Function at 0x1401ef0e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x890
mov rax, qword [0x14031eda0]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor r12d, r12d
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov esi, r12d
mov ebp, r12d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ef670
mov qword [rsp + 0x8b8], rdi
mov qword [rsp + 0x8c0], r13
lea r13d, [r12 + 1]
mov qword [rsp + 0x8b0], rbx
mov edi, r12d
nop
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x480]
mov edx, edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1401ef565
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x80]
mov edx, 0x200
mov ebx, r12d
call fcn.14022ccc0
lea r8, str.Properties
lea rcx, [rsp + 0x80]
mov edx, 0x200
call fcn.14022cd70
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ef568
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef25a
lea rdx, str.Realtek
lea rcx, [rsp + 0x80]
call fcn.14022cc50
test rax, rax
cmovne ebx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401ef568
lea r8, str.FXProperties
lea rcx, [rsp + 0x480]
mov edx, 0x200
call fcn.14022cd70
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x480]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ef568
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef558
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [0x1403375e8], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov ebp, r13d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef343
mov eax, dword [rsp + 0x54]
or dword [0x1403375d4], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef387
mov eax, dword [rsp + 0x54]
or dword [0x1403375d8], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef3cb
mov eax, dword [rsp + 0x54]
or dword [0x1403375dc], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1403375e4]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x1403375e4], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef458
mov eax, dword [rsp + 0x54]
or dword [0x1403375e0], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1403375f4]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x1403375f4], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ef50f
cmp dword [rsp + 0x54], r12d
je 0x1401ef50f
mov dword [0x1403375f8], 0x80000000
mov dword [0x1403375e8], r12d
mov dword [0x1403375d4], r12d
mov dword [0x1403375d8], r12d
mov dword [0x1403375dc], r12d
mov dword [0x1403375e0], r12d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1403375fc]
test eax, eax
cmove ecx, dword [rsp + 0x54]
mov dword [0x1403375fc], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401ef568
mov esi, r13d
add edi, r13d
test esi, esi
je 0x1401ef160
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1401ef658
cmp dword [0x14033762c], r12d
mov dword [0x1403375d0], 0xaeaeaeae
jne 0x1401ef5b0
lea rdi, [0x1403375d0]
mov rdx, rdi
mov rcx, rdi
call fcn.1401ee900
jmp 0x1401ef658
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x1403375d0]
test eax, eax
jne 0x1401ef63d
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, str.CapProperties
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov ebx, r12d
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401ef63d
lea rdx, str.WriteRegistry_successful
jmp 0x1401ef644
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r12d
or r8d, r9d
call fcn.1401eed80
mov rbx, qword [rsp + 0x8b0]
mov rdi, qword [rsp + 0x8b8]
mov r13, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.14022b9b0
add rsp, 0x890
pop r12
pop rsi
pop rbp
ret