword [rcx + 0x140]
xor esi, esi
mov rdi, rcx
cmp dword [rbx - 0x10], esi
je 0x1400ec456
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x38], rax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
lea rax, [r11 - 0x28]
xor r9d, r9d
mov qword [r11 - 0x40], rax
xor r8d, r8d
mov qword [r11 - 0x48], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test rbx, rbx
jne 0x1400ec410
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ec456
lea rdx, str.JackSense
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
jmp 0x1400ec44b
cmp qword [rsp + 0x50], rsi
je 0x1400ec456
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.JackSense
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp qword [rdi + 0x150], rsi
je 0x1400ec4f8
mov rax, qword [rdi + 0x148]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400ec4f8
nop word [rax + rax]
mov r9d, dword [rbx + 0x28]
lea rdx, str.SOFTWAREWaves_AudioDellOptimizer
mov r8, qword [rbx + 0x20]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call fcn.14001fd70
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], sil
je 0x1400ec4cb
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], sil
jne 0x1400ec4c6
cmp rbx, qword [rax + 0x10]
jne 0x1400ec4c6
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], sil
je 0x1400ec4b3
mov rbx, rax
jmp 0x1400ec4ef
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], sil
jne 0x1400ec4ef
nop word [rax + rax]
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], sil
je 0x1400ec4e0
cmp rbx, qword [rdi + 0x148]
jne 0x1400ec480
cmp byte [rdi + 0x158], sil
je 0x1400ec58e
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400ec58e
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DoNotShowJackSenseDialog
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400efb20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x30], rcx
lea rax, vtable.CNXHelper.0
mov qword [rcx], rax
lea rbx, [rcx + 8]
mov qword [rsp + 0x48], rbx
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.140016e10
mov qword [rbx], rax
mov dword [rdi + 0x18], 2
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.140027c30
mov qword [rbx], rax
lea rbx, [rdi + 0x30]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.140027c30
mov qword [rbx], rax
mov byte [rdi + 0x40], sil
mov dword [rsp + 0x40], 2
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400efc27
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.MaxNXModules
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [rsp + 0x40]
mov dword [rdi + 0x18], ecx
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400fa270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor eax, eax
xor bl, bl
mov qword [rsp + 0x20], rax
mov rdi, rdx
test rcx, rcx
je 0x1400fa32f
cmp ax, word [rcx]
je 0x1400fa32f
mov rdx, rcx
lea r8, [0x140250704]
lea rcx, [rsp + 0x20]
call fcn.140172924
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400fa32f
xor edx, edx
mov qword [rsp + 0x50], rsi
lea r8d, [rdx + 2]
call fcn.14019cea8
mov rcx, qword [rsp + 0x20]
call fcn.14019cc88
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
movsxd rsi, eax
call fcn.14019cea8
test esi, esi
jle 0x1400fa320
mov rdx, rsi
mov rcx, rdi
mov rbx, rsi
call fcn.140021800
mov r9, qword [rsp + 0x20]
mov r8d, 1
mov rcx, qword [rdi]
mov rdx, rsi
call fcn.1401810a0
cmp rax, 1
sete bl
mov rcx, qword [rsp + 0x20]
call fcn.140172a0c
mov rsi, qword [rsp + 0x50]
movzx eax, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fa350
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor bpl, bpl
xor r12d, r12d
mov qword [rsp + 0x28], r12
lea rax, [0x140250710]
lea rbx, [0x140250718]
test r9b, r9b
cmovne rbx, rax
call fcn.140015450
mov rcx, rax
test rax, rax
je 0x1400fa480
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400165c0
lea rdi, [r12 - 1]
test al, al
jne 0x1400fa3fb
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400fa3e0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016ed0
nop
mov rbx, qword [rsp + 0x30]
test rsi, rsi
je 0x1400fa41b
cmp r12w, word [rsi]
je 0x1400fa41b
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140172924
mov r9, qword [rsp + 0x28]
test r9, r9
je 0x1400fa448
mov rdx, r15
mov r8d, 1
mov rcx, r14
call fcn.1401806e0
cmp rax, 1
sete bpl
mov rcx, qword [rsp + 0x28]
call fcn.140172a0c
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400fa460
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, bpl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140146480
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.1400151f0
int3
Function at 0x1400fd360
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xor eax, eax
mov qword [rdx], rax
lea rdx, [0x14022a4b0]
mov rcx, rbx
call fcn.140016290
mov edi, 1
mov dword [rsp + 0x30], edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400fd48d
mov dword [rsp + 0x48], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.NxCurrentCamera
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x48]
test edx, edx
je 0x1400fd48d
js 0x1400fd4ad
mov rax, qword [rbx]
sub edi, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or edi, ecx
jge 0x1400fd414
mov rcx, rbx
call fcn.140017100
mov rdi, qword [rbx]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.NxCurrentCamera
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400fd446
test rax, rax
je 0x1400fd45f
mov eax, dword [rsp + 0x48]
dec eax
mov word [rdi + rax*2], bp
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400fd46b
mov eax, ebp
jmp 0x1400fd478
movsxd rdx, dword [rcx - 0xc]
call fcn.140172bb4
test eax, eax
js 0x1400fd4b8
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400fd4b8
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400151f0
int3
mov ecx, 0x80070057
call fcn.1400151f0
int3

Function at 0x1400fd4d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400fd533
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbx + 0x20]
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fe840
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 4]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400fe900
lea r8d, [rbx + 4]
mov qword [rsp + 0x80], rsi
lea rdx, str.IntelAudioService
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400fe8ef
xor eax, eax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
lea r9d, [rbx + 0x24]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x38]
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x50], rax
mov rcx, rsi
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400fe8e6
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove ebx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x80]
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140146480
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret