Function at 0x14006a910
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x14006b40f
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006b40f
mov r15, qword [rsp + 0x38]
mov qword [rsp + 0x60], r15
call fcn.14013e120
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14006a9c3
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov edx, 0xa
lea rcx, [rsp + 0x68]
call fcn.140154af8
nop
mov rdi, qword [rdi + 0xf48]
test rdi, rdi
je 0x14006aa23
mov rdx, rdi
test rdi, rdi
je 0x14006aa1d
mov rdi, qword [rdi]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x14006aa16
add rdx, 0x118
lea rcx, [rsp + 0x68]
call fcn.140154ea8
test rdi, rdi
jne 0x14006a9f1
jmp 0x14006aa23
call fcn.14013de24
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
mov dword [rsp + 0x44], 0x200
mov r13d, esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, 1
or r12, 0xffffffffffffffff
test eax, eax
jne 0x14006ac81
mov eax, dword [rsp + 0x5c]
cmp eax, r14d
je 0x14006aa96
cmp eax, 2
jne 0x14006ac81
mov ecx, dword [rsp + 0x44]
test ecx, ecx
je 0x14006aabd
test r14b, cl
jne 0x14006ac81
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r13w
je 0x14006aac6
jmp 0x14006ac81
mov word [rsp + 0xb0], r13w
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
xor ecx, ecx
call fcn.14007b8d0
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006ab06
add rax, 2
test cx, cx
jne 0x14006aaf0
mov eax, esi
jmp 0x14006ab0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006ac45
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006ab94
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006ac16
cmp dword [rdx + 0x10], eax
jge 0x14006ab60
cmp dword [rbx - 0xc], eax
jge 0x14006ab55
mov ecx, 0x80070057
call fcn.140001c70
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006ac16
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006ab78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006ac16
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006abc5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006abe5
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015c620
jmp 0x14006ac02
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015c410
test edi, edi
js 0x14006ac3a
cmp edi, dword [rbx - 0xc]
jg 0x14006ac3a
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140154c2c
test rax, rax
je 0x14006ac45
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14007ba80
jmp 0x14006ac45
mov ecx, 0x80070057
call fcn.140001c70
int3
test rbx, rbx
jne 0x14006ac4e
mov ecx, esi
jmp 0x14006ac63
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006ac76
cmp ecx, dword [rbx - 0xc]
jg 0x14006ac76
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006ac81
mov ecx, 0x80070057
call fcn.140001c70
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r13 + r13]
mov dword [rsp + 0x4c], edx
mov r13d, esi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006aed6
mov eax, dword [rsp + 0x54]
cmp eax, r14d
je 0x14006aceb
cmp eax, 2
jne 0x14006aed6
mov ecx, dword [rsp + 0x4c]
test ecx, ecx
je 0x14006ad12
test r14b, cl
jne 0x14006aed6
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006ad1c
jmp 0x14006aed6
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
mov ecx, r14d
call fcn.14007b8d0
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006ad5b
add rax, 2
test cx, cx
jne 0x14006ad45
mov eax, esi
jmp 0x14006ad60
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006ae9a
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006ade9
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006ae6b
cmp dword [rdx + 0x10], eax
jge 0x14006adb5
cmp dword [rbx - 0xc], eax
jge 0x14006adaa
mov ecx, 0x80070057
call fcn.140001c70
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006ae6b
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006adcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006ae6b
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006ae1a
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006ae3a
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015c620
jmp 0x14006ae57
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015c410
test edi, edi
js 0x14006ae8f
cmp edi, dword [rbx - 0xc]
jg 0x14006ae8f
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140154c2c
test rax, rax
je 0x14006ae9a
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14007ba80
jmp 0x14006ae9a
mov ecx, 0x80070057
call fcn.140001c70
int3
test rbx, rbx
jne 0x14006aea3
mov ecx, esi
jmp 0x14006aeb8
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006aecb
cmp ecx, dword [rbx - 0xc]
jg 0x14006aecb
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006aed6
mov ecx, 0x80070057
call fcn.140001c70
int3
mov eax, dword [0x14022c3f4]
test eax, eax
jne 0x14006aefd
mov dword [0x14022c3f0], 0x114
lea rcx, [0x14022c3f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022c3f4]
cmp eax, 6
jne 0x14006af10
cmp dword [0x14022c3f8], r14d
jae 0x14006af19
jmp 0x14006b3be
cmp eax, 6
jbe 0x14006b3be
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r13 + r13]
mov dword [rsp + 0x40], edx
mov r13d, esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006b173
mov eax, dword [rsp + 0x50]
cmp eax, r14d
je 0x14006af83
cmp eax, 2
jne 0x14006b173
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14006afaa
test r14b, cl
jne 0x14006b173
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006afb4
jmp 0x14006b173
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, 2
xor ecx, ecx
call fcn.14007b8d0
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006aff6
add rax, 2
test cx, cx
jne 0x14006afe0
mov eax, esi
jmp 0x14006affb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006b137
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006b084
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006b106
cmp dword [rdx + 0x10], eax
jge 0x14006b050
cmp dword [rbx - 0xc], eax
jge 0x14006b045
mov ecx, 0x80070057
call fcn.140001c70
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006b106
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006b068
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006b106
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006b0b5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006b0d5
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015c620
jmp 0x14006b0f2
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015c410
test edi, edi
js 0x14006b12c
cmp edi, dword [rbx - 0xc]
jg 0x14006b12c
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140154c2c
test rax, rax
je 0x14006b137
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.14007ba80
jmp 0x14006b137
mov ecx, 0x80070057
call fcn.140001c70
int3
test rbx, rbx
jne 0x14006b140
mov ecx, esi
jmp 0x14006b155
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006b168
cmp ecx, dword [rbx - 0xc]
jg 0x14006b168
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006b173
mov ecx, 0x80070057
call fcn.140001c70
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r13 + r13]
mov dword [rsp + 0x48], edx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006b3be
mov eax, dword [rsp + 0x58]
cmp eax, r14d
je 0x14006b1da
cmp eax, 2
jne 0x14006b3be
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14006b1fe
test r14b, al
jne 0x14006b3be
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006b208
jmp 0x14006b3be
mov word [rsp + 0xb0], 0
lea r8, [rsp + 0x30]
mov edx, 2
mov ecx, r14d
call fcn.14007b8d0
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006b246
add rax, 2
test cx, cx
jne 0x14006b230
mov eax, esi
jmp 0x14006b24b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006b381
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006b2d1
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006b350
cmp dword [rdx + 0x10], eax
jge 0x14006b2a0
cmp dword [rbx - 0xc], eax
jge 0x14006b295
mov ecx, 0x80070057
call fcn.140001c70
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006b350
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006b2b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006b350
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, r14d
jge 0x14006b301
mov edx, ecx
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006b321
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015c620
jmp 0x14006b33e
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015c410
test edi, edi
js 0x14006b376
cmp edi, dword [rbx - 0xc]
jg 0x14006b376
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140154c2c
test rax, rax
je 0x14006b381
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.14007ba80
jmp 0x14006b381
mov ecx, 0x80070057
call fcn.140001c70
int3
test rbx, rbx
jne 0x14006b38a
xor ecx, ecx
jmp 0x14006b3a0
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006b3b3
cmp ecx, dword [rbx - 0xc]
jg 0x14006b3b3
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006b3be
mov ecx, 0x80070057
call fcn.140001c70
int3
test r15, r15
je 0x14006b3d5
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x68]
call fcn.140154cf8
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14006b3fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006b40f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006b40f
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14015b6f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret