Function at 0x140069720
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x14006a21f
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a21f
mov r15, qword [rsp + 0x38]
mov qword [rsp + 0x60], r15
call fcn.14012a060
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400697d3
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov edx, 0xa
lea rcx, [rsp + 0x68]
call fcn.14013e42c
nop
mov rdi, qword [rdi + 0xe50]
test rdi, rdi
je 0x140069833
mov rdx, rdi
test rdi, rdi
je 0x14006982d
mov rdi, qword [rdi]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140069826
add rdx, 0x118
lea rcx, [rsp + 0x68]
call fcn.14013e7dc
test rdi, rdi
jne 0x140069801
jmp 0x140069833
call fcn.140129ec4
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
mov dword [rsp + 0x44], 0x200
mov r13d, esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, 1
or r12, 0xffffffffffffffff
test eax, eax
jne 0x140069a91
mov eax, dword [rsp + 0x5c]
cmp eax, r14d
je 0x1400698a6
cmp eax, 2
jne 0x140069a91
mov ecx, dword [rsp + 0x44]
test ecx, ecx
je 0x1400698cd
test r14b, cl
jne 0x140069a91
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r13w
je 0x1400698d6
jmp 0x140069a91
mov word [rsp + 0xb0], r13w
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
xor ecx, ecx
call fcn.140078a70
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140069916
add rax, 2
test cx, cx
jne 0x140069900
mov eax, esi
jmp 0x14006991b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x140069a55
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x1400699a4
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140069a26
cmp dword [rdx + 0x10], eax
jge 0x140069970
cmp dword [rbx - 0xc], eax
jge 0x140069965
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x140069a26
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140069988
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x140069a26
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400699d5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002cd0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x1400699f5
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140144e50
jmp 0x140069a12
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.140144ee0
test edi, edi
js 0x140069a4a
cmp edi, dword [rbx - 0xc]
jg 0x140069a4a
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14013e560
test rax, rax
je 0x140069a55
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140078c20
jmp 0x140069a55
mov ecx, 0x80070057
call fcn.140002cb0
int3
test rbx, rbx
jne 0x140069a5e
mov ecx, esi
jmp 0x140069a73
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x140069a86
cmp ecx, dword [rbx - 0xc]
jg 0x140069a86
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x140069a91
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r13 + r13]
mov dword [rsp + 0x4c], edx
mov r13d, esi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140069ce6
mov eax, dword [rsp + 0x54]
cmp eax, r14d
je 0x140069afb
cmp eax, 2
jne 0x140069ce6
mov ecx, dword [rsp + 0x4c]
test ecx, ecx
je 0x140069b22
test r14b, cl
jne 0x140069ce6
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x140069b2c
jmp 0x140069ce6
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
mov ecx, r14d
call fcn.140078a70
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140069b6b
add rax, 2
test cx, cx
jne 0x140069b55
mov eax, esi
jmp 0x140069b70
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x140069caa
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x140069bf9
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140069c7b
cmp dword [rdx + 0x10], eax
jge 0x140069bc5
cmp dword [rbx - 0xc], eax
jge 0x140069bba
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x140069c7b
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140069bdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x140069c7b
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140069c2a
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002cd0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x140069c4a
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140144e50
jmp 0x140069c67
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.140144ee0
test edi, edi
js 0x140069c9f
cmp edi, dword [rbx - 0xc]
jg 0x140069c9f
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14013e560
test rax, rax
je 0x140069caa
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140078c20
jmp 0x140069caa
mov ecx, 0x80070057
call fcn.140002cb0
int3
test rbx, rbx
jne 0x140069cb3
mov ecx, esi
jmp 0x140069cc8
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x140069cdb
cmp ecx, dword [rbx - 0xc]
jg 0x140069cdb
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x140069ce6
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov eax, dword [0x140206d04]
test eax, eax
jne 0x140069d0d
mov dword [0x140206d00], 0x114
lea rcx, [0x140206d00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x140206d04]
cmp eax, 6
jne 0x140069d20
cmp dword [0x140206d08], r14d
jae 0x140069d29
jmp 0x14006a1ce
cmp eax, 6
jbe 0x14006a1ce
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r13 + r13]
mov dword [rsp + 0x40], edx
mov r13d, esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140069f83
mov eax, dword [rsp + 0x50]
cmp eax, r14d
je 0x140069d93
cmp eax, 2
jne 0x140069f83
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140069dba
test r14b, cl
jne 0x140069f83
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x140069dc4
jmp 0x140069f83
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, 2
xor ecx, ecx
call fcn.140078a70
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140069e06
add rax, 2
test cx, cx
jne 0x140069df0
mov eax, esi
jmp 0x140069e0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x140069f47
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x140069e94
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140069f16
cmp dword [rdx + 0x10], eax
jge 0x140069e60
cmp dword [rbx - 0xc], eax
jge 0x140069e55
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x140069f16
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140069e78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x140069f16
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140069ec5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002cd0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x140069ee5
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140144e50
jmp 0x140069f02
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.140144ee0
test edi, edi
js 0x140069f3c
cmp edi, dword [rbx - 0xc]
jg 0x140069f3c
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14013e560
test rax, rax
je 0x140069f47
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140078c20
jmp 0x140069f47
mov ecx, 0x80070057
call fcn.140002cb0
int3
test rbx, rbx
jne 0x140069f50
mov ecx, esi
jmp 0x140069f65
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x140069f78
cmp ecx, dword [rbx - 0xc]
jg 0x140069f78
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x140069f83
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r13 + r13]
mov dword [rsp + 0x48], edx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a1ce
mov eax, dword [rsp + 0x58]
cmp eax, r14d
je 0x140069fea
cmp eax, 2
jne 0x14006a1ce
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14006a00e
test r14b, al
jne 0x14006a1ce
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006a018
jmp 0x14006a1ce
mov word [rsp + 0xb0], 0
lea r8, [rsp + 0x30]
mov edx, 2
mov ecx, r14d
call fcn.140078a70
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006a056
add rax, 2
test cx, cx
jne 0x14006a040
mov eax, esi
jmp 0x14006a05b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006a191
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006a0e1
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006a160
cmp dword [rdx + 0x10], eax
jge 0x14006a0b0
cmp dword [rbx - 0xc], eax
jge 0x14006a0a5
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006a160
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006a0c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006a160
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, r14d
jge 0x14006a111
mov edx, ecx
lea rcx, [rsp + 0x30]
call fcn.140002cd0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006a131
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140144e50
jmp 0x14006a14e
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.140144ee0
test edi, edi
js 0x14006a186
cmp edi, dword [rbx - 0xc]
jg 0x14006a186
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14013e560
test rax, rax
je 0x14006a191
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140078c20
jmp 0x14006a191
mov ecx, 0x80070057
call fcn.140002cb0
int3
test rbx, rbx
jne 0x14006a19a
xor ecx, ecx
jmp 0x14006a1b0
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a1c3
cmp ecx, dword [rbx - 0xc]
jg 0x14006a1c3
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006a1ce
mov ecx, 0x80070057
call fcn.140002cb0
int3
test r15, r15
je 0x14006a1e5
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x68]
call fcn.14013e62c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14006a20d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006a21f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006a21f
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret