joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4930
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x30], rcx
lea rax, vtable.CSimpleOrientationSensorManagerEvents.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], SafeArrayUnaccessData
mov dword [rcx + 0x58], ebp
mov dword [rcx + 0x5c], 0xa
mov qword [rcx + 0x60], rbp
mov qword [rcx + 0x68], rbp
mov dword [rcx + 0x3c], 0x3f400000
mov dword [rcx + 0x40], 0x3e800000
mov dword [rcx + 0x44], 0x40100000
xor ecx, ecx
movss xmm1, dword [0x140165cc0]
movabs rdx, 0x8000000000000000
movss xmm0, dword [0x140165cf0]
comiss xmm1, xmm0
jb 0x1400b49d5
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400b49d5
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
mov qword [rdi + 0x48], rax
xor ecx, ecx
movss xmm1, dword [0x140165c68]
comiss xmm1, xmm0
jb 0x1400b49fc
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400b49fc
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
cmp rax, 0x11
cmovb rax, rbp
mov qword [rdi + 0x50], rax
mov dword [rdi + 8], ebp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0xc], 1
mov ecx, pe_nt_image_headers64
call fcn.1400ce83c
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400d54b0
mov r8, rdi
mov rcx, rbx
call fcn.1400bce90
nop
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x78], rbp
mov qword [rdi + 0x80], rbp
mov qword [rdi + 0x88], rbp
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.1.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.2.0
mov qword [rbx], rax
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov r8d, 0xa
lea rdx, str.CSensorsMgr::CSensorsMgr
lea rcx, [0x140114db0]
call fcn.140064950
mov qword [rsp + 0x40], rbx
call fcn.140099a60
mov rsi, rax
test rbx, rbx
je 0x1400b4b15
lea rcx, [rax + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rsi + 0xc8]
mov rax, qword [rcx]
test rax, rax
je 0x1400b4afe
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400b4b08
mov rax, qword [rax]
test rax, rax
jne 0x1400b4af0
lea rdx, [rsp + 0x40]
call fcn.140007280
lea rcx, [rsi + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x1400b5060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ce210
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400bb710
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.140084fd0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e6
lea rcx, str._s__d_hadRun_d
call fcn.140064950
cmp dword [rsp + 0x40], 1
jne 0x1400bb869
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e9
lea rcx, str._s__d_hadRun_d
call fcn.140064950
call fcn.14000b9e0
mov rcx, rax
call fcn.140094f30
call fcn.14000b9e0
mov rcx, rax
call fcn.140094ed0
mov rbx, rax
test rbx, rbx
je 0x1400bb857
call fcn.14000b9e0
call fcn.14000b9e0
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400bb7a6
cmp dword [rcx + 0x1ac], 1
jne 0x1400bb7a6
add rcx, 0xc8
mov qword [rsp + 0x48], rdi
call fcn.140010630
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.140084fd0
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2f6
lea rcx, str._s__d_bMuted_d
call fcn.140064950
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
call qword [r9 + 0x10]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.140085100
mov rdi, qword [rsp + 0x48]
call fcn.14000b9e0
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.140094fb0
add rsp, 0x30
pop rbx
ret

Function at 0x1400bc350
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400bc3d6
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ce210
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bc400
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14002be50
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400bc4a9
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ce210
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400bc730
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400bc783
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400bc861
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400bc85f
cmp eax, 3
jne 0x1400bc7e8
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400bc778
cmp dword [rsp + 0x3c], 1
je 0x1400bc85f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400bc87c
cmp dword [rsp + 0x3c], 3
je 0x1400bc795
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400bc778
cmp dword [rsp + 0x3c], 1
je 0x1400bc85f
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400bc778
cmp dword [rsp + 0x3c], 1
je 0x1400bc85f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400bc87c
cmp dword [rsp + 0x3c], 1
jne 0x1400bc810
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ce210
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400bc861
Function at 0x1400bcda0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.140064950
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400bce20]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ce210
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400bda40
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400bdacb
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce210
add rsp, 0x58
ret
Function at 0x1400c25d0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
cmp edx, 0x20
jb 0x1400c25fb
mov r8d, 0x291
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.140064950
call fcn.14002c780
lea rcx, [rax + 0x10]
call fcn.140048b70
call fcn.14002c780
mov rcx, rax
mov edx, ebx
call fcn.140068230
mov ebx, eax
call fcn.14002c780
mov edx, 0xffffffff
lock xadd dword [rax + 0x28], edx
mov edx, dword [rax + 0x28]
test edx, edx
jne 0x1400c263c
mov rcx, qword [rax + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400c265d
mov eax, dword [rax + 0x28]
cmp eax, 0x32
jle 0x1400c265d
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.140064950
mov r8d, 0x298
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140114db0]
call fcn.140064950
cmp dword [0x1401a4e98], 0
je 0x1400c26cd
test ebx, ebx
je 0x1400c2750
xor edx, edx
lea rcx, [0x140114aa8]
call fcn.1400c1090
call fcn.14005ab10
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x108]
test eax, eax
je 0x1400c26cd
mov r8d, 0x2ac
mov dword [0x1401a4e98], 0
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, [0x140114db0]
call fcn.140064950
test ebx, ebx
je 0x1400c274a
call fcn.1400c1750
mov r9d, eax
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
mov r8d, 0x2bc
lea rcx, str._s__d__bCheckIfUWPIsInstalled___d
mov ebx, eax
call fcn.140064950
test ebx, ebx
je 0x1400c274a
mov r8d, 0x2bf
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_SET_PING_UWP_WHILE_PLUG_IN_EVENT_HAPPENED_2s_later
call fcn.140064950
mov dword [0x1401a4ee0], 0xa
call fcn.14000bb60
mov rcx, rax
mov edx, 0x40c
call fcn.1400c3be0
call fcn.14000bb60
mov rcx, rax
mov edx, 0x40c
mov r8d, 0x7d0
add rsp, 0x20
pop rbx
jmp fcn.1400c39b0
add rsp, 0x20
pop rbx
ret
call fcn.14005ab10
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x88]
test eax, eax
jne 0x1400c274a
mov edx, 0x2000000
lea rcx, str._Ping
add rsp, 0x20
pop rbx
jmp fcn.1400c1090
Function at 0x1400c3f00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x12c], 0
mov r14, rcx
jne 0x1400c410f
nop dword [rax]
mov ecx, dword [r14 + 0x130]
lea rdx, [r14 + 0x138]
mov r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x1400c4101
cmp qword [r14 + 0xe8], 0
je 0x1400c4101
mov edx, dword [r14 + 0xf0]
xor ecx, ecx
test edx, edx
je 0x1400c3f8f
mov r9, qword [r14 + 0xe0]
nop dword [rax]
mov r8, qword [r9 + rcx*8]
test r8, r8
jne 0x1400c3fa0
inc ecx
cmp ecx, edx
jb 0x1400c3f80
xor r8d, r8d
test r8, r8
je 0x1400c4101
nop dword [rax + rax]
mov r11, r8
test r8, r8
je 0x1400c3fe4
mov rcx, qword [r8 + 0x10]
test rcx, rcx
jne 0x1400c3fe1
mov eax, dword [r8 + 0x18]
xor edx, edx
mov r10d, dword [r14 + 0xf0]
div r10d
inc edx
cmp edx, r10d
jae 0x1400c3fe1
mov rax, qword [r14 + 0xe0]
mov r9, qword [rax + rdx*8]
test r9, r9
cmovne rcx, r9
inc edx
test rcx, rcx
je 0x1400c3fc3
mov r8, rcx
mov rax, qword [r11 + 8]
test rax, rax
je 0x1400c3ffa
cmp dword [rax + 0x18], ebx
jne 0x1400c3ffa
mov rdi, qword [rax]
test rdi, rdi
jne 0x1400c4004
test r8, r8
jne 0x1400c3fa0
jmp 0x1400c4101
mov r15d, dword [rax + 8]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov r12d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov r8d, 0xb1
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r9d, eax
lea rcx, str._s__d___Thread_ID___d
call fcn.140064950
mov ecx, 1
lock xadd dword [rdi + 0xb4], ecx
mov rsi, qword [rdi + 0x50]
test rsi, rsi
je 0x1400c40c1
cmp dword [rdi + 0xb0], 0
jne 0x1400c40c1
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
test rsi, rsi
je 0x1400c4144
cmp qword [rdi + 0x90], 0
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jbe 0x1400c40a2
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400c40a2
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400c40a0
mov rax, qword [rax]
test rax, rax
jne 0x1400c4090
jmp 0x1400c40a2
xor ebx, ebx
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400c40bc
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
test rsi, rsi
jne 0x1400c4050
mov eax, 0xffffffff
lock xadd dword [rdi + 0xb4], eax
lea rcx, [rdi + 0x28]
call fcn.14000b8f0
cmp r12d, 1
jbe 0x1400c40fb
mov r9d, r12d
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r8d, SystemTimeToVariantTime
lea rcx, str._s__d_CoInitializeEx_hr_x
call fcn.140064950
jmp 0x1400c4101
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
cmp dword [r14 + 0x12c], 0
je 0x1400c3f30
mov r8d, 0xdb
lea rdx, str.CTimerEventNotify::WorkThreadLoop
lea rcx, [0x140114db0]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140064950
mov ecx, 0x80004005
call fcn.140005560
int3
Function at 0x1400c4370
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.1400298b0
test eax, eax
je 0x1400c43f8
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140064950
