Function at 0x140022980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x140022cd5
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], r15
mov r9d, 0x20019
lea r8, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.140015610
test eax, eax
je 0x140022a70
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.1400153d0
test eax, eax
je 0x140022a56
lea r8, str.AudioDeviceMgr.cpp
mov edx, 0x758
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140022cc5
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140022a6b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov r9d, 0x2001f
lea r8, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.140015610
test eax, eax
jne 0x140022cc5
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140022f88
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.14029ff20
mov dword [rsp + 0x48], 0x200
mov esi, r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov r14, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x140022d01
mov eax, dword [rsp + 0x70]
dec eax
cmp eax, 1
ja 0x140022b36
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x140022b32
test cl, 1
jne 0x140022b36
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x72], si
jne 0x140022b36
mov esi, ecx
shr esi, 1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.14029ff20
lea eax, [rsi + rsi]
mov dword [rsp + 0x4c], eax
mov esi, r15d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022dad
mov eax, dword [rsp + 0x74]
dec eax
cmp eax, 1
ja 0x140022bb0
mov ecx, dword [rsp + 0x4c]
test ecx, ecx
je 0x140022d9f
test cl, 1
jne 0x140022bb0
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x72], si
je 0x140022da4
call fcn.140035a90
test eax, eax
je 0x140022c95
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.14029ff20
lea eax, [rsi + rsi]
mov dword [rsp + 0x50], eax
mov esi, r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022e4f
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 1
ja 0x140022c33
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140022c2f
test cl, 1
jne 0x140022c33
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x72], si
jne 0x140022c33
mov esi, ecx
shr esi, 1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.14029ff20
lea eax, [rsi + rsi]
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022eef
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x140022c95
cmp dword [rsp + 0x54], 0
jne 0x140022c95
mov word [rbp - 0x70], r15w
test r14, r14
je 0x140022ca8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140022cc5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140022cd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14029d880
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp eax, 2
jne 0x140022b36
lea r8, [rsp + 0x40]
lea edx, [rax - 1]
xor ecx, ecx
call fcn.140055570
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140022d36
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000dc90
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140022d73
mov rax, rdi
nop
lea rax, [rax + 1]
cmp word [rbx + rax*2], si
jne 0x140022d40
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1402a58a8
test eax, eax
js 0x140022f93
cmp eax, dword [rbx - 0xc]
jg 0x140022f93
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
jmp 0x140022b36
mov word [rbp - 0x70], r15w
mov esi, ecx
shr esi, 1
jmp 0x140022bb0
cmp eax, 2
jne 0x140022bb0
lea r8, [rsp + 0x40]
mov edx, 1
mov ecx, edx
call fcn.140055570
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140022de4
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000dc90
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140022e23
mov rax, rdi
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], si
jne 0x140022df0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1402a58a8
test eax, eax
js 0x140022f9e
cmp eax, dword [rbx - 0xc]
jg 0x140022f9e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
jmp 0x140022bb0
cmp eax, 2
jne 0x140022c33
lea r8, [rsp + 0x40]
mov edx, eax
xor ecx, ecx
call fcn.140055570
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140022e83
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000dc90
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140022ec3
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], si
jne 0x140022e90
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1402a58a8
test eax, eax
js 0x140022fa9
cmp eax, dword [rbx - 0xc]
jg 0x140022fa9
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
jmp 0x140022c33
cmp eax, 2
jne 0x140022c95
lea r8, [rsp + 0x40]
mov edx, eax
lea ecx, [rax - 1]
call fcn.140055570
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140022f24
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000dc90
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140022f64
mov rax, rdi
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x140022f30
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1402a58a8
test eax, eax
js 0x140022fb4
cmp eax, dword [rbx - 0xc]
jg 0x140022fb4
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
jmp 0x140022c95
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80070057
call fcn.14000de90
int3
mov ecx, 0x80070057
call fcn.14000de90
int3
mov ecx, 0x80070057
call fcn.14000de90
int3
mov ecx, 0x80070057
call fcn.14000de90
int3