Function at 0x140020330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, edx
mov rbx, rcx
xor esi, esi
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x40], rsi
mov r8d, 0x208
call fcn.1400423d0
lea rcx, str.Capture
test edi, edi
lea rax, str.Render
mov edx, 0x104
cmovne rax, rcx
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudio
lea rcx, str.FxProperties
mov qword [rsp + 0x30], rcx
lea r8, str._s_s_s_s
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000a160
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400206e0
mov ecx, dword [0x14007b550]
mov eax, dword [0x14007b540]
mov qword [rsp + 0x2c0], rbp
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x280], r13
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x270], r15
test ecx, ecx
jne 0x140020426
test eax, eax
jne 0x140020426
lea r13, str.F005D60E_B43A_46CF_BAD3_6ACB1D314511
mov ebp, esi
jmp 0x14002044e
lea r13, str.FC6D7D4E_5D4B_4CF6_AC04_7A585769B45F
test ecx, ecx
jne 0x14002043a
test eax, eax
jne 0x14002043a
mov rbp, rsi
jmp 0x14002044e
test edi, edi
lea rax, str.FB19AA08_04A2_4810_8846_DF71A3DA56DB
lea rbp, str.FD278210_3175_4909_B46A_DF2CA8C20D46
cmovne rbp, rax
mov r12, qword [rsp + 0x40]
mov r15d, 0x200
mov ecx, r15d
mov edi, esi
mov ebx, r15d
call fcn.14004d694
mov r14, rax
mov esi, 1
test rax, rax
je 0x14002054a
nop word [rax + rax]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_5
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1400204da
lea eax, [rbx + 0x1000]
cmp ebx, 0x1000
lea ecx, [rbx + rbx]
cmovae ecx, eax
mov ebx, ecx
mov edx, ecx
mov rcx, r14
call fcn.14004dea0
mov r14, rax
test rax, rax
jne 0x140020480
jmp 0x14002054a
test eax, eax
jne 0x14002053a
mov rbx, r14
cmp word [r14], di
je 0x14002053a
test edi, edi
jne 0x14002053a
mov rdx, r13
mov rcx, rbx
call fcn.14004da60
test eax, eax
jne 0x1400204fe
mov edi, esi
jmp 0x140020513
test rbp, rbp
je 0x140020513
mov rdx, rbp
mov rcx, rbx
call fcn.14004da60
test eax, eax
cmove edi, esi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140020520
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x1400204e7
mov rcx, r14
call fcn.14004d69c
test edi, edi
jne 0x1400206ad
mov r12, qword [rsp + 0x40]
mov rcx, r15
xor edi, edi
call fcn.14004d694
mov r14, rax
test rax, rax
je 0x140020639
nop word [rax + rax]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_6
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1400205cf
lea eax, [r15 + 0x1000]
cmp r15d, 0x1000
lea ecx, [r15 + r15]
cmovae ecx, eax
mov r15d, ecx
mov edx, ecx
mov rcx, r14
call fcn.14004dea0
mov r14, rax
test rax, rax
jne 0x140020570
jmp 0x140020639
test eax, eax
jne 0x14002062d
mov rbx, r14
cmp word [r14], di
je 0x14002062d
nop dword [rax]
test edi, edi
jne 0x14002062d
mov rdx, r13
mov rcx, rbx
call fcn.14004da60
test eax, eax
jne 0x1400205f7
mov edi, esi
jmp 0x14002060c
test rbp, rbp
je 0x14002060c
mov rdx, rbp
mov rcx, rbx
call fcn.14004da60
test eax, eax
cmove edi, esi
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140020613
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x1400205e0
mov rcx, r14
call fcn.14004d69c
test edi, edi
jne 0x1400206ad
mov rcx, qword [rsp + 0x40]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_7
mov r9, rbp
mov r8, r13
call fcn.140031e50
test eax, eax
jne 0x1400206ad
mov rcx, qword [rsp + 0x40]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_13
mov r9, rbp
mov r8, r13
call fcn.140031e50
test eax, eax
jne 0x1400206ad
mov rcx, qword [rsp + 0x40]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_14
mov r9, rbp
mov r8, r13
call fcn.140031e50
test eax, eax
jne 0x1400206ad
mov rcx, qword [rsp + 0x40]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_15
mov r9, rbp
mov r8, r13
call fcn.140031e50
test eax, eax
mov eax, 0
cmovne eax, esi
mov esi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r15, qword [rsp + 0x270]
mov r14, qword [rsp + 0x278]
mov r13, qword [rsp + 0x280]
mov r12, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2c0]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x290
pop rdi
pop rsi
pop rbx
ret