Function at 0x140124140
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rcx
lea r12, [rcx + 0x140]
mov rax, qword [rcx + 0x1d8]
mov r8, qword [rcx + 0x1e0]
mov cl, 1
nop word [rax + rax]
cmp rax, r8
je 0x1401241e0
mov rdx, qword [rax]
test rdx, rdx
je 0x1401241d3
mov rcx, qword [rdx + 0x100]
sub rcx, qword [rdx + 0xf8]
cmp rcx, 4
jae 0x1401241d1
cmp qword [rdx + 0x130], 0
jne 0x1401241d1
add rax, 8
jmp 0x140124198
xor cl, cl
add rax, 8
test cl, cl
jne 0x1401241a0
jmp 0x1401244ca
test cl, cl
je 0x1401244ca
xor eax, eax
mov qword [rsp + 0x58], rax
lea rax, vtable.CMaxxAudioRegistryPreset.0
mov qword [rsp + 0x50], rax
xor r13d, r13d
mov qword [rsp + 0x60], r13
mov ecx, dword [rdi + 0xec]
mov eax, ecx
and eax, 2
mov edx, 0x100
mov esi, 0x200
test al, al
je 0x140124221
mov r9d, esi
jmp 0x14012422b
test cl, 4
mov r9d, r13d
cmovne r9d, edx
mov qword [rsp + 0x58], r13
or r9d, 0x20017
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rdi + 0x110]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
sete r15b
mov r14d, 1
test eax, eax
je 0x140124368
call fcn.140015450
mov rcx, rax
test rax, rax
je 0x140124505
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1401242b2
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140017100
mov rbx, qword [rsp + 0x70]
mov r8, rbx
xor edx, edx
mov ecx, dword [rdi + 0xe8]
call fcn.1401bfd70
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140172bb4
test eax, eax
js 0x1401244fa
cmp eax, dword [rbx - 0xc]
jg 0x1401244fa
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov ecx, dword [rdi + 0xec]
mov eax, ecx
and eax, 2
test al, al
jne 0x140124306
test cl, 4
mov esi, r13d
mov eax, 0x100
cmovne esi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14012431b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
or esi, 0x20017
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
sete r15b
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140124368
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r15b, r15b
je 0x1401244ae
mov rcx, r12
call fcn.140113f70
mov edi, r13d
nop dword [rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1401659c0
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x80]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
cmp dword [rsp + 0x48], 0
jbe 0x1401244a2
mov r8d, 0xd
lea rdx, str.DefaultPreset
lea rcx, [rbp - 0x80]
call fcn.140189e34
test eax, eax
jne 0x14012449e
mov ecx, dword [rsp + 0x48]
call fcn.140146e5c
mov rbx, rax
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r8d, dword [rsp + 0x48]
test r8d, r8d
je 0x140124467
test rbx, rbx
je 0x140124467
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov rdx, rbx
mov rcx, r12
call fcn.140112e50
test al, al
jne 0x140124491
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
mov rdx, rbx
mov rcx, r12
call fcn.140113710
test rbx, rbx
je 0x14012449e
mov rcx, rbx
call fcn.140146bac
inc edi
jmp 0x1401244a5
mov r14d, r13d
test r14d, r14d
jne 0x140124380
lea rax, vtable.CMaxxAudioRegistryPreset.0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401244ca
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400151f0
nop
mov ecx, 0x80004005
call fcn.1400151f0
int3