Function at 0x14006a150
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x2c0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x14006a8a2
xor r13d, r13d
mov qword [r11 - 0x250], r13
lea rax, [r11 - 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a1de
mov rsi, qword [rsp + 0x88]
jmp 0x14006a24d
mov qword [rsp + 0x98], r13
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006a8a2
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x14006a24d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r13
mov qword [rsp + 0x90], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a892
mov eax, r13d
test rsi, rsi
je 0x14006a298
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x70], rsi
test eax, eax
jne 0x14006a892
call fcn.14013e120
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14006a2cd
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
mov dword [rsp + 0x64], 0x200
mov r12d, r13d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x14006a379
mov eax, dword [rsp + 0x7c]
cmp eax, 1
je 0x14006a348
cmp eax, 2
jne 0x14006a432
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x14006a36e
test cl, 1
jne 0x14006a432
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x14006a432
mov r12d, ecx
shr r12d, 1
jmp 0x14006a432
cmp eax, 2
jne 0x14006a432
lea r8, [rsp + 0x50]
lea edx, [rax - 1]
xor ecx, ecx
call fcn.14007b8d0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a3ae
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001cf0
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a3c6
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a3ff
mov ecx, r13d
jmp 0x14006a415
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a427
cmp ecx, dword [rbx - 0xc]
jg 0x14006a427
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x14006a432
mov ecx, 0x80070057
call fcn.140001c70
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r12 + r12]
mov dword [rsp + 0x60], edx
mov r12d, r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a4d2
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x14006a497
cmp eax, 2
jne 0x14006a58d
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x14006a4be
test cl, 1
jne 0x14006a58d
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
je 0x14006a4c7
jmp 0x14006a58d
mov word [rsp + 0xb0], r12w
mov r12d, ecx
shr r12d, 1
jmp 0x14006a58d
cmp eax, 2
jne 0x14006a58d
lea r8, [rsp + 0x50]
mov edx, 1
mov ecx, edx
call fcn.14007b8d0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a509
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001cf0
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a521
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a55a
mov ecx, r13d
jmp 0x14006a570
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a582
cmp ecx, dword [rbx - 0xc]
jg 0x14006a582
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x14006a58d
mov ecx, 0x80070057
call fcn.140001c70
int3
mov eax, dword [0x14022c3f4]
test eax, eax
jne 0x14006a5b4
mov dword [0x14022c3f0], 0x114
lea rcx, [0x14022c3f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022c3f4]
cmp eax, 6
jne 0x14006a5c7
cmp dword [0x14022c3f8], 1
jae 0x14006a5d0
jmp 0x14006a85a
cmp eax, 6
jbe 0x14006a85a
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r12 + r12]
mov dword [rsp + 0x58], edx
mov r12d, r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a66c
mov eax, dword [rsp + 0x80]
cmp eax, 1
je 0x14006a63b
cmp eax, 2
jne 0x14006a724
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x14006a661
test cl, 1
jne 0x14006a724
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x14006a724
mov r12d, ecx
shr r12d, 1
jmp 0x14006a724
cmp eax, 2
jne 0x14006a724
lea r8, [rsp + 0x50]
mov edx, eax
xor ecx, ecx
call fcn.14007b8d0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a6a0
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001cf0
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a6b8
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a6f1
mov ecx, r13d
jmp 0x14006a707
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a719
cmp ecx, dword [rbx - 0xc]
jg 0x14006a719
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x14006a724
mov ecx, 0x80070057
call fcn.140001c70
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401601f0
lea edx, [r12 + r12]
mov dword [rsp + 0x5c], edx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a7a0
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x14006a786
cmp eax, 2
jne 0x14006a85a
cmp dword [rsp + 0x5c], 0
jne 0x14006a85a
mov word [rsp + 0xb0], 0
jmp 0x14006a85a
cmp eax, 2
jne 0x14006a85a
lea r8, [rsp + 0x50]
mov edx, eax
lea ecx, [rax - 1]
call fcn.14007b8d0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a7d5
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001cf0
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a7ed
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a826
mov ecx, r13d
jmp 0x14006a83c
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a84f
cmp ecx, dword [rbx - 0xc]
jg 0x14006a84f
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006a85a
mov ecx, 0x80070057
call fcn.140001c70
int3
test rsi, rsi
je 0x14006a86d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14006a88d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x70]
jmp 0x14006a892
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14006a8a2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006a8a2
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14015b6f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret