Function at 0x1401ea330
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x890
mov rax, qword [0x140315d90]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor r12d, r12d
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov esi, r12d
mov ebp, r12d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ea8c0
mov qword [rsp + 0x8b8], rdi
mov qword [rsp + 0x8c0], r13
lea r13d, [r12 + 1]
mov qword [rsp + 0x8b0], rbx
mov edi, r12d
nop
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x480]
mov edx, edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1401ea7b5
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x80]
mov edx, 0x200
mov ebx, r12d
call fcn.1402285e0
lea r8, str.Properties
lea rcx, [rsp + 0x80]
mov edx, 0x200
call fcn.140228690
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ea7b8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea4aa
lea rdx, str.Realtek
lea rcx, [rsp + 0x80]
call fcn.140228250
test rax, rax
cmovne ebx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401ea7b8
lea r8, str.FXProperties
lea rcx, [rsp + 0x480]
mov edx, 0x200
call fcn.140228690
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x480]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ea7b8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea7a8
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [0x14032def8], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov ebp, r13d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea593
mov eax, dword [rsp + 0x54]
or dword [0x14032dee4], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea5d7
mov eax, dword [rsp + 0x54]
or dword [0x14032dee8], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea61b
mov eax, dword [rsp + 0x54]
or dword [0x14032deec], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14032def4]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x14032def4], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea6a8
mov eax, dword [rsp + 0x54]
or dword [0x14032def0], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14032df04]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x14032df04], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ea75f
cmp dword [rsp + 0x54], r12d
je 0x1401ea75f
mov dword [0x14032df08], 0x80000000
mov dword [0x14032def8], r12d
mov dword [0x14032dee4], r12d
mov dword [0x14032dee8], r12d
mov dword [0x14032deec], r12d
mov dword [0x14032def0], r12d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14032df0c]
test eax, eax
cmove ecx, dword [rsp + 0x54]
mov dword [0x14032df0c], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401ea7b8
mov esi, r13d
add edi, r13d
test esi, esi
je 0x1401ea3b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1401ea8a8
cmp dword [0x14032df3c], r12d
mov dword [0x14032dee0], 0xaeaeaeae
jne 0x1401ea800
lea rdi, [0x14032dee0]
mov rdx, rdi
mov rcx, rdi
call fcn.1401e9b50
jmp 0x1401ea8a8
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x14032dee0]
test eax, eax
jne 0x1401ea88d
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, str.CapProperties
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov ebx, r12d
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401ea88d
lea rdx, str.WriteRegistry_successful
jmp 0x1401ea894
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r12d
or r8d, r9d
call fcn.1401e9fd0
mov rbx, qword [rsp + 0x8b0]
mov rdi, qword [rsp + 0x8b8]
mov r13, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.1402272f0
add rsp, 0x890
pop r12
pop rsi
pop rbp
ret