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c4467
jmp 0x1400c4461
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_110
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c4459
cmp dword [rsp + 0x40], 4
jne 0x1400c4459
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400c444e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400c4467
mov eax, 1
jmp 0x1400c4469
test rbx, rbx
je 0x1400c4467
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ce210
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400c4490
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 - 0x28], rax
xor esi, esi
mov qword [r11 - 0x30], rsi
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x20], rsi
mov dword [rsp + 0x38], esi
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x30]
call fcn.1400298b0
test eax, eax
je 0x1400c4518
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.140064950
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c4587
jmp 0x1400c4581
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_20
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c4579
cmp dword [rsp + 0x40], 4
jne 0x1400c4579
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x1400c456e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400c4587
mov eax, 1
jmp 0x1400c4589
test rbx, rbx
je 0x1400c4587
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ce210
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400c56d0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140114db0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r8d, 0x83
call fcn.140064950
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
test rbx, rbx
jne 0x1400c5715
mov r8d, 0x84
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140064950
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x86
mov qword [rsp + 0x20], rax
call fcn.140064950
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400c5775
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppStartFirstSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x8a
mov qword [rsp + 0x20], rax
call fcn.140064950
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400c52c0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c59f0

Function at 0x1400c5790
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140114db0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r8d, 0x96
call fcn.140064950
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
test rbx, rbx
jne 0x1400c57d5
mov r8d, 0x97
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140064950
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0x99
mov qword [rsp + 0x20], rax
call fcn.140064950
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400c5835
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppEndLastSession
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0x9d
mov qword [rsp + 0x20], rax
call fcn.140064950
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400c54b0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c59f0
Function at 0x1400c5850
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140114db0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r8d, 0xa9
call fcn.140064950
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
test rbx, rbx
jne 0x1400c5895
mov r8d, 0xaa
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140064950
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xac
mov qword [rsp + 0x20], rax
call fcn.140064950
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400c58f5
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionTypeChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xb0
mov qword [rsp + 0x20], rax
call fcn.140064950
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400c52c0
mov rdx, rbx
call fcn.1400c54b0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c59f0

Function at 0x1400c5920
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
lea rcx, [0x140114db0]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r8d, 0xbd
call fcn.140064950
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
test rbx, rbx
jne 0x1400c5965
mov r8d, 0xbe
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x30
pop rbx
jmp fcn.140064950
mov rax, qword [rbx + 0x18]
lea rcx, str._s__d_nProcessType_d_sAppName_s
mov r9d, dword [rbx + 4]
mov r8d, 0xc0
mov qword [rsp + 0x20], rax
call fcn.140064950
mov rcx, qword [rbx + 0x18]
lea rdx, str.audiodg.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400c59c5
mov rax, qword [rbx + 0x18]
lea rdx, str.CVoipStreamCreationTimeMgr::OnAppSessionAudioDeviceChange
mov r9d, dword [rbx + 4]
lea rcx, str._s__d_nProcessType_d_sAppName_s__skip_audiodg.exe
mov r8d, 0xc4
mov qword [rsp + 0x20], rax
call fcn.140064950
add rsp, 0x30
pop rbx
ret
mov rdx, rbx
call fcn.1400c52c0
mov rdx, rbx
call fcn.1400c54b0
mov rdx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c59f0