Function at 0x140001c20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0x498
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r13d, r13d
lea rax, [rsp + 0x68]
mov rdi, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov ebp, r13d
mov r12d, r13d
mov qword [rsp + 0x60], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002256
mov qword [rsp + 0x4d0], rsi
mov qword [rsp + 0x490], r14
lea r14d, [r13 + 1]
mov qword [rsp + 0x4c8], rbx
mov esi, r13d
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x280]
mov edx, esi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000215f
lea r8, [rsp + 0x280]
lea rax, [rsp + 0x80]
mov ebx, r13d
mov edx, 0x200
lea rcx, [rsp + 0x80]
sub r8, rax
lea rax, [rdx + 0x7ffffdfe]
test rax, rax
je 0x140001d22
movzx eax, byte [r8 + rcx]
test al, al
je 0x140001d22
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x140001d01
jmp 0x140001d27
test rdx, rdx
jne 0x140001d2a
sub rcx, r14
mov byte [rcx], bl
lea rax, [rsp + 0x80]
mov ecx, 0x200
nop
nop
cmp byte [rax], bl
je 0x140001d4e
add rax, r14
sub rcx, r14
jne 0x140001d40
jmp 0x140001da7
test rcx, rcx
je 0x140001da7
mov edx, 0x200
mov r8d, 0x200
sub rdx, rcx
sub r8, rdx
lea rax, [rsp + rdx + 0x80]
je 0x140001da2
lea r9, str.Properties
lea rdx, [r8 + rdx + 0x7ffffdff]
sub r9, rax
test rdx, rdx
je 0x140001d9d
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x140001d9d
mov byte [rax], cl
sub rdx, r14
add rax, r14
sub r8, r14
jne 0x140001d80
jmp 0x140001da2
test r8, r8
jne 0x140001da5
sub rax, r14
mov byte [rax], bl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002162
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001e2d
lea rdx, str.IDT_High
lea rcx, [rsp + 0x80]
call fcn.140003e60
test rax, rax
cmovne ebx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140002162
mov ecx, 0x200
lea rax, [rsp + 0x280]
nop
cmp byte [rax], r13b
je 0x140001e5f
add rax, r14
sub rcx, r14
jne 0x140001e50
jmp 0x140001eb9
test rcx, rcx
je 0x140001eb9
mov r8d, 0x200
mov edx, 0x200
sub r8, rcx
sub rdx, r8
lea rax, [rsp + r8 + 0x280]
je 0x140001eb3
lea r9, str.FXProperties
lea r8, [rdx + r8 + 0x7ffffdff]
sub r9, rax
test r8, r8
je 0x140001eae
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x140001eae
mov byte [rax], cl
sub r8, r14
add rax, r14
sub rdx, r14
jne 0x140001e91
jmp 0x140001eb3
test rdx, rdx
jne 0x140001eb6
sub rax, r14
mov byte [rax], r13b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x280]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002162
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002152
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [rdi + 0x18], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov r12d, r14d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001f70
mov eax, dword [rsp + 0x54]
or dword [rdi + 4], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001fb1
mov eax, dword [rsp + 0x54]
or dword [rdi + 8], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001ff2
mov eax, dword [rsp + 0x54]
or dword [rdi + 0xc], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002033
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002074
mov eax, dword [rsp + 0x54]
or dword [rdi + 0x10], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400020b5
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x24], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002111
cmp dword [rsp + 0x54], r13d
je 0x140002111
mov dword [rdi + 0x28], 0x80000000
mov dword [rdi + 0x18], r13d
mov dword [rdi + 4], r13d
mov dword [rdi + 8], r13d
mov dword [rdi + 0xc], r13d
mov dword [rdi + 0x10], r13d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002152
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x2c], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002162
mov ebp, r14d
add esi, r14d
test ebp, ebp
je 0x140001ca0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
mov rsi, qword [rsp + 0x4d0]
je 0x140002246
cmp dword [rdi + 0x5c], r13d
mov dword [rdi], 0xaeaeaeae
jne 0x1400021a5
mov rdx, rdi
mov rcx, rdi
call fcn.1400015e0
jmp 0x140002246
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareIDTAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000222b
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, [0x140011fd8]
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, r13d
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14000222b
lea rdx, str.WriteRegistry_successful
jmp 0x140002232
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r13d
or r8d, r9d
call fcn.140001970
mov rbx, qword [rsp + 0x4c8]
mov r14, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140003f10
add rsp, 0x498
pop r13
pop r12
pop rdi
pop rbp
ret