Function at 0x140126d60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x890
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor r12d, r12d
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov esi, r12d
mov ebp, r12d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401272f0
mov qword [rsp + 0x8b8], rdi
mov qword [rsp + 0x8c0], r13
lea r13d, [r12 + 1]
mov qword [rsp + 0x8b0], rbx
mov edi, r12d
nop
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x480]
mov edx, edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1401271e5
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x80]
mov edx, 0x200
mov ebx, r12d
call fcn.1401469a0
lea r8, str.Properties
lea rcx, [rsp + 0x80]
mov edx, 0x200
call fcn.140146a50
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401271e8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140126eda
lea rdx, str.Realtek
lea rcx, [rsp + 0x80]
call fcn.140145480
test rax, rax
cmovne ebx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401271e8
lea r8, str.FXProperties
lea rcx, [rsp + 0x480]
mov edx, 0x200
call fcn.140146a50
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x480]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401271e8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401271d8
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [0x140208438], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov ebp, r13d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140126fc3
mov eax, dword [rsp + 0x54]
or dword [0x140208424], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140127007
mov eax, dword [rsp + 0x54]
or dword [0x140208428], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012704b
mov eax, dword [rsp + 0x54]
or dword [0x14020842c], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x140208434]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x140208434], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401270d8
mov eax, dword [rsp + 0x54]
or dword [0x140208430], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x140208444]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x140208444], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012718f
cmp dword [rsp + 0x54], r12d
je 0x14012718f
mov dword [0x140208448], 0x80000000
mov dword [0x140208438], r12d
mov dword [0x140208424], r12d
mov dword [0x140208428], r12d
mov dword [0x14020842c], r12d
mov dword [0x140208430], r12d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14020844c]
test eax, eax
cmove ecx, dword [rsp + 0x54]
mov dword [0x14020844c], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401271e8
mov esi, r13d
add edi, r13d
test esi, esi
je 0x140126de0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1401272d8
cmp dword [0x14020847c], r12d
mov dword [0x140208420], 0xaeaeaeae
jne 0x140127230
lea rdi, [0x140208420]
mov rdx, rdi
mov rcx, rdi
call fcn.140126580
jmp 0x1401272d8
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x140208420]
test eax, eax
jne 0x1401272bd
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, str.CapProperties
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov ebx, r12d
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401272bd
lea rdx, str.WriteRegistry_successful
jmp 0x1401272c4
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r12d
or r8d, r9d
call fcn.140126a00
mov rbx, qword [rsp + 0x8b0]
mov rdi, qword [rsp + 0x8b8]
mov r13, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.140144dc0
add rsp, 0x890
pop r12
pop rsi
pop rbp
ret