Function at 0x421f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov ebx, edx
mov esi, ecx
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x78], r12
call fcn.0049d8dc
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x421fa2
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.0049d8dc
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x421fd4
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x88], 0
xor eax, eax
mov qword [rsp + 0x8a], rax
mov dword [rsp + 0x92], eax
mov word [rsp + 0x96], ax
mov dword [rsp + 0x68], r12d
lea edx, [rax + 0xa]
lea rcx, [rsp + 0xb0]
call fcn.0049c2a8
lea r11, [0x004f93a0]
mov qword [rsp + 0xb0], r11
mov r15d, r12d
mov r13d, r12d
mov dword [rsp + 0x150], r12d
mov dword [rsp + 0x70], r12d
xor eax, eax
mov dword [rsp + 0x74], eax
lea rcx, [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test ebx, ebx
jne 0x42213f
test esi, esi
jne 0x422092
xor r9d, r9d
lea r8, str.RenderDefaultFixed
lea rdx, str.General
lea rcx, [0x0053fac0]
call fcn.004a0ffc
jmp 0x4220af
xor r9d, r9d
lea r8, str.CaptureDefaultFixed
lea rdx, str.General
lea rcx, [0x0053fac0]
call fcn.004a0ffc
cmp eax, 1
jne 0x42213f
lea rcx, [rsp + 0xb0]
call fcn.0049c2d0
nop
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x4220e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x422104
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x422115
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x422126
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x422926
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x422926
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x004f8b98]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x004f8b78]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4221f2
lea rcx, [rsp + 0xb0]
call fcn.0049c2d0
nop
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x422198
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4221b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4221c8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x4221d9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x422926
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x422926
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
mov r8d, 9
mov edx, esi
call qword [rax + 0x18]
test eax, eax
jns 0x422299
lea rcx, [rsp + 0xb0]
call fcn.0049c2d0
nop
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x42223f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x42225e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x42226f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x422280
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x422926
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x422926
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x18]
test eax, eax
jns 0x422338
lea rcx, [rsp + 0xb0]
call fcn.0049c2d0
nop
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x4222de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4222fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x42230e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x42231f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x422926
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x422926
mov r14d, r12d
or rbx, 0xffffffffffffffff
cmp dword [rsp + 0x50], r13d
jbe 0x422700
lea rbp, str.Render_
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x422366
mov qword [rsp + 0x30], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, r14d
call qword [rax + 0x20]
test eax, eax
js 0x4226d1
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
call qword [rax + 0x28]
test eax, eax
js 0x4226d1
xor eax, eax
mov rcx, rbx
lea rdi, [0x004f7838]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x004f7838]
lea rcx, [rsp + 0x40]
call fcn.00409ff0
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.0040a2d0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [rsp + 0x158], r12d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x158]
call qword [rax + 0x30]
test eax, eax
js 0x4226cc
xor eax, eax
mov rcx, rbx
lea rdi, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudio_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudio_
lea rcx, [rsp + 0x38]
call fcn.00409ff0
lea rdx, str.Capture_
test esi, esi
cmove rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.0040a2d0
mov rdi, qword [rsp + 0x40]
cmp dword [rdi - 0x10], 0
jge 0x422453
mov eax, ebx
jmp 0x422471
lea rdx, [0x004f7610]
mov rcx, rdi
call fcn.004c83e0
test rax, rax
jne 0x42246b
mov eax, ebx
jmp 0x422471
sub rax, rdi
sar rax, 1
lea r8d, [rax + 2]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.00409920
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.004094d0
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4224b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x4224d4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0xa0], r12
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4226cc
mov eax, r12d
test rdi, rdi
je 0x42251d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x78], rcx
test eax, eax
jne 0x4226cc
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x68], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.Role:0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4226cc
cmp dword [rsp + 0x98], 3
jne 0x4226cc
lea ecx, [rax + 0x18]
call fcn.00490410
mov r13, rax
test rax, rax
je 0x4226ba
call fcn.0049d8dc
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
je 0x4226f5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [r13], rax
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.0040a1e0
lea rdx, [r13 + 8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [rsp + 0x158]
mov dword [r13 + 0x10], edx
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
je 0x42265a
nop
nop
nop
nop
mov rsi, rdi
mov rcx, rdi
test rdi, rdi
je 0x4226ef
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x42263e
add rcx, 8
lea rdx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
je 0x422645
test rdi, rdi
je 0x42265a
jmp 0x422610
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.0049c3d4
jmp 0x42266a
mov rdx, r13
lea rcx, [rsp + 0xb0]
call fcn.0049c398
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
mov edi, 1
cmove r15d, edi
cmp dword [rsp + 0x158], edi
je 0x4226c4
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov r13d, dword [rsp + 0x150]
cmp eax, edi
cmove r13d, edi
mov dword [rsp + 0x150], r13d
mov rdi, qword [rsp + 0x40]
jmp 0x4226d1
mov r13d, dword [rsp + 0x150]
jmp 0x4226cc
mov r13d, dword [rsp + 0x150]
mov rdi, qword [rsp + 0x40]
add r14d, 1
cmp r14d, dword [rsp + 0x50]
jae 0x422700
mov esi, dword [rsp + 0x140]
lea rbp, str.Render_
jmp 0x422351
call fcn.0049c5dc
int3
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x422715
mov qword [rsp + 0x30], r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test r15d, r15d
je 0x4227db
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x004f7818]
mov r14d, 1
mov r8d, r14d
xor edx, edx
lea rcx, [0x004f77c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4227cb
mov rsi, qword [rsp + 0xb8]
test rsi, rsi
je 0x4227cb
nop
mov rbp, rsi
test rsi, rsi
je 0x4227c5
mov rsi, qword [rsi]
mov rbp, qword [rbp + 0x10]
test rbp, rbp
je 0x4227be
cmp dword [rbp + 0x10], r14d
jne 0x4227be
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbp]
call qword [rax + 0x60]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov r8d, r14d
mov rdx, qword [rbp]
call qword [rax + 0x60]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov r8d, 2
mov rdx, qword [rbp]
call qword [rax + 0x60]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
jne 0x422760
jmp 0x4227cb
call fcn.0049c5dc
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x4227db
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rsp + 0x140], 0
jne 0x42280b
test r13d, r13d
sete r12b
mov r9d, r12d
lea r8, str.RenderDefaultFixed
lea rdx, str.General
lea rcx, [0x0053fac0]
call fcn.004a108c
jmp 0x42282f
test r13d, r13d
sete r12b
mov r9d, r12d
lea r8, str.CaptureDefaultFixed
lea rdx, str.General
lea rcx, [0x0053fac0]
call fcn.004a108c
mov rsi, qword [rsp + 0xb8]
test rsi, rsi
je 0x42288c
nop
mov rdi, rsi
test rsi, rsi
je 0x422886
mov rsi, qword [rsi]
mov rdi, qword [rdi + 0x10]
test rdi, rdi
je 0x42287a
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x422872
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdi
call fcn.00490454
test rsi, rsi
jne 0x422840
mov rdi, qword [rsp + 0x40]
jmp 0x42288c
call fcn.0049c5dc
int3
lea rcx, [rsp + 0xb0]
call fcn.0049c13c
nop
lea rcx, [rsp + 0xb0]
call fcn.0049c2d0
nop
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4228c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4228e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x4228f4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x422905
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x422916
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x422926
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret