Function at 0x140068f60
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x2c0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x1400696b2
xor r13d, r13d
mov qword [r11 - 0x250], r13
lea rax, [r11 - 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140068fee
mov rsi, qword [rsp + 0x88]
jmp 0x14006905d
mov qword [rsp + 0x98], r13
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400696b2
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x14006905d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r13
mov qword [rsp + 0x90], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400696a2
mov eax, r13d
test rsi, rsi
je 0x1400690a8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x70], rsi
test eax, eax
jne 0x1400696a2
call fcn.14012a060
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400690dd
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
mov dword [rsp + 0x64], 0x200
mov r12d, r13d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140069189
mov eax, dword [rsp + 0x7c]
cmp eax, 1
je 0x140069158
cmp eax, 2
jne 0x140069242
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x14006917e
test cl, 1
jne 0x140069242
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x140069242
mov r12d, ecx
shr r12d, 1
jmp 0x140069242
cmp eax, 2
jne 0x140069242
lea r8, [rsp + 0x50]
lea edx, [rax - 1]
xor ecx, ecx
call fcn.140078a70
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x1400691be
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x1400691d6
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006920f
mov ecx, r13d
jmp 0x140069225
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069237
cmp ecx, dword [rbx - 0xc]
jg 0x140069237
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140069242
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r12 + r12]
mov dword [rsp + 0x60], edx
mov r12d, r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400692e2
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x1400692a7
cmp eax, 2
jne 0x14006939d
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x1400692ce
test cl, 1
jne 0x14006939d
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
je 0x1400692d7
jmp 0x14006939d
mov word [rsp + 0xb0], r12w
mov r12d, ecx
shr r12d, 1
jmp 0x14006939d
cmp eax, 2
jne 0x14006939d
lea r8, [rsp + 0x50]
mov edx, 1
mov ecx, edx
call fcn.140078a70
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140069319
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140069331
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006936a
mov ecx, r13d
jmp 0x140069380
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069392
cmp ecx, dword [rbx - 0xc]
jg 0x140069392
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x14006939d
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov eax, dword [0x140206d04]
test eax, eax
jne 0x1400693c4
mov dword [0x140206d00], 0x114
lea rcx, [0x140206d00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x140206d04]
cmp eax, 6
jne 0x1400693d7
cmp dword [0x140206d08], 1
jae 0x1400693e0
jmp 0x14006966a
cmp eax, 6
jbe 0x14006966a
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r12 + r12]
mov dword [rsp + 0x58], edx
mov r12d, r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006947c
mov eax, dword [rsp + 0x80]
cmp eax, 1
je 0x14006944b
cmp eax, 2
jne 0x140069534
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140069471
test cl, 1
jne 0x140069534
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x140069534
mov r12d, ecx
shr r12d, 1
jmp 0x140069534
cmp eax, 2
jne 0x140069534
lea r8, [rsp + 0x50]
mov edx, eax
xor ecx, ecx
call fcn.140078a70
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x1400694b0
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x1400694c8
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069501
mov ecx, r13d
jmp 0x140069517
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069529
cmp ecx, dword [rbx - 0xc]
jg 0x140069529
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140069534
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140148fe0
lea edx, [r12 + r12]
mov dword [rsp + 0x5c], edx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400695b0
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x140069596
cmp eax, 2
jne 0x14006966a
cmp dword [rsp + 0x5c], 0
jne 0x14006966a
mov word [rsp + 0xb0], 0
jmp 0x14006966a
cmp eax, 2
jne 0x14006966a
lea r8, [rsp + 0x50]
mov edx, eax
lea ecx, [rax - 1]
call fcn.140078a70
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x1400695e5
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002d30
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x1400695fd
mov ecx, 0x80004005
call fcn.140002cb0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069636
mov ecx, r13d
jmp 0x14006964c
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006965f
cmp ecx, dword [rbx - 0xc]
jg 0x14006965f
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006966a
mov ecx, 0x80070057
call fcn.140002cb0
int3
test rsi, rsi
je 0x14006967d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14006969d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x70]
jmp 0x1400696a2
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x1400696b2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400696b2
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret