Function at 0x1400170e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x14009f008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rdx + 0x18], 0xf
mov qword [rdx + 0x10], r14
cmp qword [rdx + 0x18], 0x10
jb 0x14001714d
mov rax, qword [rdx]
jmp 0x140017150
mov rax, r13
mov byte [rax], r14b
mov r15d, 1
mov dword [rsp + 0x30], r15d
xor bl, bl
mov eax, dword [rcx + 0x10]
cmp eax, 0xe
ja 0x140017176
mov ecx, 0x50b0
bt ecx, eax
jae 0x140017176
movzx ebx, r15b
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture_
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender_
test bl, bl
cmovne rdx, rax
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
cmp byte [rdx], 0
jne 0x1400171a4
mov r8, r14
jmp 0x1400171ba
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400171b0
lea rcx, [rbp + 8]
call fcn.140002500
nop
lea rax, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_17
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
test bl, bl
cmovne rdx, rax
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
cmp byte [rdx], 0
jne 0x1400171f2
mov r8, r14
jmp 0x140017200
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400171f6
lea rcx, [rbp - 0x38]
call fcn.140002500
nop
lea rax, [0x140085908]
lea rdx, [0x140085918]
test bl, bl
cmovne rdx, rax
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
cmp byte [rdx], 0
jne 0x140017238
mov r8, r14
jmp 0x14001724a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140017240
lea rcx, [rbp - 0x18]
call fcn.140002500
nop
mov rbx, qword [rdi]
mov rbx, qword [rbx]
cmp qword [r13 + 0x10], 0
jne 0x140017af3
mov r12d, r15d
cmp rbx, qword [rdi]
je 0x140017a03
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r14
mov byte [rbp - 0x58], 0
lea rdx, [rbx + 0x28]
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.140002630
nop
mov rcx, qword [rbp - 0x68]
cmp rcx, 1
jb 0x140017303
lea rax, [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
cmp r14, 0x10
cmovae rax, rsi
lea rdi, [rcx - 1]
add rdi, rax
nop dword [rax + rax]
cmp byte [rdi], 0x7b
sete al
test al, al
je 0x1400172df
cmp byte [rdi], 0x7b
je 0x1400172f2
lea rcx, [rbp - 0x78]
call fcn.140002440
cmp rdi, rax
je 0x140017303
dec rdi
jmp 0x1400172d0
lea rax, [rbp - 0x78]
cmp r14, 0x10
cmovae rax, rsi
sub rdi, rax
jmp 0x140017307
or rdi, 0xffffffffffffffff
cmp rdi, 0xffffffffffffffff
je 0x1400173f2
or r9, 0xffffffffffffffff
mov r8, rdi
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x78]
call fcn.140018880
mov rdi, rax
lea rax, [rbp - 0x58]
cmp rax, rdi
je 0x1400173a4
mov rcx, qword [rbp - 0x40]
cmp rcx, 0x10
jb 0x140017383
inc rcx
mov rdx, qword [rbp - 0x58]
cmp rcx, 0x1000
jb 0x14001737b
test dl, 0x1f
jne 0x14001793a
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140017934
sub rdx, rax
cmp rdx, 8
jb 0x14001792e
cmp rdx, 0x27
ja 0x140017928
mov rdx, rax
mov rcx, rdx
call fcn.14003a87c
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], 0
mov byte [rbp - 0x58], 0
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140002760
nop
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x1400173f2
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x1400173ed
test cl, 0x1f
jne 0x140017952
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001794c
sub rcx, rax
cmp rcx, 8
jb 0x140017946
cmp rcx, 0x27
ja 0x140017940
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x80], 0xf
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c240
lea r8d, [r14 + 0xb]
lea rdx, [0x140085908]
lea rcx, [rsp + 0x68]
call fcn.14000c0f0
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140017470
mov ecx, r14d
mov qword [rbp + 0x50], rcx
jmp 0x14001756c
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140017474
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x1400174c8
cmp eax, 0xc
je 0x14001796e
cmp eax, 0x16
je 0x140017963
cmp eax, 0x22
je 0x140017963
cmp eax, 0x50
jne 0x140017958
xor sil, sil
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14001756c
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140017568
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x50]
test dil, dil
je 0x14001756c
cmp dword [rsp + 0x40], 3
sete sil
jmp 0x14001756c
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x58]
cmp rcx, rax
je 0x14001757a
call fcn.14005d6dc
test sil, sil
jne 0x1400177c6
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140002630
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c240
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x68]
call fcn.14000c240
mov dword [rsp + 0x44], r14d
lea rsi, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rsi, qword [rbp - 0x38]
lea rax, [rbp + 0xe8]
mov qword [rbp + 0xe0], rax
test rsi, rsi
jne 0x1400175f1
mov qword [rbp + 0xe0], r14
jmp 0x140017652
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400175f5
inc edi
lea r8, [rbp + 0xe8]
mov edx, edi
lea rcx, [rbp + 0xe0]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0xe0]
call fcn.140001490
test eax, eax
je 0x140017652
cmp eax, 0xc
je 0x14001798f
cmp eax, 0x16
je 0x140017984
cmp eax, 0x22
je 0x140017984
cmp eax, 0x50
jne 0x140017979
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
test rsi, rsi
jne 0x140017681
mov rdx, r14
mov qword [rbp + 0x50], rdx
jmp 0x1400176dd
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140017685
inc edi
lea r8, [rbp + 0x58]
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140002c80
movsxd rdx, edi
mov r9, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x50]
call fcn.140001490
test eax, eax
je 0x1400176d9
cmp eax, 0xc
je 0x1400179b0
cmp eax, 0x16
je 0x1400179a5
cmp eax, 0x22
je 0x1400179a5
cmp eax, 0x50
jne 0x14001799a
mov rdx, qword [rbp + 0x50]
mov r15d, r12d
or r15d, 6
mov rdi, qword [rbp + 0xe0]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140017769
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x140017769
cmp dword [rsp + 0x44], 1
jne 0x140017769
mov dil, 1
jmp 0x14001776c
xor dil, dil
and r15d, 0xfffffffb
lea rax, [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
cmp rcx, rax
je 0x140017783
call fcn.14005d6dc
nop
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
lea rax, [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
cmp rcx, rax
je 0x1400177a4
call fcn.14005d6dc
test dil, dil
je 0x1400177c6
lea rax, [rbp - 0x78]
cmp r13, rax
je 0x1400177c6
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, r13
call fcn.140002630
nop
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140017815
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x140017810
test cl, 0x1f
jne 0x1400179cd
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400179c7
sub rcx, rax
cmp rcx, 8
jb 0x1400179c1
cmp rcx, 0x27
ja 0x1400179bb
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x140017875
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x140017870
test cl, 0x1f
jne 0x1400179e5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400179df
sub rcx, rax
cmp rcx, 8
jb 0x1400179d9
cmp rcx, 0x27
ja 0x1400179d3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x1400178d3
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x1400178ce
test cl, 0x1f
jne 0x1400179fd
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400179f7
sub rcx, rax
cmp rcx, 8
jb 0x1400179f1
cmp rcx, 0x27
ja 0x1400179eb
mov rcx, rax
call fcn.14003a87c
cmp byte [rbx + 0x19], 0
jne 0x14001791e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400178fe
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14001791e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400178f0
jmp 0x14001791e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14001791b
cmp rbx, qword [rax + 0x10]
jne 0x14001791b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140017908
mov rbx, rax
mov rdi, qword [rsp + 0x48]
jmp 0x14001725a
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
nop
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
nop
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
nop
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
call fcn.14005d52c
int3
cmp qword [r13 + 0x10], 0
jne 0x140017af3
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.140017ec0
mov rdx, rax
mov rcx, r13
call fcn.14000bed0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140017a7b
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x140017a76
test cl, 0x1f
je 0x140017a49
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017a58
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017a67
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140017a73
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
cmp qword [r13 + 0x10], 0
jne 0x140017af3
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.140016840
mov rdx, rax
mov rcx, r13
call fcn.14000bed0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140017af3
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x140017aed
test cl, 0x1f
je 0x140017ac0
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017acf
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017ade
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140017aea
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
nop
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x140017b49
inc rax
mov rcx, qword [rbp - 0x18]
cmp rax, 0x1000
jb 0x140017b44
test cl, 0x1f
je 0x140017b17
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017b26
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017b35
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140017b41
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x140017baf
inc rax
mov rcx, qword [rbp - 0x38]
cmp rax, 0x1000
jb 0x140017baa
test cl, 0x1f
je 0x140017b7d
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017b8c
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017b9b
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140017ba7
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x140017c15
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x140017c10
test cl, 0x1f
je 0x140017be3
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140017bf2
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140017c01
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x140017c0d
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14003a8a0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret