Function at 0x140001860
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0x498
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r13d, r13d
lea rax, [rsp + 0x68]
mov rdi, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov ebp, r13d
mov r12d, r13d
mov qword [rsp + 0x60], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001e96
mov qword [rsp + 0x4d0], rsi
mov qword [rsp + 0x490], r14
lea r14d, [r13 + 1]
mov qword [rsp + 0x4c8], rbx
mov esi, r13d
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x280]
mov edx, esi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140001d9f
lea r8, [rsp + 0x280]
lea rax, [rsp + 0x80]
mov ebx, r13d
mov edx, 0x200
lea rcx, [rsp + 0x80]
sub r8, rax
lea rax, [rdx + 0x7ffffdfe]
test rax, rax
je 0x140001962
movzx eax, byte [r8 + rcx]
test al, al
je 0x140001962
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x140001941
jmp 0x140001967
test rdx, rdx
jne 0x14000196a
sub rcx, r14
mov byte [rcx], bl
lea rax, [rsp + 0x80]
mov ecx, 0x200
nop
nop
cmp byte [rax], bl
je 0x14000198e
add rax, r14
sub rcx, r14
jne 0x140001980
jmp 0x1400019e7
test rcx, rcx
je 0x1400019e7
mov edx, 0x200
mov r8d, 0x200
sub rdx, rcx
sub r8, rdx
lea rax, [rsp + rdx + 0x80]
je 0x1400019e2
lea r9, str.Properties
lea rdx, [r8 + rdx + 0x7ffffdff]
sub r9, rax
test rdx, rdx
je 0x1400019dd
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x1400019dd
mov byte [rax], cl
sub rdx, r14
add rax, r14
sub r8, r14
jne 0x1400019c0
jmp 0x1400019e2
test r8, r8
jne 0x1400019e5
sub rax, r14
mov byte [rax], bl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001da2
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001a6d
lea rdx, str.Realtek
lea rcx, [rsp + 0x80]
call fcn.140004640
test rax, rax
cmovne ebx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140001da2
mov ecx, 0x200
lea rax, [rsp + 0x280]
nop
cmp byte [rax], r13b
je 0x140001a9f
add rax, r14
sub rcx, r14
jne 0x140001a90
jmp 0x140001af9
test rcx, rcx
je 0x140001af9
mov r8d, 0x200
mov edx, 0x200
sub r8, rcx
sub rdx, r8
lea rax, [rsp + r8 + 0x280]
je 0x140001af3
lea r9, str.FXProperties
lea r8, [rdx + r8 + 0x7ffffdff]
sub r9, rax
test r8, r8
je 0x140001aee
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x140001aee
mov byte [rax], cl
sub r8, r14
add rax, r14
sub rdx, r14
jne 0x140001ad1
jmp 0x140001af3
test rdx, rdx
jne 0x140001af6
sub rax, r14
mov byte [rax], r13b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x280]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001da2
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d92
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [rdi + 0x18], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov r12d, r14d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001bb0
mov eax, dword [rsp + 0x54]
or dword [rdi + 4], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001bf1
mov eax, dword [rsp + 0x54]
or dword [rdi + 8], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001c32
mov eax, dword [rsp + 0x54]
or dword [rdi + 0xc], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001c73
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001cb4
mov eax, dword [rsp + 0x54]
or dword [rdi + 0x10], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001cf5
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x24], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d51
cmp dword [rsp + 0x54], r13d
je 0x140001d51
mov dword [rdi + 0x28], 0x80000000
mov dword [rdi + 0x18], r13d
mov dword [rdi + 4], r13d
mov dword [rdi + 8], r13d
mov dword [rdi + 0xc], r13d
mov dword [rdi + 0x10], r13d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d92
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x2c], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001da2
mov ebp, r14d
add esi, r14d
test ebp, ebp
je 0x1400018e0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
mov rsi, qword [rsp + 0x4d0]
je 0x140001e86
cmp dword [rdi + 0x5c], r13d
mov dword [rdi], 0xaeaeaeae
jne 0x140001de5
mov rdx, rdi
mov rcx, rdi
call fcn.140001330
jmp 0x140001e86
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140001e6b
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, str.CapProperties
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, r13d
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140001e6b
lea rdx, str.WriteRegistry_successful
jmp 0x140001e72
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r13d
or r8d, r9d
call fcn.1400015b0
mov rbx, qword [rsp + 0x4c8]
mov r14, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0x498
pop r13
pop r12
pop rdi
pop rbp
ret