Function at 0x140016670
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1400f5010]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.140009760
test dword [rax + 0xd0], 0x100
je 0x1400166e1
mov ecx, 1
call fcn.14003c1a0
call fcn.140011360
mov ebx, dword [0x1400fad78]
mov r9d, ebx
mov r8d, 0x194
lea rdx, str.CBackgroundProcMain::InitFirstTime
lea rcx, str._s__d_nUsbPathCount___d
call fcn.14003f0e0
test ebx, ebx
jle 0x1400166e1
call fcn.14003c270
call fcn.140009760
test dword [rax + 0xd0], 0x8000
je 0x140016794
call fcn.140009920
mov rcx, rax
call fcn.140066e30
call fcn.140009920
cmp dword [rax + 0x138], 0
jne 0x140016749
cmp dword [0x1400f9a88], 0
je 0x140016749
cmp dword [0x1400f9a54], 0
jne 0x140016730
mov rax, qword [0x1400f5508]
test byte [rax + 0x1c], 1
je 0x140016749
mov r8d, 0x3b
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.14003f0e0
call fcn.140009920
mov rbx, qword [rax + 0xd8]
test rbx, rbx
je 0x140016787
call fcn.140009920
call fcn.140009920
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140016755
cmp dword [rcx + 0x180], 4
jne 0x140016755
cmp dword [rcx + 0x158], 0
jne 0x140016755
call fcn.14003dce0
call fcn.140009920
mov rcx, rax
call fcn.140066eb0
call fcn.140009760
test dword [rax + 0xd0], 0x10000
je 0x14001683e
call fcn.140009920
mov rcx, rax
call fcn.140066e30
call fcn.140009920
cmp dword [rax + 0x138], 0
jne 0x1400167fc
cmp dword [0x1400f9a88], 0
je 0x1400167fc
cmp dword [0x1400f9a54], 0
jne 0x1400167e3
mov rax, qword [0x1400f5508]
test byte [rax + 0x1c], 1
je 0x1400167fc
mov r8d, 0x3b
lea rdx, str.CMMPlatform::AudioDevList_GetHeadPosition
lea rcx, str._s__d_please_call_AudioDevList_AddRef_before_AudioDevList_GetHeadPosition
call fcn.14003f0e0
call fcn.140009920
mov rbx, qword [rax + 0xd8]
test rbx, rbx
je 0x140016831
call fcn.140009920
call fcn.140009920
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140016808
cmp dword [rcx + 0x180], 4
jne 0x140016808
call fcn.14004a6a0
call fcn.140009920
mov rcx, rax
call fcn.140066eb0
mov rbx, qword [0x1400fa5d0]
call fcn.140009760
mov r9d, dword [rax + 0x18]
shr r9d, 6
not r9d
and r9d, 1
lea r8, str.JDPopup
lea rdx, str.General
lea rcx, [0x1400fa5d0]
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.140009760
test dword [rax + 0xc0], 0x400
je 0x140016887
call fcn.140039fe0
call fcn.140009760
test dword [rax + 0x20], 0x2000000
je 0x14001689a
call fcn.14004fff0
call fcn.140009760
test dword [rax + 0xac], 0x200
je 0x1400168b0
call fcn.14003a3a0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x38], eax
lea r9d, [rax + 1]
lea r8, str.SOFTWAREFortemediaHowlingDection
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14001cc20
test eax, eax
je 0x140016913
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14003f0e0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001697d
jmp 0x140016977
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.13AE3061_F6DC_45C1_B90C_F5E992141790_11
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14001696f
cmp dword [rsp + 0x40], 4
jne 0x14001696f
mov edi, dword [rsp + 0x38]
test rbx, rbx
je 0x140016969
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
jne 0x14001698b
jmp 0x14001697d
test rbx, rbx
je 0x14001697d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.140009760
test dword [rax + 0x50], 0x4000
je 0x140016990
call fcn.140009760
call fcn.1400382a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008ade0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret