Function at 0x1401493f9
Capabilities:
Delete registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x140149876
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r13, rcx
xor eax, eax
mov qword [rbp + 0xf], rax
xor r12d, r12d
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], r12
mov dword [rbp + 0xf], r12d
mov qword [rbp + 0x17], r12
lea rax, [0x14031b7bc]
mov qword [rsp + 0x20], rax
lea r9, str.CapxEndpointIDList
lea r8, str.SOFTWAREWaves_AudioMaxxAudioSettings
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x17]
call fcn.140056fc0
nop
mov rdi, qword [rbp + 0x17]
mov qword [rbp - 1], r12
mov ebx, r12d
mov qword [rbp + 7], rbx
lea r15, [r12 - 1]
cmp r12w, word [rdi]
je 0x140149578
mov esi, r12d
mov r14d, r12d
call fcn.140039c50
mov rdx, rax
test rax, rax
je 0x140149898
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rcx, rdx
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rbp - 0x61], rax
mov rdx, rdi
lea rcx, [rbp - 0x61]
call fcn.14003b370
test al, al
jne 0x1401494fc
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1401494e0
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x61]
call fcn.14003beb0
mov rsi, r14
cmp rsi, rbx
jb 0x140149516
lea rdx, [rsi + 1]
lea rcx, [rbp - 9]
call fcn.140058ea0
test al, al
je 0x140149882
mov rax, qword [rbp - 9]
lea rcx, [rax + rsi*8]
mov rbx, qword [rbp - 0x61]
mov rdx, rbx
call fcn.14003be10
mov rsi, qword [rbp - 1]
inc rsi
mov qword [rbp - 1], rsi
movsxd rax, dword [rbx - 0x10]
lea rdi, [rdi + rax*2]
add rdi, 2
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140149562
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov r14, rsi
cmp r12w, word [rdi]
je 0x140149574
mov rbx, qword [rbp + 7]
jmp 0x1401494a1
mov rdi, qword [rbp + 0x17]
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140149599
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
lea rdx, [r13 + 0x50]
lea rcx, [rbp - 0x59]
call fcn.14003ead0
nop
lea r14, [rbp - 0x59]
cmp qword [rbp - 0x41], 8
cmovae r14, qword [rbp - 0x59]
mov esi, r12d
mov r12, qword [rbp - 9]
mov rdi, qword [rbp - 1]
test rdi, rdi
je 0x140149603
xor ecx, ecx
mov ebx, ecx
nop dword [rax]
cmp rbx, rdi
jae 0x1401498ae
test r14, r14
je 0x1401498a3
mov rdx, r14
mov rcx, qword [r12 + rbx*8]
call fcn.1402389bc
test eax, eax
je 0x140149813
inc esi
inc rbx
movsxd rax, esi
cmp rax, rdi
jb 0x1401495d0
mov bl, 1
lea rcx, [rbp - 0x59]
call fcn.14003b0f0
test bl, bl
je 0x140149832
lea rdx, [r13 + 0x50]
lea rcx, [rbp - 0x39]
call fcn.14003ead0
nop
lea rsi, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rsi, qword [rbp - 0x39]
mov rbx, rdi
cmp rdi, qword [rbp + 7]
jb 0x140149658
lea rdx, [rdi + 1]
lea rcx, [rbp - 9]
call fcn.140058ea0
test al, al
je 0x14014988d
mov rdi, qword [rbp - 1]
mov r12, qword [rbp - 9]
lea rcx, [r12 + rbx*8]
mov rdx, rsi
call fcn.14003be10
inc rdi
mov qword [rbp - 1], rdi
lea rcx, [rbp - 0x39]
call fcn.14003b0f0
xor r15d, r15d
mov qword [rbp - 0x11], r15
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140149832
test rdi, rdi
je 0x14014981a
call fcn.140039c50
mov rcx, rax
test rax, rax
je 0x1401498b9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x69], rbx
mov r14d, r15d
lea r13d, [r15 + 1]
test rdi, rdi
je 0x140149776
cmp r15, rdi
jae 0x1401498e5
mov rdx, qword [r12 + r14*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x69]
call fcn.14003c4a0
mov rbx, qword [rbp - 0x69]
movsxd r15, dword [rbx - 0x10]
lea esi, [r15 + 1]
test esi, esi
js 0x1401498da
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14014974d
mov edx, esi
lea rcx, [rbp - 0x69]
call fcn.14003b630
mov rbx, qword [rbp - 0x69]
mov eax, r15d
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp esi, dword [rbx - 0xc]
jg 0x1401498cf
mov dword [rbx - 0x10], esi
mov rax, r15
xor r15d, r15d
mov word [rbx + rax*2 + 2], r15w
inc r14
cmp r14, rdi
jb 0x14014970a
movsxd rsi, dword [rbx - 0x10]
lea edi, [rsi + 1]
test edi, edi
js 0x1401498c4
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r13d
jge 0x1401497a2
mov edx, edi
lea rcx, [rbp - 0x69]
call fcn.14003b630
mov rbx, qword [rbp - 0x69]
mov eax, esi
mov word [rbx + rax*2], r15w
cmp edi, dword [rbx - 0xc]
jg 0x140149877
mov dword [rbx - 0x10], edi
mov word [rbx + rsi*2 + 2], r15w
mov eax, dword [rbx - 0x10]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 7
xor r8d, r8d
lea rdx, str.CapxEndpointIDList
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
mov rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140149809
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov rdi, qword [rbp - 1]
mov r12, qword [rbp - 9]
jmp 0x140149827
xor bl, bl
jmp 0x140149605
lea rdx, str.CapxEndpointIDList
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
test r12, r12
je 0x14014984a
mov rdx, rdi
mov rcx, r12
call fcn.140059000
mov rcx, r12
call fcn.1402384fc
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140039950
nop
mov ecx, 0x8007000e
call fcn.140039950
nop
mov ecx, 0x8007000e
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
nop
mov ecx, 0x80070057
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
int3
mov ecx, 0x80070057
call fcn.140039950
int3