Function at 0x140019680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rdx + 0x18], 0xf
mov qword [rdx + 0x10], r14
cmp qword [rdx + 0x18], 0x10
jb 0x1400196ed
mov rax, qword [rdx]
jmp 0x1400196f0
mov rax, r13
mov byte [rax], r14b
mov r15d, 1
mov dword [rsp + 0x30], r15d
xor bl, bl
mov eax, dword [rcx + 0x10]
cmp eax, 0xe
ja 0x140019716
mov ecx, 0x50b0
bt ecx, eax
jae 0x140019716
movzx ebx, r15b
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture_
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender_
test bl, bl
cmovne rdx, rax
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
cmp byte [rdx], 0
jne 0x140019744
mov r8, r14
jmp 0x14001975a
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140019750
lea rcx, [rbp + 8]
call fcn.140002500
nop
lea rax, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_17
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
test bl, bl
cmovne rdx, rax
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
cmp byte [rdx], 0
jne 0x140019792
mov r8, r14
jmp 0x1400197a0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140019796
lea rcx, [rbp - 0x38]
call fcn.140002500
nop
lea rax, [0x140088c78]
lea rdx, [0x140088c88]
test bl, bl
cmovne rdx, rax
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
cmp byte [rdx], 0
jne 0x1400197d8
mov r8, r14
jmp 0x1400197ea
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400197e0
lea rcx, [rbp - 0x18]
call fcn.140002500
nop
mov rbx, qword [rdi]
mov rbx, qword [rbx]
cmp qword [r13 + 0x10], 0
jne 0x14001a093
mov r12d, r15d
cmp rbx, qword [rdi]
je 0x140019fa3
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r14
mov byte [rbp - 0x58], 0
lea rdx, [rbx + 0x28]
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.140002630
nop
mov rcx, qword [rbp - 0x68]
cmp rcx, 1
jb 0x1400198a3
lea rax, [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
cmp r14, 0x10
cmovae rax, rsi
lea rdi, [rcx - 1]
add rdi, rax
nop dword [rax + rax]
cmp byte [rdi], 0x7b
sete al
test al, al
je 0x14001987f
cmp byte [rdi], 0x7b
je 0x140019892
lea rcx, [rbp - 0x78]
call fcn.140002440
cmp rdi, rax
je 0x1400198a3
dec rdi
jmp 0x140019870
lea rax, [rbp - 0x78]
cmp r14, 0x10
cmovae rax, rsi
sub rdi, rax
jmp 0x1400198a7
or rdi, 0xffffffffffffffff
cmp rdi, 0xffffffffffffffff
je 0x140019992
or r9, 0xffffffffffffffff
mov r8, rdi
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x78]
call fcn.14001ae20
mov rdi, rax
lea rax, [rbp - 0x58]
cmp rax, rdi
je 0x140019944
mov rcx, qword [rbp - 0x40]
cmp rcx, 0x10
jb 0x140019923
inc rcx
mov rdx, qword [rbp - 0x58]
cmp rcx, 0x1000
jb 0x14001991b
test dl, 0x1f
jne 0x140019eda
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140019ed4
sub rdx, rax
cmp rdx, 8
jb 0x140019ece
cmp rdx, 0x27
ja 0x140019ec8
mov rdx, rax
mov rcx, rdx
call fcn.14003ccec
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], 0
mov byte [rbp - 0x58], 0
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140002760
nop
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140019992
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x14001998d
test cl, 0x1f
jne 0x140019ef2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140019eec
sub rcx, rax
cmp rcx, 8
jb 0x140019ee6
cmp rcx, 0x27
ja 0x140019ee0
mov rcx, rax
call fcn.14003ccec
mov qword [rbp - 0x80], 0xf
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c340
lea r8d, [r14 + 0xb]
lea rdx, [0x140088c78]
lea rcx, [rsp + 0x68]
call fcn.14000c1f0
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140019a10
mov ecx, r14d
mov qword [rbp + 0x50], rcx
jmp 0x140019b0c
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140019a14
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002d00
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x140019a68
cmp eax, 0xc
je 0x140019f0e
cmp eax, 0x16
je 0x140019f03
cmp eax, 0x22
je 0x140019f03
cmp eax, 0x50
jne 0x140019ef8
xor sil, sil
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140019b0c
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140019b08
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x50]
test dil, dil
je 0x140019b0c
cmp dword [rsp + 0x40], 3
sete sil
jmp 0x140019b0c
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x58]
cmp rcx, rax
je 0x140019b1a
call fcn.14005fb6c
test sil, sil
jne 0x140019d66
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c340
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x68]
call fcn.14000c340
mov dword [rsp + 0x44], r14d
lea rsi, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rsi, qword [rbp - 0x38]
lea rax, [rbp + 0xe8]
mov qword [rbp + 0xe0], rax
test rsi, rsi
jne 0x140019b91
mov qword [rbp + 0xe0], r14
jmp 0x140019bf2
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140019b95
inc edi
lea r8, [rbp + 0xe8]
mov edx, edi
lea rcx, [rbp + 0xe0]
call fcn.140002d00
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0xe0]
call fcn.140001490
test eax, eax
je 0x140019bf2
cmp eax, 0xc
je 0x140019f2f
cmp eax, 0x16
je 0x140019f24
cmp eax, 0x22
je 0x140019f24
cmp eax, 0x50
jne 0x140019f19
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140019c21
mov rdx, r14
mov qword [rbp + 0x50], rdx
jmp 0x140019c7d
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140019c25
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002d00
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x140019c79
cmp eax, 0xc
je 0x140019f50
cmp eax, 0x16
je 0x140019f45
cmp eax, 0x22
je 0x140019f45
cmp eax, 0x50
jne 0x140019f3a
mov rdx, qword [rbp + 0x50]
mov r15d, r12d
or r15d, 6
mov rdi, qword [rbp + 0xe0]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140019d09
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x140019d09
cmp dword [rsp + 0x44], 1
jne 0x140019d09
mov dil, 1
jmp 0x140019d0c
xor dil, dil
and r15d, 0xfffffffb
lea rax, [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
cmp rcx, rax
je 0x140019d23
call fcn.14005fb6c
nop
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
lea rax, [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
cmp rcx, rax
je 0x140019d44
call fcn.14005fb6c
test dil, dil
je 0x140019d66
lea rax, [rbp - 0x78]
cmp r13, rax
je 0x140019d66
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, r13
call fcn.140002630
nop
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140019db5
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x140019db0
test cl, 0x1f
jne 0x140019f6d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140019f67
sub rcx, rax
cmp rcx, 8
jb 0x140019f61
cmp rcx, 0x27
ja 0x140019f5b
mov rcx, rax
call fcn.14003ccec
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x140019e15
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x140019e10
test cl, 0x1f
jne 0x140019f85
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140019f7f
sub rcx, rax
cmp rcx, 8
jb 0x140019f79
cmp rcx, 0x27
ja 0x140019f73
mov rcx, rax
call fcn.14003ccec
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x140019e73
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x140019e6e
test cl, 0x1f
jne 0x140019f9d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140019f97
sub rcx, rax
cmp rcx, 8
jb 0x140019f91
cmp rcx, 0x27
ja 0x140019f8b
mov rcx, rax
call fcn.14003ccec
cmp byte [rbx + 0x19], 0
jne 0x140019ebe
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x140019e9e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140019ebe
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140019e90
jmp 0x140019ebe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140019ebb
cmp rbx, qword [rax + 0x10]
jne 0x140019ebb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140019ea8
mov rbx, rax
mov rdi, qword [rsp + 0x48]
jmp 0x1400197fa
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
nop
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
nop
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
nop
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
call fcn.14005f9bc
int3
cmp qword [r13 + 0x10], 0
jne 0x14001a093
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.14001a460
mov rdx, rax
mov rcx, r13
call fcn.14000bfd0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x14001a01b
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x14001a016
test cl, 0x1f
je 0x140019fe9
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140019ff8
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001a007
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14001a013
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
cmp qword [r13 + 0x10], 0
jne 0x14001a093
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.140018de0
mov rdx, rax
mov rcx, r13
call fcn.14000bfd0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x14001a093
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x14001a08d
test cl, 0x1f
je 0x14001a060
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001a06f
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001a07e
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14001a08a
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
nop
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x14001a0e9
inc rax
mov rcx, qword [rbp - 0x18]
cmp rax, 0x1000
jb 0x14001a0e4
test cl, 0x1f
je 0x14001a0b7
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001a0c6
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001a0d5
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14001a0e1
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x14001a14f
inc rax
mov rcx, qword [rbp - 0x38]
cmp rax, 0x1000
jb 0x14001a14a
test cl, 0x1f
je 0x14001a11d
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001a12c
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001a13b
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14001a147
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14001a1b5
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14001a1b0
test cl, 0x1f
je 0x14001a183
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001a192
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001a1a1
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14001a1ad
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14003cd10
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret