Function at 0x1400d9370
Capabilities:
Create thread
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rbx, rcx
xor edi, edi
cmp dword [rcx + 0x60], edi
je 0x1400d93a0
xor eax, eax
jmp 0x1400d984d
add rcx, 0x68
call fcn.1400da710
test eax, eax
jns 0x1400d93b7
mov edi, 0x80004005
jmp 0x1400d984b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x1400d9497
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x1400d9497
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0xa0], rax
test rax, rax
je 0x1400d9497
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x1400d9d30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x1400d9497
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400d9497
mov rax, qword [rcx]
mov rdx, qword [rbx + 0xa0]
call qword [rax + 0x18]
test eax, eax
js 0x1400d9497
mov dword [rbx + 0xb8], 1
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400d9497
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x98]
call qword [rax + 0x30]
test eax, eax
js 0x1400d9497
mov dword [rbx + 0xbc], 1
cmp dword [rbx + 0x70], edi
je 0x1400d9497
mov rcx, qword [rbx + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov dword [rbx + 0x60], 1
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x10], edi
mov qword [rbp - 8], rdi
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekAudioWOV
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140024490
test eax, eax
jne 0x1400d9567
mov dword [rbp + 0x30], edi
mov dword [rbp + 0x38], 4
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.EnableDefaultKeyword
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d952c
cmp dword [rbp + 0x40], 4
jne 0x1400d952c
cmp dword [rbp + 0x30], edi
je 0x1400d952c
test rsi, rsi
je 0x1400d9522
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
jmp 0x1400d95ba
mov dword [rbp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableDefaultKeyword
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x1400d9576
mov rcx, rsi
jmp 0x1400d9570
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400d9576
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
mov qword [rbp + 0x30], rcx
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x1400d95ab
mov rax, qword [r9]
lea r8, [rbp + 0x30]
lea rdx, [0x1403b7ea0]
mov rcx, r9
call qword [rax]
mov rcx, qword [rbp + 0x30]
test eax, eax
js 0x1400d95ab
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x30]
mov edx, edi
test rcx, rcx
je 0x1400d95ba
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov edx, edi
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax + 0x84]
bt r14d, 0x10
jae 0x1400d9705
test edx, edx
jne 0x1400d9705
mov edx, 1
lea rcx, [rbx + 0x68]
call fcn.1400da860
bt r14d, 0x11
jae 0x1400d9674
mov rax, qword [rbx + 0x68]
test dword [rax + 0x84], 0x800
je 0x1400d96d2
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x10], edi
mov qword [rbp - 8], rdi
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekAudioWOV
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140024490
test eax, eax
jne 0x1400d96c3
mov dword [rbp + 0x30], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DefaultKeywordGlobalStatus
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x1400d96d2
mov rcx, rsi
jmp 0x1400d96cc
xor edx, edx
lea rcx, [rbx + 0x68]
call fcn.1400da860
mov rax, qword [rbx + 0x68]
test dword [rax + 0x84], 0x800
je 0x1400d96d2
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x10], edi
mov qword [rbp - 8], rdi
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekAudioWOV
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140024490
test eax, eax
jne 0x1400d96c3
mov dword [rbp + 0x30], edi
jmp 0x1400d963c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400d96d2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x30], edi
cmp dword [rbx + 0x70], 0
je 0x1400d96ee
mov rcx, qword [rbx + 0x80]
mov rax, qword [rcx]
lea r8, [rbp + 0x30]
xor edx, edx
call qword [rax + 0x28]
bt r14d, 0x11
jb 0x1400d97fa
mov dword [0x1404657cc], 1
jmp 0x1400d9712
cmp dword [0x1404657cc], 0
je 0x1400d9800
mov dword [rbp + 0x30], edi
cmp dword [rbx + 0x70], 0
je 0x1400d9800
mov rcx, qword [rbx + 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + 0x20]
cmp dword [rbp + 0x30], 0
je 0x1400d9800
cmp dword [rbx + 0x70], 0
je 0x1400d9770
mov dword [rbp + 0x30], edi
mov rcx, qword [rbx + 0x80]
mov rax, qword [rcx]
lea r8, [rbp + 0x30]
mov edx, 1
call qword [rax + 0x18]
test eax, eax
js 0x1400d9763
cmp dword [rbp + 0x30], 0
je 0x1400d9770
lea rcx, str._ZZ__HWKWS::SetDefaultKeywordEnable___fail_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rbx + 0x68]
test dword [rax + 0x84], 0x800
je 0x1400d97fa
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x10], edi
mov qword [rbp - 8], rdi
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekAudioWOV
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.140024490
test eax, eax
jne 0x1400d97eb
mov dword [rbp + 0x30], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DefaultKeywordGlobalStatus
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x1400d97fa
mov rcx, rsi
jmp 0x1400d97f4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400d97fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1404657cc], edi
cmp dword [rbx + 0xc4], 0
je 0x1400d984b
mov rcx, rbx
call fcn.1400da420
dec eax
cmp eax, 0x62
ja 0x1400d984b
mov dword [rbp + 0x30], edi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x1400da6f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb0], rax
mov rcx, rbx
call fcn.1400da550
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret