joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096f30
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x70], rcx
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x140097170
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x808], rax
test rbx, rbx
je 0x140097149
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140096fa0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x808]
call fcn.1400048e0
mov rax, qword [rbp + 0x808]
cmp dword [rax - 8], 1
jle 0x140096fdf
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 0x808]
call fcn.140004780
mov rax, qword [rbp + 0x808]
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x820], rsi
mov rdi, rbp
mov esi, 0x5c00
xor r15d, r15d
nop dword [rax + rax]
mov qword [rdi + 8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x1400970d2
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov ebx, esi
or ebx, 0x220000
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax + 3]
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140097077
mov qword [rsp + 0x40], r15
jmp 0x1400970c9
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayUnaccessData
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test ebx, ebx
cmove rcx, r15
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm0
add esi, 0xc
add rdi, 0x20
cmp esi, 0x5ef4
jl 0x140097000
mov qword [rbp + 0x7e8], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbp + 0x7e0], rax
test rax, rax
je 0x140097132
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbp
lea r8, [0x1400973b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbp + 0x810], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbp + 0x818], rax
mov rax, rbp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x140097990
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
mov r9d, edx
lea rcx, str._s__d_nDriverEventIndex_d
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xd1
call fcn.14005dbf0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov rcx, qword [rsi + 0x820]
mov ebx, eax
test rcx, rcx
je 0x1400979eb
mov r9, qword [rcx]
mov r8d, edi
mov rdx, qword [rsi + 0x800]
call qword [r9]
cmp ebx, 1
jbe 0x140097a1b
mov r9d, ebx
lea rdx, str.CRtkAudioDriverEvent::NotifyEvent
mov r8d, 0xda
lea rcx, str._s__d_CoInitializeEx_hr_x
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005dbf0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
Function at 0x14009d930
Capabilities:
Check if file exists
Print debug messages
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x14009d95c
mov r8d, 0x2e2
lea rdx, str.CRtkBssGen4PresetLoader::OnAddDevice
lea rcx, str._s__d_RETURN_ON_FALSE
add rsp, 0x20
pop rbx
jmp fcn.14005dbf0
mov rcx, rbx
call fcn.14000ecf0
test eax, eax
jne 0x14009d97f
call fcn.14001dc30
test byte [rax + 4], 8
je 0x14009d98c
mov rcx, rbx
call fcn.1400247e0
test eax, eax
je 0x14009d98c
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14009c400
add rsp, 0x20
pop rbx
ret

Function at 0x14009d9a0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14000b470
mov rcx, rax
call fcn.14008cd40
call fcn.14000b470
cmp dword [rax + 0x140], 0
jne 0x14009d9f9
cmp dword [0x14015fde8], 0
je 0x14009d9f9
cmp dword [0x14015fdb4], 0
jne 0x14009d9e0
mov rax, qword [0x1401591e0]
test byte [rax + 0x1c], 1
je 0x14009d9f9
mov r8d, 0x3e
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.14005dbf0
call fcn.14000b470
mov rbx, qword [rax + 0xe0]
test rbx, rbx
je 0x14009da42
nop word [rax + rax]
call fcn.14000b470
call fcn.14000b470
test rbx, rbx
je 0x14009da92
mov rdx, qword [rbx + 0x10]
mov rbx, qword [rbx]
cmp dword [rdx + 0x170], 0
je 0x14009da3d
cmp dword [rdx + 0x184], 1
jne 0x14009da3d
call fcn.14009c400
test rbx, rbx
jne 0x14009da10
call fcn.14000b470
sub dword [rax + 0x140], 1
mov ecx, dword [rax + 0x140]
jne 0x14009da69
mov rcx, qword [rax + 0x150]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp ecx, 0x32
jle 0x14009da8c
mov r8d, 0x80
lea rdx, str.CMMPlatform::AudioDevList_Release
lea rcx, str._s__d_calling_AudioDevList_Release_isnt_matched_AudioDevList_AddRef_or_directly_return_in_EnumAudioDeviceStart_loop
add rsp, 0x20
pop rbx
jmp fcn.14005dbf0
add rsp, 0x20
pop rbx
ret
mov ecx, 0x80004005
call fcn.140004fd0
int3
Function at 0x1400a3210
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400a3970
test rax, rax
jne 0x1400a3275
mov ecx, 0xa0c
call fcn.1400bf154
lea rcx, [rdi + 8]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
mov rdx, rbx
call fcn.1400a4610
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1400a3275
lea r8d, [rax + 0x6c]
lea rdx, str.CRtkEffectConditionsBase::ResetConditions
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005dbf0
mov rdx, rax
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400a3290

Function at 0x1400a3e30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call fcn.14000b470
mov rdx, rbx
call fcn.14008e8b0
mov rdi, rax
test rax, rax
jne 0x1400a3e82
mov r8d, 0x1b0
lea rdx, str.CRtkEffectConditionsBase::SaveCondToPropertyStore
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14005dbf0
mov rdx, rbx
mov rcx, rsi
call fcn.1400a3970
test rax, rax
jne 0x1400a3e9a
mov r8d, 0x1b3
jmp 0x1400a3e60
cmp dword [rax], 0
jg 0x1400a3ea7
mov r8d, 0x1b4
jmp 0x1400a3e60
lea rcx, [rdi + 0x10]
mov dword [rsp + 0x20], 1
mov r9d, 0xa0c
lea rdx, [0x1400ddff8]
mov r8, rax
call fcn.140003700
test eax, eax
jne 0x1400a3ee8
mov r9, rbx
lea rdx, str.CRtkEffectConditionsBase::SaveCondToPropertyStore
mov r8d, 0x1b8
lea rcx, str._s__d_EpId_s_set_PKEY_RTK_BSS_CONDITIONS_GUID_VALUE_ARRAY_V3_failed
call fcn.14005dbf0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a6ec0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x30], rcx
lea rax, vtable.CSimpleOrientationSensorManagerEvents.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], SafeArrayUnaccessData
mov dword [rcx + 0x58], ebp
mov dword [rcx + 0x5c], 0xa
mov qword [rcx + 0x60], rbp
mov qword [rcx + 0x68], rbp
mov dword [rcx + 0x3c], 0x3f400000
mov dword [rcx + 0x40], 0x3e800000
mov dword [rcx + 0x44], 0x40100000
xor ecx, ecx
movss xmm1, dword [0x140129dc8]
movabs rdx, 0x8000000000000000
movss xmm0, dword [0x140129df4]
comiss xmm1, xmm0
jb 0x1400a6f65
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400a6f65
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
mov qword [rdi + 0x48], rax
xor ecx, ecx
movss xmm1, dword [0x140129d70]
comiss xmm1, xmm0
jb 0x1400a6f8c
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400a6f8c
mov rcx, rdx
cvttss2si rax, xmm1
add rax, rcx
cmp rax, 0x11
cmovb rax, rbp
mov qword [rdi + 0x50], rax
mov dword [rdi + 8], ebp
mov qword [rdi + 0x10], rbp
mov dword [rdi + 0xc], 1
mov ecx, 0x108
call fcn.1400bf154
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call fcn.1400c53e0
mov r8, rdi
mov rcx, rbx
call fcn.1400aee00
nop
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x78], rbp
mov qword [rdi + 0x80], rbp
mov qword [rdi + 0x88], rbp
lea rbx, [rdi + 0x90]
lea rax, vtable.CSensorsMgr.2.0
mov qword [rdi], rax
lea rax, vtable.CSensorsMgr.0
mov qword [rdi + 0x70], rax
lea rax, vtable.CSensorsMgr.1.0
mov qword [rbx], rax
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov r8d, 0xa
lea rdx, str.CSensorsMgr::CSensorsMgr
lea rcx, [0x1400e2bd0]
call fcn.14005dbf0
mov qword [rsp + 0x40], rbx
call fcn.1400915e0
mov rsi, rax
test rbx, rbx
je 0x1400a70a5
lea rcx, [rax + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
lea rcx, [rsi + 0xc8]
mov rax, qword [rcx]
test rax, rax
je 0x1400a708e
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400a7098
mov rax, qword [rax]
test rax, rax
jne 0x1400a7080
lea rdx, [rsp + 0x40]
call fcn.140006ca0
lea rcx, [rsi + 0xa0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x9c], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x1400a75f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0xa0], rax
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400beb20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400ad6d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeRun
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
call fcn.14007da80
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e6
lea rcx, str._s__d_hadRun_d
call fcn.14005dbf0
cmp dword [rsp + 0x40], 1
jne 0x1400ad829
mov r9d, 1
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2e9
lea rcx, str._s__d_hadRun_d
call fcn.14005dbf0
call fcn.14000b470
mov rcx, rax
call fcn.14008cd40
call fcn.14000b470
mov rcx, rax
call fcn.14008cce0
mov rbx, rax
test rbx, rbx
je 0x1400ad817
call fcn.14000b470
call fcn.14000b470
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x1400ad766
cmp dword [rcx + 0x1ac], 1
jne 0x1400ad766
add rcx, 0xc8
mov qword [rsp + 0x48], rdi
call fcn.140010190
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
lea r8, str.TVModeSpkMute
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdi, rax
call fcn.14007da80
mov r9d, dword [rsp + 0x40]
lea rdx, str.CServiceMain::CheckLastTimeTVMode
mov r8d, 0x2f6
lea rcx, str._s__d_bMuted_d
call fcn.14005dbf0
mov r9, qword [rdi]
mov rcx, rdi
mov edx, dword [rsp + 0x40]
call qword [r9 + 0x10]
xor r9d, r9d
lea r8, str.TVModeRun
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call fcn.14007dbb0
mov rdi, qword [rsp + 0x48]
call fcn.14000b470
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.14008cdc0
add rsp, 0x30
pop rbx
ret

Function at 0x1400ae2e0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400ae366
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ae390
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140029740
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400ae439
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x1400ae6c0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400ae713
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1400ae7f1
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x1400ae7ef
cmp eax, 3
jne 0x1400ae778
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400ae708
cmp dword [rsp + 0x3c], 1
je 0x1400ae7ef
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400ae80c
cmp dword [rsp + 0x3c], 3
je 0x1400ae725
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1400ae708
cmp dword [rsp + 0x3c], 1
je 0x1400ae7ef
nop word [rax + rax]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400ae708
cmp dword [rsp + 0x3c], 1
je 0x1400ae7ef
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x1400ae80c
cmp dword [rsp + 0x3c], 1
jne 0x1400ae7a0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov eax, 0x5b4
jmp 0x1400ae7f1
Function at 0x1400aed10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
mov rdi, rcx
lea rdx, str.CSilencePlayerMgr::PlayASlienceMS
mov r8d, 0xc9
lea rcx, str._s__d
call fcn.14005dbf0
lea rax, [rsp + 0x30]
mov dword [rdi + 8], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400aed90]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400af960
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400af9eb
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rdx, str.ConvertibleSlateMode
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400beb20
add rsp, 0x58
ret
Function at 0x1400afcb0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], r8d
lea rdx, str.SOFTWARERealtekRealtekEffectsAP
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400afd5c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.AutoRotationState
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.SensorIndex
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400beb20
add rsp, 0x58
ret
Function at 0x1400b3050
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
cmp edx, 0x20
jb 0x1400b3087
mov r8d, 0x1b4
lea rdx, str.CStoreAppMgr::OnJackPlugStatusChanged
lea rcx, str._s__d_RETURN_ON_FALSE
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005dbf0
call fcn.14002a070
lea rcx, [rax + 0x10]
call fcn.140044480
call fcn.14002a070
mov rcx, rax
mov edx, edi
call fcn.140061260
mov edi, eax
call fcn.14002a070
sub dword [rax + 0x28], 1
mov ecx, dword [rax + 0x28]
jne 0x1400b30c0
mov rcx, qword [rax + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x1400b30de
cmp ecx, 0x32
jle 0x1400b30de
mov r8d, 0x6a
lea rdx, str.CDataAccessProtector::FinishAccess
lea rcx, str._s__d_calling_FinishAccess_isnt_matched_RequestAccess_or_directly_return_in_EnumAudioDeviceStart_loop
call fcn.14005dbf0
test edi, edi
je 0x1400b3133
xor edx, edx
lea rcx, [0x1400e2fc8]
call fcn.1400b2890
call fcn.140055380
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xf8]
test eax, eax
je 0x1400b3159
xor ecx, ecx
lea rax, [rbx - 8]
test rax, rax
mov dword [0x1401602c4], ecx
cmove rbx, rcx
call fcn.140020470
mov rdx, rbx
lea rcx, [rax + 0x10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000b540
call fcn.140055380
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x88]
test eax, eax
jne 0x1400b3159
mov edx, 0x2000000
lea rcx, str._Ping
call fcn.1400b2890
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b48f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x12c], 0
mov r14, rcx
jne 0x1400b4af8
nop dword [rax]
mov ecx, dword [r14 + 0x130]
lea rdx, [r14 + 0x138]
mov r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x1400b4aea
cmp qword [r14 + 0xe8], 0
je 0x1400b4aea
mov r8d, dword [r14 + 0xf0]
xor edx, edx
test r8d, r8d
je 0x1400b4980
mov r9, qword [r14 + 0xe0]
nop word [rax + rax]
mov rcx, qword [r9 + rdx*8]
test rcx, rcx
jne 0x1400b4990
inc edx
cmp edx, r8d
jb 0x1400b4970
xor ecx, ecx
test rcx, rcx
je 0x1400b4aea
nop dword [rax + rax]
mov r11, rcx
test rcx, rcx
je 0x1400b49d3
mov r9, qword [rcx + 0x10]
test r9, r9
jne 0x1400b49d0
mov eax, dword [rcx + 0x18]
xor edx, edx
mov r10d, dword [r14 + 0xf0]
div r10d
inc edx
cmp edx, r10d
jae 0x1400b49d0
mov rax, qword [r14 + 0xe0]
mov r8, qword [rax + rdx*8]
test r8, r8
cmovne r9, r8
inc edx
test r9, r9
je 0x1400b49b2
mov rcx, r9
mov rax, qword [r11 + 8]
test rax, rax
je 0x1400b49e9
cmp dword [rax + 0x18], ebx
jne 0x1400b49e9
mov rdi, qword [rax]
test rdi, rdi
jne 0x1400b49f3
test rcx, rcx
jne 0x1400b4990
jmp 0x1400b4aea
mov r15d, dword [rax + 8]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov r12d, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov r8d, 0xb1
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r9d, eax
lea rcx, str._s__d___Thread_ID___d
call fcn.14005dbf0
inc dword [rdi + 0xb4]
mov rsi, qword [rdi + 0x50]
test rsi, rsi
je 0x1400b4ab1
nop dword [rax + rax]
cmp dword [rdi + 0xb0], 0
jne 0x1400b4ab1
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
test rsi, rsi
je 0x1400b4b2d
cmp qword [rdi + 0x90], 0
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jbe 0x1400b4a92
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400b4a92
nop dword [rax]
cmp qword [rax + 0x10], rbx
je 0x1400b4a90
mov rax, qword [rax]
test rax, rax
jne 0x1400b4a80
jmp 0x1400b4a92
xor ebx, ebx
lea rcx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400b4aac
mov rax, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [rax]
test rsi, rsi
jne 0x1400b4a40
dec dword [rdi + 0xb4]
lea rcx, [rdi + 0x28]
call fcn.14000b380
cmp r12d, 1
jbe 0x1400b4ae4
mov r9d, r12d
lea rdx, str.CTimerEventNotify::OnServiceTimer
mov r8d, SystemTimeToVariantTime
lea rcx, str._s__d_CoInitializeEx_hr_x
call fcn.14005dbf0
jmp 0x1400b4aea
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
cmp dword [r14 + 0x12c], 0
je 0x1400b4920
mov r8d, 0xdb
lea rdx, str.CTimerEventNotify::WorkThreadLoop
lea rcx, [0x1400e2bd0]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14005dbf0
mov ecx, 0x80004005
call fcn.140004fd0
int3