Function at 0x140007140
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov r13, rdx
mov r14, rcx
call fcn.14004b0d0
mov rcx, rax
xor esi, esi
mov r8d, esi
test rax, rax
setne r8b
test r8d, r8d
jne 0x14000718e
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, 0xa
mov dword [rsp + 0x2c0], r15d
call fcn.14004b0d0
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400071ca
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
call qword [0x140123120]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
or ebp, 0xffffffff
mov r9d, ebp
lea r8, str.SoftwareWow6432NodeRealtekAudioInstaller
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r12d, [rax - 1]
test r12d, r12d
jle 0x140007273
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, r12d
or ecx, edx
jge 0x14000722f
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.140004650
mov rbx, qword [rsp + 0x30]
call qword [0x140123120]
mov ecx, eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9d, ebp
lea r8, str.SoftwareWow6432NodeRealtekAudioInstaller
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp r12d, dword [rbx - 0xc]
jg 0x140007268
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
mov word [rbx + rax*2], 0
jmp 0x1400072d0
mov ecx, 0x80070057
call fcn.140001610
int3
lea rdx, [rbx - 0x18]
mov r12, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400072d0
cmp dword [rdx + 0x10], 0
jge 0x1400072a1
cmp dword [rbx - 0xc], 0
jge 0x140007297
mov ecx, 0x80070057
call fcn.140001610
int3
mov dword [rbx - 0x10], esi
mov word [rbx], 0
jmp 0x1400072d0
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400072b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov rdi, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007347
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x2c8], 4
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.IADelayChk
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x2c0]
test eax, eax
cmove eax, r15d
mov dword [rsp + 0x2c0], eax
test eax, eax
jle 0x14000739b
nop
lea rcx, [rsp + 0x60]
mov rdx, r13
mov r8d, 0x20c
call fcn.140091b50
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140002190
test eax, eax
jne 0x14000739b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, 1
cmp esi, dword [rsp + 0x2c0]
jl 0x140007360
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400073b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x1400073d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret