Function at 0x140068ac0
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x2c0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x140069212
xor r13d, r13d
mov qword [r11 - 0x250], r13
lea rax, [r11 - 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140068b4e
mov rsi, qword [rsp + 0x88]
jmp 0x140068bbd
mov qword [rsp + 0x98], r13
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140069212
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x140068bbd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r13
mov qword [rsp + 0x90], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140069202
mov eax, r13d
test rsi, rsi
je 0x140068c08
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x70], rsi
test eax, eax
jne 0x140069202
call fcn.140129a50
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140068c3d
mov ecx, 0x80004005
call fcn.140002d80
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401489d0
mov dword [rsp + 0x64], 0x200
mov r12d, r13d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140068ce9
mov eax, dword [rsp + 0x7c]
cmp eax, 1
je 0x140068cb8
cmp eax, 2
jne 0x140068da2
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x140068cde
test cl, 1
jne 0x140068da2
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x140068da2
mov r12d, ecx
shr r12d, 1
jmp 0x140068da2
cmp eax, 2
jne 0x140068da2
lea r8, [rsp + 0x50]
lea edx, [rax - 1]
xor ecx, ecx
call fcn.140078820
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140068d1e
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002e00
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140068d36
mov ecx, 0x80004005
call fcn.140002d80
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140068d6f
mov ecx, r13d
jmp 0x140068d85
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140068d97
cmp ecx, dword [rbx - 0xc]
jg 0x140068d97
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140068da2
mov ecx, 0x80070057
call fcn.140002d80
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401489d0
lea edx, [r12 + r12]
mov dword [rsp + 0x60], edx
mov r12d, r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140068e42
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x140068e07
cmp eax, 2
jne 0x140068efd
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x140068e2e
test cl, 1
jne 0x140068efd
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
je 0x140068e37
jmp 0x140068efd
mov word [rsp + 0xb0], r12w
mov r12d, ecx
shr r12d, 1
jmp 0x140068efd
cmp eax, 2
jne 0x140068efd
lea r8, [rsp + 0x50]
mov edx, 1
mov ecx, edx
call fcn.140078820
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140068e79
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002e00
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140068e91
mov ecx, 0x80004005
call fcn.140002d80
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140068eca
mov ecx, r13d
jmp 0x140068ee0
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140068ef2
cmp ecx, dword [rbx - 0xc]
jg 0x140068ef2
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140068efd
mov ecx, 0x80070057
call fcn.140002d80
int3
mov eax, dword [0x140206d04]
test eax, eax
jne 0x140068f24
mov dword [0x140206d00], 0x114
lea rcx, [0x140206d00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x140206d04]
cmp eax, 6
jne 0x140068f37
cmp dword [0x140206d08], 1
jae 0x140068f40
jmp 0x1400691ca
cmp eax, 6
jbe 0x1400691ca
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401489d0
lea edx, [r12 + r12]
mov dword [rsp + 0x58], edx
mov r12d, r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140068fdc
mov eax, dword [rsp + 0x80]
cmp eax, 1
je 0x140068fab
cmp eax, 2
jne 0x140069094
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140068fd1
test cl, 1
jne 0x140069094
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x140069094
mov r12d, ecx
shr r12d, 1
jmp 0x140069094
cmp eax, 2
jne 0x140069094
lea r8, [rsp + 0x50]
mov edx, eax
xor ecx, ecx
call fcn.140078820
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140069010
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002e00
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140069028
mov ecx, 0x80004005
call fcn.140002d80
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069061
mov ecx, r13d
jmp 0x140069077
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069089
cmp ecx, dword [rbx - 0xc]
jg 0x140069089
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140069094
mov ecx, 0x80070057
call fcn.140002d80
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.1401489d0
lea edx, [r12 + r12]
mov dword [rsp + 0x5c], edx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140069110
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x1400690f6
cmp eax, 2
jne 0x1400691ca
cmp dword [rsp + 0x5c], 0
jne 0x1400691ca
mov word [rsp + 0xb0], 0
jmp 0x1400691ca
cmp eax, 2
jne 0x1400691ca
lea r8, [rsp + 0x50]
mov edx, eax
lea ecx, [rax - 1]
call fcn.140078820
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140069145
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002e00
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006915d
mov ecx, 0x80004005
call fcn.140002d80
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069196
mov ecx, r13d
jmp 0x1400691ac
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x1400691bf
cmp ecx, dword [rbx - 0xc]
jg 0x1400691bf
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x1400691ca
mov ecx, 0x80070057
call fcn.140002d80
int3
test rsi, rsi
je 0x1400691dd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x1400691fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x70]
jmp 0x140069202
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x140069212
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140069212
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1401447b0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret