Function at 0x140069b80
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x2c0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140210348]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x14006a2d2
xor r13d, r13d
mov qword [r11 - 0x250], r13
lea rax, [r11 - 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140069c0e
mov rsi, qword [rsp + 0x88]
jmp 0x140069c7d
mov qword [rsp + 0x98], r13
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006a2d2
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x140069c7d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r13
mov qword [rsp + 0x90], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a2c2
mov eax, r13d
test rsi, rsi
je 0x140069cc8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x70], rsi
test eax, eax
jne 0x14006a2c2
call fcn.14013d07c
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140069cfd
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
mov dword [rsp + 0x64], 0x200
mov r12d, r13d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140069da9
mov eax, dword [rsp + 0x7c]
cmp eax, 1
je 0x140069d78
cmp eax, 2
jne 0x140069e62
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x140069d9e
test cl, 1
jne 0x140069e62
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x140069e62
mov r12d, ecx
shr r12d, 1
jmp 0x140069e62
cmp eax, 2
jne 0x140069e62
lea r8, [rsp + 0x50]
lea edx, [rax - 1]
xor ecx, ecx
call fcn.14007bc00
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140069dde
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001e50
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140069df6
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069e2f
mov ecx, r13d
jmp 0x140069e45
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069e57
cmp ecx, dword [rbx - 0xc]
jg 0x140069e57
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140069e62
mov ecx, 0x80070057
call fcn.140001c00
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r12 + r12]
mov dword [rsp + 0x60], edx
mov r12d, r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140069f02
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x140069ec7
cmp eax, 2
jne 0x140069fbd
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x140069eee
test cl, 1
jne 0x140069fbd
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
je 0x140069ef7
jmp 0x140069fbd
mov word [rsp + 0xb0], r12w
mov r12d, ecx
shr r12d, 1
jmp 0x140069fbd
cmp eax, 2
jne 0x140069fbd
lea r8, [rsp + 0x50]
mov edx, 1
mov ecx, edx
call fcn.14007bc00
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x140069f39
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001e50
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x140069f51
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x140069f8a
mov ecx, r13d
jmp 0x140069fa0
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140069fb2
cmp ecx, dword [rbx - 0xc]
jg 0x140069fb2
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x140069fbd
mov ecx, 0x80070057
call fcn.140001c00
int3
mov eax, dword [0x14022e714]
test eax, eax
jne 0x140069fe4
mov dword [0x14022e710], 0x114
lea rcx, [0x14022e710]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022e714]
cmp eax, 6
jne 0x140069ff7
cmp dword [0x14022e718], 1
jae 0x14006a000
jmp 0x14006a28a
cmp eax, 6
jbe 0x14006a28a
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r12 + r12]
mov dword [rsp + 0x58], edx
mov r12d, r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a09c
mov eax, dword [rsp + 0x80]
cmp eax, 1
je 0x14006a06b
cmp eax, 2
jne 0x14006a154
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x14006a091
test cl, 1
jne 0x14006a154
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r12w
jne 0x14006a154
mov r12d, ecx
shr r12d, 1
jmp 0x14006a154
cmp eax, 2
jne 0x14006a154
lea r8, [rsp + 0x50]
mov edx, eax
xor ecx, ecx
call fcn.14007bc00
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a0d0
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001e50
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a0e8
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a121
mov ecx, r13d
jmp 0x14006a137
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a149
cmp ecx, dword [rbx - 0xc]
jg 0x14006a149
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r12w
jmp 0x14006a154
mov ecx, 0x80070057
call fcn.140001c00
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r12 + r12]
mov dword [rsp + 0x5c], edx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a1d0
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x14006a1b6
cmp eax, 2
jne 0x14006a28a
cmp dword [rsp + 0x5c], 0
jne 0x14006a28a
mov word [rsp + 0xb0], 0
jmp 0x14006a28a
cmp eax, 2
jne 0x14006a28a
lea r8, [rsp + 0x50]
mov edx, eax
lea ecx, [rax - 1]
call fcn.14007bc00
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 1
jle 0x14006a205
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001e50
mov rbx, qword [rsp + 0x50]
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14006a21d
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
jne 0x14006a256
mov ecx, r13d
jmp 0x14006a26c
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006a27f
cmp ecx, dword [rbx - 0xc]
jg 0x14006a27f
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006a28a
mov ecx, 0x80070057
call fcn.140001c00
int3
test rsi, rsi
je 0x14006a29d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14006a2bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x70]
jmp 0x14006a2c2
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14006a2d2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006a2d2
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14015d000
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret