Function at 0x1400170b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rdx + 0x18], 0xf
mov qword [rdx + 0x10], r14
cmp qword [rdx + 0x18], 0x10
jb 0x14001711d
mov rax, qword [rdx]
jmp 0x140017120
mov rax, r13
mov byte [rax], r14b
mov r15d, 1
mov dword [rsp + 0x30], r15d
xor bl, bl
mov eax, dword [rcx + 0x10]
cmp eax, 0xe
ja 0x140017146
mov ecx, 0x50b0
bt ecx, eax
jae 0x140017146
movzx ebx, r15b
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture_
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender_
test bl, bl
cmovne rdx, rax
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
cmp byte [rdx], 0
jne 0x140017174
mov r8, r14
jmp 0x14001718a
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140017180
lea rcx, [rbp + 8]
call fcn.140002500
nop
lea rax, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_17
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
test bl, bl
cmovne rdx, rax
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
cmp byte [rdx], 0
jne 0x1400171c2
mov r8, r14
jmp 0x1400171d0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400171c6
lea rcx, [rbp - 0x38]
call fcn.140002500
nop
lea rax, [0x140086908]
lea rdx, [0x140086918]
test bl, bl
cmovne rdx, rax
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
cmp byte [rdx], 0
jne 0x140017208
mov r8, r14
jmp 0x14001721a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140017210
lea rcx, [rbp - 0x18]
call fcn.140002500
nop
mov rbx, qword [rdi]
mov rbx, qword [rbx]
cmp qword [r13 + 0x10], 0
jne 0x140017ac3
mov r12d, r15d
cmp rbx, qword [rdi]
je 0x1400179d3
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r14
mov byte [rbp - 0x58], 0
lea rdx, [rbx + 0x28]
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.140002630
nop
mov rcx, qword [rbp - 0x68]
cmp rcx, 1
jb 0x1400172d3
lea rax, [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
cmp r14, 0x10
cmovae rax, rsi
lea rdi, [rcx - 1]
add rdi, rax
nop dword [rax + rax]
cmp byte [rdi], 0x7b
sete al
test al, al
je 0x1400172af
cmp byte [rdi], 0x7b
je 0x1400172c2
lea rcx, [rbp - 0x78]
call fcn.140002440
cmp rdi, rax
je 0x1400172d3
dec rdi
jmp 0x1400172a0
lea rax, [rbp - 0x78]
cmp r14, 0x10
cmovae rax, rsi
sub rdi, rax
jmp 0x1400172d7
or rdi, 0xffffffffffffffff
cmp rdi, 0xffffffffffffffff
je 0x1400173c2
or r9, 0xffffffffffffffff
mov r8, rdi
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x78]
call fcn.140018850
mov rdi, rax
lea rax, [rbp - 0x58]
cmp rax, rdi
je 0x140017374
mov rcx, qword [rbp - 0x40]
cmp rcx, 0x10
jb 0x140017353
inc rcx
mov rdx, qword [rbp - 0x58]
cmp rcx, 0x1000
jb 0x14001734b
test dl, 0x1f
jne 0x14001790a
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140017904
sub rdx, rax
cmp rdx, 8
jb 0x1400178fe
cmp rdx, 0x27
ja 0x1400178f8
mov rdx, rax
mov rcx, rdx
call fcn.14003aa0c
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], 0
mov byte [rbp - 0x58], 0
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140002760
nop
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x1400173c2
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x1400173bd
test cl, 0x1f
jne 0x140017922
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001791c
sub rcx, rax
cmp rcx, 8
jb 0x140017916
cmp rcx, 0x27
ja 0x140017910
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x80], 0xf
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c240
lea r8d, [r14 + 0xb]
lea rdx, [0x140086908]
lea rcx, [rsp + 0x68]
call fcn.14000c0f0
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140017440
mov ecx, r14d
mov qword [rbp + 0x50], rcx
jmp 0x14001753c
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140017444
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x140017498
cmp eax, 0xc
je 0x14001793e
cmp eax, 0x16
je 0x140017933
cmp eax, 0x22
je 0x140017933
cmp eax, 0x50
jne 0x140017928
xor sil, sil
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14001753c
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140017538
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x50]
test dil, dil
je 0x14001753c
cmp dword [rsp + 0x40], 3
sete sil
jmp 0x14001753c
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x58]
cmp rcx, rax
je 0x14001754a
call fcn.14005d86c
test sil, sil
jne 0x140017796
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c240
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x68]
call fcn.14000c240
mov dword [rsp + 0x44], r14d
lea rsi, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rsi, qword [rbp - 0x38]
lea rax, [rbp + 0xe8]
mov qword [rbp + 0xe0], rax
test rsi, rsi
jne 0x1400175c1
mov qword [rbp + 0xe0], r14
jmp 0x140017622
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400175c5
inc edi
lea r8, [rbp + 0xe8]
mov edx, edi
lea rcx, [rbp + 0xe0]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0xe0]
call fcn.140001490
test eax, eax
je 0x140017622
cmp eax, 0xc
je 0x14001795f
cmp eax, 0x16
je 0x140017954
cmp eax, 0x22
je 0x140017954
cmp eax, 0x50
jne 0x140017949
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140017651
mov rdx, r14
mov qword [rbp + 0x50], rdx
jmp 0x1400176ad
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140017655
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x1400176a9
cmp eax, 0xc
je 0x140017980
cmp eax, 0x16
je 0x140017975
cmp eax, 0x22
je 0x140017975
cmp eax, 0x50
jne 0x14001796a
mov rdx, qword [rbp + 0x50]
mov r15d, r12d
or r15d, 6
mov rdi, qword [rbp + 0xe0]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140017739
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x140017739
cmp dword [rsp + 0x44], 1
jne 0x140017739
mov dil, 1
jmp 0x14001773c
xor dil, dil
and r15d, 0xfffffffb
lea rax, [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
cmp rcx, rax
je 0x140017753
call fcn.14005d86c
nop
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
lea rax, [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
cmp rcx, rax
je 0x140017774
call fcn.14005d86c
test dil, dil
je 0x140017796
lea rax, [rbp - 0x78]
cmp r13, rax
je 0x140017796
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, r13
call fcn.140002630
nop
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x1400177e5
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x1400177e0
test cl, 0x1f
jne 0x14001799d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140017997
sub rcx, rax
cmp rcx, 8
jb 0x140017991
cmp rcx, 0x27
ja 0x14001798b
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x140017845
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x140017840
test cl, 0x1f
jne 0x1400179b5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400179af
sub rcx, rax
cmp rcx, 8
jb 0x1400179a9
cmp rcx, 0x27
ja 0x1400179a3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x1400178a3
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x14001789e
test cl, 0x1f
jne 0x1400179cd
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400179c7
sub rcx, rax
cmp rcx, 8
jb 0x1400179c1
cmp rcx, 0x27
ja 0x1400179bb
mov rcx, rax
call fcn.14003aa0c
cmp byte [rbx + 0x19], 0
jne 0x1400178ee
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400178ce
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400178ee
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400178c0
jmp 0x1400178ee
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400178eb
cmp rbx, qword [rax + 0x10]
jne 0x1400178eb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400178d8
mov rbx, rax
mov rdi, qword [rsp + 0x48]
jmp 0x14001722a
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
nop
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
nop
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
nop
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
call fcn.14005d6bc
int3
cmp qword [r13 + 0x10], 0
jne 0x140017ac3
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.140017e90
mov rdx, rax
mov rcx, r13
call fcn.14000bed0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140017a4b
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x140017a46
test cl, 0x1f
je 0x140017a19
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017a28
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017a37
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017a43
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
cmp qword [r13 + 0x10], 0
jne 0x140017ac3
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.140016810
mov rdx, rax
mov rcx, r13
call fcn.14000bed0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140017ac3
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x140017abd
test cl, 0x1f
je 0x140017a90
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017a9f
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017aae
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017aba
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
nop
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x140017b19
inc rax
mov rcx, qword [rbp - 0x18]
cmp rax, 0x1000
jb 0x140017b14
test cl, 0x1f
je 0x140017ae7
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017af6
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017b05
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017b11
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x140017b7f
inc rax
mov rcx, qword [rbp - 0x38]
cmp rax, 0x1000
jb 0x140017b7a
test cl, 0x1f
je 0x140017b4d
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017b5c
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017b6b
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017b77
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x140017be5
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x140017be0
test cl, 0x1f
je 0x140017bb3
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017bc2
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017bd1
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017bdd
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14003aa30
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret