Function at 0x140012674
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r13, r8
mov rdi, rdx
mov r12, rcx
lea rdx, str.CRecorderMgr::GetDeviceInfo
mov r15d, 8
mov ecx, r15d
call fcn.140001110
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov rax, qword [r13]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400594f8]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [rax + 0x48]
mov ebx, eax
cmp eax, r14d
jl 0x14001f700
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, str.FriendlyName
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
cmp eax, r14d
jl 0x14001f72b
cmp r15w, word [rsp + 0x78]
jne 0x14001fa64
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rdi + 0x80]
cmp rcx, rbx
je 0x140012753
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi + 0x80], rbx
mov word [rsp + 0x78], r14w
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x90]
lea rdx, str.DevicePath
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, r14d
jl 0x14001f783
cmp r15w, word [rsp + 0x90]
jne 0x14001f783
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rdi + 0x78]
cmp rcx, rbx
je 0x1400127b7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi + 0x78], rbx
mov word [rsp + 0x90], r14w
mov rdx, rdi
mov rcx, r12
call fcn.1400121e4
mov ebx, eax
cmp eax, r14d
jl 0x14001f757
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, str.CLSID
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov esi, eax
cmp eax, r14d
jl 0x14001f831
cmp r15w, word [rsp + 0x60]
jne 0x14001f831
lea rdx, [rdi + 0xbc]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
cmp eax, r14d
jl 0x14001f81b
cmp r15w, word [rsp + 0x60]
jne 0x14001f87c
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x14001f850
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0xb0], rax
cmp rax, r14
je 0x14001f860
lea r8, [0x14005a1e8]
mov rdx, rbx
mov rcx, r12
call fcn.1400129ec
mov esi, eax
cmp eax, r14d
jge 0x14001f870
mov dword [rdi + 0x5c], r14d
mov eax, dword [rdi + 0x5c]
mov dword [rsp + 0x20], eax
mov r9d, esi
mov r8, rbx
lea rdx, str.CRecorderMgr::GetDeviceInfo:_FindUPnPStreamingFilter__s__returned_0x_08X__setting_UPnPStreamingRecorder_d
mov ecx, r15d
call fcn.140001110
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400128ad
cmp dword [r12 + 0xe8], r14d
jne 0x14001f894
lea rcx, [0x1400594e8]
mov rdx, qword [rdi + 0xac]
cmp rdx, qword [rcx]
jne 0x14001f8a0
mov rdx, qword [rdi + r15 + 0xac]
cmp rdx, qword [rcx + r15]
jne 0x14001f8a0
mov eax, r14d
jmp 0x1400128e9
cmp eax, r14d
jne 0x140012908
lea rdx, str.07ddc926_774d_4438_aa05_23ea13e922eb
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, r14
jne 0x14001f8aa
lea rdx, str.07ddc927_774d_4438_aa05_23ea13e922eb
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, r14
jne 0x14001f8b6
mov qword [rsp + 0x40], r14
mov rax, qword [r13]
lea r8, [rsp + 0x40]
lea rdx, [0x140058998]
mov rcx, r13
call qword [rax]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x14001fa49
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, r14d
jge 0x14001f8c2
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Failed_to_get_GetCapabilitiesKey_0x_x
mov ecx, r15d
call fcn.140001110
mov esi, r14d
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
jne 0x14001fa3e
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x1400129a2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x1400129be
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, esi
jmp 0x1400129c2
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140001170
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r8d, eax
lea rdx, [0x140084bd0]
lea ecx, [r15 - 7]
call fcn.140001110
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x14001f724
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
jmp 0x1400129c2
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Failed_to_read__FriendlyName__from_pBag__0x_x.
mov ecx, 1
call fcn.140001110
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x14001f750
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
jmp 0x1400129c2
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Failed_to_call_GetRootDeviceNameAndInstanceID__0x_x.
mov ecx, 1
call fcn.140001110
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x14001f77c
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
jmp 0x1400129c2
mov rcx, qword [rdi + 0x80]
cmp rcx, r14
jne 0x14001f794
mov rbx, r14
jmp 0x14001f7ac
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov rbx, rax
cmp qword [rdi + 0x80], r14
je 0x14001f7ca
cmp rbx, r14
jne 0x14001f7ca
mov ecx, 0x8007000e
call fcn.140029690
nop
jmp 0x140024ed6
mov qword [rsp + 0xb0], r14
mov rcx, qword [rdi + 0x78]
cmp rcx, rbx
je 0x14001f7e5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi + 0x78], rbx
mov r8, rdi
mov rdx, qword [rsp + 0x30]
mov rcx, r12
call fcn.14003fca0
cmp eax, r14d
jge 0x14001f80d
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Ignore_failure_from_GetPBDARootDeviceNameAndInstanceId__0x_x.
mov ecx, r15d
call fcn.140001110
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x1400127d6
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_CLSIDFromString_failed__0x_x.
mov ecx, 1
call fcn.140001110
jmp 0x14001f845
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Filter_does_not_expose_property_CLSID__0x_x.
mov ecx, 1
call fcn.140001110
cmp esi, r14d
jge 0x140012830
jmp 0x14001f87c
mov rbx, r14
mov qword [rsp + 0xb0], rbx
jmp 0x140012864
mov ecx, 0x8007000e
call fcn.140029690
nop
jmp 0x140024ed7
mov dword [rdi + 0x5c], 1
jmp 0x140012885
mov r8d, esi
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Filter_does_not_expose_property_CLSID__hr0x_08X
mov ecx, r15d
call fcn.140001110
nop
jmp 0x1400128ad
or dword [rdi + 0x19c], 1
jmp 0x1400128bb
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x1400128e9
or dword [rdi + 0x19c], 1
jmp 0x140012908
or dword [rdi + 0x19c], 1
jmp 0x140012922
mov dword [rsp + 0x38], 1
mov word [rsp + 0xc0], r14w
xor edx, edx
lea r8d, [rdx + 0x4e]
lea rcx, [rsp + 0xc2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x3c], 0x50
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.2d7e9965_d630_4b0c_a98e_66dc47b6399a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
mov ebx, 0x80070000
or esi, ebx
cmp eax, r14d
cmovle esi, eax
cmp esi, r14d
jge 0x14001f948
mov r8d, esi
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Failed_to_get_serial_number_0x_x
mov ecx, r15d
call fcn.140001110
jmp 0x14001f9b9
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
cmp eax, r14d
jl 0x14001f9a4
mov rcx, qword [rdi + 0xd0]
lea rax, [rsp + 0xc0]
cmp rax, rcx
je 0x14001f9b9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi + 0xd0], rax
cmp rax, r14
jne 0x14001f9b9
mov ecx, 0x8007000e
call fcn.140029690
int3
mov r8d, eax
lea rdx, str.CRecorderMgr::GetDeviceInfo:_invalid_serial_number_0x_x
mov ecx, r15d
call fcn.140001110
mov esi, r14d
test byte [rdi + 0x19c], 1
jne 0x140012983
mov eax, 4
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0xb0], r14d
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.38528f39_96ea_4b89_80ac_8c73c457ed95
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, ebx
cmp eax, r14d
cmovle esi, eax
cmp esi, r14d
jge 0x14001fa24
mov esi, r14d
jmp 0x140012983
cmp dword [rsp + 0xb0], 1
jne 0x140012983
or dword [rdi + 0x19c], 1
jmp 0x140012983
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012991
mov r8d, 0x80004002
lea rdx, str.CRecorderMgr::GetDeviceInfo:_Failed_to_get_IGetCapabilitiesKey_0x_x
mov ecx, r15d
call fcn.140001110
nop
jmp 0x140012991
lea rdx, str.CRecorderMgr::GetDeviceInfo:_varName.vt_is_not_VT_BSTR__invalid_argument_.
mov ecx, 1
call fcn.140001110
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x14001fa91
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, 0x80070057
jmp 0x1400129c2