Function at 0x140029e78
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400866a0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rcx
lea rax, [0x1400860c0]
mov sil, 0x10
mov rcx, qword [0x1400860c0]
cmp rcx, rax
je 0x140029ee2
test byte [rcx + 0x1c], sil
je 0x140029ee2
cmp byte [rcx + 0x19], 4
jb 0x140029ee2
mov edx, 0xb
lea r8, [0x1400716d8]
mov rcx, qword [rcx + 0x10]
call fcn.14002bed0
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceFrequency]
mov rax, qword [rbp - 0x11]
mov qword [section.RT_BSS], rax
mov edx, 4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140029f29
mov edx, 0x149
mov rcx, qword [rbp + 0x5f]
mov r9d, ebx
lea r8, str.avcore_audiocore_server_audiodgexe_audiodg.cpp
call fcn.140028204
mov eax, ebx
jmp 0x14002a265
mov rbx, qword [r14]
xor edx, edx
xor ecx, ecx
mov r9d, 0x1f0003
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventExW]
mov rdi, rax
test rax, rax
je 0x140029f61
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdx, rdi
lea rcx, [rbx + 0x80]
call fcn.140028ed8
xor ebx, ebx
jmp 0x140029f68
call fcn.140027268
mov ebx, eax
test ebx, ebx
jns 0x140029f73
mov edx, 0x14e
jmp 0x140029f0f
call fcn.14002d5c8
mov ebx, eax
test eax, eax
jns 0x140029f85
mov edx, 0x154
jmp 0x140029f0f
and qword [rbp - 0x29], 0
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.140001b90
xor r9d, r9d
lea r8, [rbp - 0x29]
lea ebx, [r9 + 1]
mov edx, ebx
lea rcx, str.D:_A__GRGWGX___WD__A__GRGWGX___RC__A__GA___BA__A__GA___OW__A__GR___AC__A__GR___S_1_15_3_1024_1692970155_4054893335_185714091_3362601943_3526593181_1159816984_2199008581_497492991_
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x140029fca
mov rcx, qword [rbp + 0x5f]
lea r8, str.avcore_audiocore_server_audiodgexe_audiodg.cpp
mov edx, 0x15a
call fcn.1400281e4
jmp 0x14002a048
mov r9, qword [rbp - 0x29]
lea r8, str.AudioDeviceGraph
mov edx, 0xa
lea rcx, str.ncalrpc
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
je 0x140029ff2
mov edx, 0x15c
jmp 0x14002a035
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x38], rax
lea rax, [0x140014910]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4d2
mov r9d, 0x21
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400682e0]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIf3]
test eax, eax
je 0x14002a04f
mov edx, 0x15d
lea r8, str.avcore_audiocore_server_audiodgexe_audiodg.cpp
mov r9d, eax
mov rcx, qword [rbp + 0x5f]
call fcn.14002b804
mov esi, eax
jmp 0x14002a254
mov dword [0x1400873e0], ebx
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp - 1], rax
mov r8d, 4
lea rdx, str.AUDIOSRV
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp + 7], rax
mov rcx, qword [0x1400860c0]
lea rax, [0x1400860c0]
cmp rcx, rax
je 0x14002a0ba
test byte [rcx + 0x1c], sil
je 0x14002a0ba
cmp byte [rcx + 0x19], 4
jb 0x14002a0ba
mov edx, 0xc
lea r8, [0x1400716d8]
mov rcx, qword [rcx + 0x10]
call fcn.14002bed0
mov r9d, 0x24
mov dword [rbp - 0x21], r9d
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xf]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14002a0ea
mov edx, 0x167
jmp 0x14002a190
mov eax, dword [rbp + 0x13]
dec eax
test eax, 0xfffffffd
jne 0x14002a108
mov esi, 0x8000ffff
mov r9d, esi
mov edx, 0x16c
jmp 0x14002a213
mov rcx, qword [0x1400860c0]
lea rax, [0x1400860c0]
cmp rcx, rax
je 0x14002a140
test byte [rcx + 0x1c], sil
je 0x14002a140
cmp byte [rcx + 0x19], 4
jb 0x14002a140
mov edx, 0xd
mov r9d, dword [rbp + 0x2b]
lea r8, [0x1400716d8]
mov rcx, qword [rcx + 0x10]
call fcn.14002bef4
mov rcx, qword [r14]
mov eax, dword [rbp + 0x2b]
mov dword [rcx + 0x90], eax
mov rax, qword [r14]
mov r8d, dword [rax + 0x90]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rdx, rax
mov rcx, qword [r14]
add rcx, 0x88
call fcn.1400018d8
mov rax, qword [r14]
mov rcx, qword [rax + 0x88]
inc rcx
test rcx, 0xfffffffffffffffe
jne 0x14002a1a7
mov edx, 0x171
lea r8, str.avcore_audiocore_server_audiodgexe_audiodg.cpp
mov rcx, qword [rbp + 0x5f]
call fcn.1400281e4
mov esi, eax
jmp 0x14002a236
call fcn.14002a90c
mov esi, eax
test eax, eax
jns 0x14002a1b9
mov edx, 0x176
jmp 0x14002a210
and dword [rbp - 0x19], 0
mov dword [rbp - 0x1d], 4
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, Ordinal_29
lea r8, str.AudioDgWatchDogTimerInMs
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov rcx, qword [r14]
call fcn.14002b098
mov esi, eax
test eax, eax
jns 0x14002a225
mov edx, 0x181
mov r9d, eax
mov rcx, qword [rbp + 0x5f]
lea r8, str.avcore_audiocore_server_audiodgexe_audiodg.cpp
call fcn.140028204
jmp 0x14002a236
mov rcx, qword [r14]
mov rcx, qword [rcx + 0x98]
call fcn.14002baa8
xor esi, esi
test rbx, rbx
je 0x14002a245
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x14002a254
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14002a263
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140015a80
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret