Function at 0x1400186e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, edx
mov rbx, rcx
xor esi, esi
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov r8d, 0x208
call fcn.140034ac0
lea rcx, str.Capture
mov qword [rsp + 0x28], rbx
test edi, edi
lea rax, str.Render
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudio
mov edx, 0x104
cmovne rax, rcx
lea r8, str._s_s_sFxProperties
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140009eb0
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018b55
mov ecx, dword [0x140069390]
mov eax, dword [0x140069380]
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x278], r12
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
test ecx, ecx
jne 0x1400187ca
test eax, eax
jne 0x1400187ca
lea r13, str.F005D60E_B43A_46CF_BAD3_6ACB1D314511
mov ebp, esi
jmp 0x1400187f2
lea r13, str.FC6D7D4E_5D4B_4CF6_AC04_7A585769B45F
test ecx, ecx
jne 0x1400187de
test eax, eax
jne 0x1400187de
mov rbp, rsi
jmp 0x1400187f2
test edi, edi
lea rax, str.FB19AA08_04A2_4810_8846_DF71A3DA56DB
lea rbp, str.FD278210_3175_4909_B46A_DF2CA8C20D46
cmovne rbp, rax
mov r15, qword [rsp + 0x30]
mov r12d, 0x200
mov ecx, r12d
mov edi, esi
mov ebx, r12d
call fcn.14003fd84
mov r14, rax
mov esi, 1
test rax, rax
je 0x1400188ea
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_5
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x14001887a
lea eax, [rbx + 0x1000]
cmp ebx, 0x1000
lea ecx, [rbx + rbx]
cmovae ecx, eax
mov ebx, ecx
mov edx, ecx
mov rcx, r14
call fcn.1400404ec
mov r14, rax
test rax, rax
jne 0x140018820
jmp 0x1400188ea
test eax, eax
jne 0x1400188da
mov rbx, r14
cmp word [r14], di
je 0x1400188da
test edi, edi
jne 0x1400188da
mov rdx, r13
mov rcx, rbx
call fcn.1400400ac
test eax, eax
jne 0x14001889e
mov edi, esi
jmp 0x1400188b3
test rbp, rbp
je 0x1400188b3
mov rdx, rbp
mov rcx, rbx
call fcn.1400400ac
test eax, eax
cmove edi, esi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400188c0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140018887
mov rcx, r14
call fcn.14003fd8c
test edi, edi
jne 0x140018b22
mov r15, qword [rsp + 0x30]
mov rcx, r12
xor edi, edi
mov ebx, r12d
call fcn.14003fd84
mov r14, rax
test rax, rax
je 0x1400189da
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_6
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x14001896a
lea eax, [rbx + 0x1000]
cmp ebx, 0x1000
lea ecx, [rbx + rbx]
cmovae ecx, eax
mov ebx, ecx
mov edx, ecx
mov rcx, r14
call fcn.1400404ec
mov r14, rax
test rax, rax
jne 0x140018910
jmp 0x1400189da
test eax, eax
jne 0x1400189ca
mov rbx, r14
cmp word [r14], di
je 0x1400189ca
test edi, edi
jne 0x1400189ca
mov rdx, r13
mov rcx, rbx
call fcn.1400400ac
test eax, eax
jne 0x14001898e
mov edi, esi
jmp 0x1400189a3
test rbp, rbp
je 0x1400189a3
mov rdx, rbp
mov rcx, rbx
call fcn.1400400ac
test eax, eax
cmove edi, esi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400189b0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140018977
mov rcx, r14
call fcn.14003fd8c
test edi, edi
jne 0x140018b22
mov r15, qword [rsp + 0x30]
mov rcx, r12
xor edi, edi
call fcn.14003fd84
mov r14, rax
test rax, rax
je 0x140018ac9
nop word [rax + rax]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_7
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x140018a60
lea eax, [r12 + 0x1000]
cmp r12d, 0x1000
lea ecx, [r12 + r12]
cmovae ecx, eax
mov r12d, ecx
mov edx, ecx
mov rcx, r14
call fcn.1400404ec
mov r14, rax
test rax, rax
jne 0x140018a00
jmp 0x140018ac9
test eax, eax
jne 0x140018abd
mov rbx, r14
cmp word [r14], di
je 0x140018abd
nop dword [rax]
test edi, edi
jne 0x140018abd
mov rdx, r13
mov rcx, rbx
call fcn.1400400ac
test eax, eax
jne 0x140018a87
mov edi, esi
jmp 0x140018a9c
test rbp, rbp
je 0x140018a9c
mov rdx, rbp
mov rcx, rbx
call fcn.1400400ac
test eax, eax
cmove edi, esi
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140018aa3
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140018a70
mov rcx, r14
call fcn.14003fd8c
test edi, edi
jne 0x140018b22
mov rcx, qword [rsp + 0x30]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_13
mov r9, rbp
mov r8, r13
call fcn.140027950
test eax, eax
jne 0x140018b22
mov rcx, qword [rsp + 0x30]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_14
mov r9, rbp
mov r8, r13
call fcn.140027950
test eax, eax
jne 0x140018b22
mov rcx, qword [rsp + 0x30]
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_15
mov r9, rbp
mov r8, r13
call fcn.140027950
test eax, eax
mov eax, 0
cmovne eax, esi
mov esi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r15, qword [rsp + 0x260]
mov r14, qword [rsp + 0x268]
mov r13, qword [rsp + 0x270]
mov r12, qword [rsp + 0x278]
mov rbp, qword [rsp + 0x2b0]
mov eax, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret