Function at 0x14008c290
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0xd18
mov rax, qword [0x14016adb0]
xor rax, rsp
mov qword [rsp + 0xd00], rax
xor ebx, ebx
mov r12d, r8d
lea rax, [rsp + 0x58]
mov r13d, edx
lea r9, [rsp + 0x88]
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x17]
xor edx, edx
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x78], 0x294935ce
mov word [rsp + 0x7c], 0xf637
mov word [rsp + 0x7e], 0x4e7c
mov byte [rsp + 0x80], 0xa4
mov byte [rsp + 0x81], 0x1b
mov byte [rsp + 0x82], 0xab
mov byte [rsp + 0x83], 0x25
mov byte [rsp + 0x84], 0x54
mov byte [rsp + 0x85], 0x60
mov byte [rsp + 0x86], reloc.OLEAUT32.dll_VariantTimeToSystemTime
mov byte [rsp + 0x87], 0x62
mov dword [rsp + 0x88], 0x568b9108
mov word [rsp + 0x8c], 0x44bf
mov word [rsp + 0x8e], 0x40b4
mov byte [rsp + 0x90], 0x90
mov byte [rsp + 0x91], 6
mov byte [rsp + 0x92], 0x86
mov byte [rsp + 0x93], 0xaf
mov byte [rsp + 0x94], 0xe5
mov byte [rsp + 0x95], VariantTimeToSystemTime
mov byte [rsp + 0x96], 0xa6
mov byte [rsp + 0x97], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebp, eax
jns 0x14008c3a2
xor eax, eax
jmp 0x14008c8d2
lea rcx, [rsp + 0x2b0]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture_
mov r8d, 0x86
mov qword [rsp + 0xd40], rsi
call fcn.1400fd180
lea rcx, [rsp + 0x336]
xor edx, edx
mov r8d, 0x182
call fcn.1400fce30
lea rcx, [rsp + 0xaf0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x14008c427
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14008c427
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x2b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov esi, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x14008c454
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x2b0]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov esi, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008c45f
xor eax, eax
jmp 0x14008c8ca
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0xd48], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x6d0]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0xd50], r14
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0xd10], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r14d, 1
cmp eax, 0x103
mov edi, eax
movsxd r15, esi
je 0x14008c88c
test edi, edi
jne 0x14008c8fb
lea r8, str.0.0.1.00000000.
lea rcx, [rsp + 0x4c0]
mov edx, 0x104
call fcn.1400f9e00
lea r8, [rsp + 0x6d0]
lea rcx, [rsp + 0x4c0]
mov edx, 0x104
call fcn.1400fb090
lea r8, [rsp + 0x2b0]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov dword [rsp + 0x68], 4
call fcn.1400f9e00
lea r8, [rsp + 0x6d0]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call fcn.1400fb090
test r15, r15
je 0x14008c56e
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x14008c596
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c8fb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
lea rdx, str.DeviceState
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14008c8fb
mov eax, dword [rsp + 0x64]
and al, 0xf
cmp al, 1
jne 0x14008c83f
lea r8, [rsp + 0x2b0]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call fcn.1400f9e00
lea r8, [rsp + 0x6d0]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call fcn.1400fb090
lea r8, str.Properties
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call fcn.1400fb090
test r15, r15
je 0x14008c671
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x14008c699
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c8fb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008c90a
lea rsi, [rsp + 0x8e0]
lea rdi, str.VIA_High_Definition_Audio
mov ecx, 0x1a
repe cmpsw word [rsi], word [rdi]
je 0x14008c709
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008c83f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.a45c254e_df1c_4efd_8020_67d146a850e0_2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008c90a
lea rdx, [0x14013b818]
lea rcx, [rsp + 0x8e0]
call fcn.1400fa3c0
test rax, rax
je 0x14008c7ad
cmp r13d, 0xffffffff
je 0x14008c834
test r13d, r13d
je 0x14008c790
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4c0]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ebp, eax
jmp 0x14008c834
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4c0]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ebp, eax
jmp 0x14008c834
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008c8f0
cmp dword [rsp + 0x60], 0xa
jne 0x14008c834
cmp r12d, 0xffffffff
je 0x14008c834
test r12d, r12d
je 0x14008c81c
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4c0]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ebp, eax
jmp 0x14008c834
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4c0]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ebp, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x6d0]
mov edx, r14d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add r14d, 1
cmp eax, 0x103
mov edi, eax
jne 0x14008c4c8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14008c906
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14008c8ab
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
test ebp, ebp
setns bl
mov eax, ebx
mov r14, qword [rsp + 0xd50]
mov rdi, qword [rsp + 0xd48]
mov r15, qword [rsp + 0xd10]
mov rsi, qword [rsp + 0xd40]
mov rcx, qword [rsp + 0xd00]
xor rcx, rsp
call fcn.1400f9790
add rsp, 0xd18
pop r13
pop r12
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14008c8b2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14008c8b2