Function at 0x180047fc0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1800a0040]
xor rax, rsp
mov qword [rbp + 0x168], rax
mov qword [rbp - 0x50], rdx
mov r13, rcx
mov qword [rbp + 0x50], rdx
mov dword [rsp + 0x40], 1
xor ebx, ebx
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
mov dword [rsp + 0x40], 1
lea ecx, [rbx + 0x20]
call fcn.1800506b0
mov rcx, rax
movups xmm0, xmmword [str.ChromeHook_GetAudioPid]
movups xmmword [rax], xmm0
mov eax, dword [0x1800906b0]
mov dword [rcx + 0x10], eax
movzx eax, word [0x1800906b4]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], bl
lea edx, [rbx + 0x20]
call fcn.180050b2c
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], rbx
lea r8d, [rbx + 0x2b]
lea rdx, str.__utility_sub_typeaudio.mojom.AudioService
lea rcx, [rbp + 0xd8]
call fcn.1800066c0
nop
lea rax, [rbp - 0x28]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
lea r15, [rbp + 0xd8]
mov rsi, qword [rbp + 0xd8]
mov r14, qword [rbp + 0xf0]
cmp r14, 7
cmova r15, rsi
movabs rbx, 0x7ffffffffffffffe
mov rdi, qword [rbp + 0xe8]
cmp rdi, rbx
ja 0x180048b17
cmp rdi, 7
ja 0x1800480e7
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x28], xmm0
jmp 0x18004813b
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x180048102
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rax, [rbx + 1]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x28]
call fcn.180006ae0
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rbx
lea r8, [rdi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.18007a3d0
nop
mov ecx, dword [r13 + 0x70]
test ecx, ecx
je 0x18004814c
cmp ecx, 1
lea rdx, [r13 + 0x28]
je 0x180048150
lea rdx, [r13 + 8]
lea rcx, [rbp + 0x128]
call fcn.180006250
mov dword [rsp + 0x40], 5
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x128]
lea rcx, [rsp + 0x78]
call fcn.180046560
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 7
jbe 0x1800481c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800481bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b1d
call fcn.180050b2c
mov r8, qword [rsp + 0x78]
xor r15d, r15d
cmp r8, qword [rbp - 0x80]
je 0x180048a6b
mov qword [rbp - 0x70], r15
mov qword [rbp + 0xfc], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x70]
lea edx, [r15 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180048a66
mov dword [rbp + 0xf8], 1
mov dword [rbp + 0x104], 2
lea r8, [rbp + 0xfc]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18004824a
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0xf8]
xor edx, edx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x78]
mov r12d, dword [rax + 8]
mov ecx, 0x20
call fcn.1800506b0
mov rcx, rax
movups xmm0, xmmword [str.ChromeHook_GetAudioSyncPipes]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800907a0]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x1800907a8]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], r15b
mov edx, 0x20
call fcn.180050b2c
mov ecx, dword [r13 + 0x70]
test ecx, ecx
je 0x1800482b2
cmp ecx, 1
jne 0x1800482b2
lea r8d, [rcx + 3]
lea rdx, str.edge
jmp 0x1800482bf
mov r8d, 6
lea rdx, str.chrome
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
lea rcx, [rbp - 8]
call fcn.1800066c0
mov edi, 0x25
mov dword [rsp + 0x40], edi
lea r8, [rbp - 8]
mov edx, r12d
lea rcx, [rsp + 0x48]
call fcn.180047b00
nop
mov rbx, qword [r13 + 0x60]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x18004843a
mov rsi, qword [rbx + 0x40]
mov r15, qword [rbx + 0x48]
cmp rsi, r15
je 0x1800483cf
mov rax, qword [rsi]
movzx ecx, byte [rax + 8]
test cl, cl
je 0x18004835b
mov rcx, qword [rsi]
mov rax, qword [rcx]
lea rdx, [rbp + 0x148]
call qword [rax + select]
nop
mov edi, dword [rsp + 0x40]
or edi, 2
mov dword [rsp + 0x40], edi
mov r8, rax
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.18004a1b0
mov rcx, qword [rax]
cmp qword [rcx + 0x40], 0
jne 0x18004835f
mov r14b, 1
jmp 0x180048362
mov edi, dword [rsp + 0x40]
xor r14b, r14b
test dil, 2
je 0x1800483b5
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x160]
cmp rdx, 7
jbe 0x1800483b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800483b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b23
call fcn.180050b2c
test r14b, r14b
je 0x1800483c2
mov rcx, qword [rsi]
call fcn.180044e70
add rsi, 0x10
cmp rsi, r15
jne 0x180048314
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800483fb
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800483f6
cmp rbx, qword [rax + 0x10]
jne 0x1800483f6
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800483e3
mov rbx, rax
jmp 0x18004841f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18004841f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x180048410
cmp byte [rbx + 0x19], 0
je 0x180048303
mov r14, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0xd8]
xor r15d, r15d
cmp qword [rsp + 0x50], 0
jne 0x180048545
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18004a880
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
call fcn.180050b2c
nop
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x1800484db
mov rcx, qword [rbp - 0x78]
movabs rax, 0x73615a240e6c2b45
sub rcx, r8
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
cmp rdx, 0x1000
mov rax, r8
jb 0x1800484c6
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b0b
mov rcx, r8
call fcn.180050b2c
mov qword [rbp - 0x78], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
cmp r14, 7
jbe 0x180048517
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18004850e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b11
mov rcx, rsi
call fcn.180050b2c
nop
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x168]
xor rcx, rsp
call fcn.180050570
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x20
call fcn.1800506b0
mov rcx, rax
movups xmm0, xmmword [str.ChromeHook_GetAudioRenderers]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800907c0]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x1800907c8]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0
mov edx, 0x20
call fcn.180050b2c
lea rax, [rbp + 0x58]
mov qword [rbp + 0x38], rax
mov ecx, dword [r13 + 0x70]
test ecx, ecx
je 0x180048599
cmp ecx, 1
lea rdx, [r13 + 0x28]
je 0x18004859d
lea rdx, [r13 + 8]
lea rcx, [rbp + 0x58]
call fcn.180006250
or edi, 0x10
mov dword [rsp + 0x40], edi
mov ecx, dword [r13 + 0x70]
test ecx, ecx
je 0x1800485c7
cmp ecx, 1
jne 0x1800485c7
lea r8d, [rcx + 3]
lea rdx, str.edge
jmp 0x1800485d4
mov r8d, 6
lea rdx, str.chrome
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
lea rcx, [rbp + 0x18]
call fcn.1800066c0
or edi, 8
mov dword [rsp + 0x40], edi
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x18]
mov edx, r12d
lea rcx, [rbp - 0x40]
call fcn.180046b40
nop
mov rax, qword [rbp - 0x38]
cmp qword [rbp - 0x40], rax
jne 0x180048620
lea rcx, [rbp - 0x40]
call fcn.180018100
jmp 0x180048446
mov ecx, 0x20
call fcn.1800506b0
mov rcx, rax
movups xmm0, xmmword [str.ChromeHook_FilterAudioRenderers]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180090770]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x180090778]
mov dword [rcx + 0x18], eax
movzx eax, word [0x18009077c]
mov word [rcx + 0x1c], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rcx + 0x1e], al
mov byte [rcx + 0x1f], 0
mov edx, 0x20
call fcn.180050b2c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
sub rax, rdx
sar rax, 4
test rax, rax
je 0x180048953
xor eax, eax
mov r14d, eax
mov rax, qword [rdx + r14 + 8]
test rax, rax
je 0x1800486a4
lock inc dword [rax + 8]
mov rdi, qword [rdx + r14]
mov qword [rsp + 0x60], rdi
mov rax, qword [rdx + r14 + 8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
test rax, rax
je 0x1800486cd
lock inc dword [rax + 8]
mov rdi, qword [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x40], xmm0
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.180048b30
nop
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x180048702
movzx eax, byte [rax + 8]
mov rdi, qword [rsp + 0x60]
test al, al
je 0x180048702
mov bl, 1
jmp 0x180048704
xor bl, bl
mov rax, qword [rdi]
lea rdx, [rbp + 0x108]
mov rcx, rdi
call qword [rax + select]
nop
mov r8, rax
lea rdx, [rbp + 0x88]
lea rcx, [rsp + 0x48]
call fcn.18004a1b0
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x40]
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x180048776
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180048771
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b29
call fcn.180050b2c
xor eax, eax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], 7
mov word [rbp + 0x108], ax
test bl, bl
jne 0x18004889c
test rsi, rsi
je 0x18004889c
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x70]
mov r8, r12
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1800488a5
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x1800487ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x1800487fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xb8], rbx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x18004886f
mov qword [rdi + 0xb0], rax
mov r9, qword [rbp - 0x50]
mov rdx, qword [r9 + 8]
cmp rdx, qword [r9 + 0x10]
je 0x180048860
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18004884d
lock inc dword [rcx + 8]
mov rdi, qword [rsp + 0x60]
mov qword [rdx], rdi
mov rax, qword [rsp + 0x68]
mov qword [rdx + 8], rax
add qword [r9 + 8], 0x10
jmp 0x1800488a5
lea r8, [rsp + 0x60]
mov rcx, r9
call fcn.18001b960
jmp 0x1800488a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Audio_sync_port_creation_failed:
lea rcx, [0x1800a2b90]
call fcn.18000f6f0
mov edx, ebx
mov rcx, rax
call fcn.180026410
mov rcx, rax
call fcn.18000fa00
mov rcx, rdi
call fcn.180044e70
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1800488e3
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1800488e3
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800488e3
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180048923
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180048923
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180048923
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc r15d
add r14, 0x10
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
sub rcx, rdx
sar rcx, 4
movsxd rax, r15d
cmp rax, rcx
jb 0x180048696
mov r14, qword [rbp + 0xf0]
mov rsi, qword [rbp + 0xd8]
mov rbx, qword [rsp + 0x48]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1800489c5
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x180048970
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18004899c
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x180048997
cmp rbx, qword [rax + 0x10]
jne 0x180048997
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x180048984
mov rbx, rax
jmp 0x1800489bf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1800489bf
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1800489b0
cmp byte [rbx + 0x19], 0
je 0x180048961
lea rcx, [rbp - 0x40]
call fcn.180018100
nop
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18004a880
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
call fcn.180050b2c
nop
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x1800484db
mov rcx, qword [rbp - 0x78]
sub rcx, r8
movabs rax, 0x73615a240e6c2b45
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, r8
cmp rdx, 0x1000
jb 0x180048a53
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b0b
mov rcx, r8
call fcn.180050b2c
xor eax, eax
mov qword [rbp - 0x78], rax
jmp 0x1800484d2
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x180048acf
mov rcx, qword [rbp - 0x78]
sub rcx, r8
movabs rax, 0x73615a240e6c2b45
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, r8
cmp rdx, 0x1000
jb 0x180048aba
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b0b
mov rcx, r8
call fcn.180050b2c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
cmp r14, 7
jbe 0x180048517
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18004850e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048b11
jmp 0x18004850e
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.180004ad0
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
int3