Function at 0x14001cc40
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3830
call fcn.14011c260
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x3868], rbx
mov qword [rsp + 0x3870], rbp
mov qword [rsp + 0x3878], rsi
mov rax, qword [0x14016adb0]
xor rax, rsp
mov qword [rsp + 0x3820], rax
mov r14, rcx
lea rcx, [rsp + 0x17a0]
lea rbx, [0x140000000]
mov rax, qword [rbx + 0x12df68]
mov qword [rcx], rax
mov rax, qword [rbx + 0x12df70]
mov qword [rcx + 8], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x17b0]
call fcn.1400fce30
lea r11, [rsp + 0x19a8]
mov rax, qword [rbx + 0x12df78]
mov qword [r11], rax
mov rax, qword [rbx + 0x12df80]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12df88]
mov dword [r11 + 0x10], eax
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rsp + 0x19bc]
call fcn.1400fce30
lea r11, [rsp + 0x1bb0]
mov rax, qword [rbx + 0x12df90]
mov qword [r11], rax
mov rax, qword [rbx + 0x12df98]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12dfa0]
mov dword [r11 + 0x10], eax
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rsp + 0x1bc4]
call fcn.1400fce30
lea r11, [rsp + 0x1db8]
mov rax, qword [rbx + 0x12dfa8]
mov qword [r11], rax
movzx eax, word [rbx + 0x12dfb0]
mov word [r11 + 8], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x1dc2]
call fcn.1400fce30
lea r11, [rsp + 0x1fc0]
mov rax, qword [rbx + 0x12dfb8]
mov qword [r11], rax
mov rax, qword [rbx + 0x12dfc0]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12dfc8]
mov dword [r11 + 0x10], eax
movzx eax, word [rbx + 0x12dfcc]
mov word [r11 + 0x14], ax
xor edx, edx
mov r8d, 0x1f2
lea rcx, [rsp + 0x1fd6]
call fcn.1400fce30
lea r11, [rsp + 0x21c8]
mov rax, qword [rbx + 0x12dfd0]
mov qword [r11], rax
mov eax, dword [rbx + 0x12dfd8]
mov dword [r11 + 8], eax
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rsp + 0x21d4]
call fcn.1400fce30
lea r11, [rsp + 0x23d0]
mov rax, qword [rbx + 0x12dfe0]
mov qword [r11], rax
mov rax, qword [rbx + 0x12dfe8]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12dff0]
mov dword [r11 + 0x10], eax
movzx eax, word [rbx + 0x12dff4]
mov word [r11 + 0x14], ax
xor edx, edx
mov r8d, 0x1f2
lea rcx, [rsp + 0x23e6]
call fcn.1400fce30
lea r11, [rsp + 0x25d8]
mov rax, qword [rbx + 0x12dff8]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e000]
mov qword [r11 + 8], rax
mov rax, qword [rbx + 0x12e008]
mov qword [r11 + 0x10], rax
xor edx, edx
mov r8d, 0x1f0
lea rcx, [rsp + 0x25f0]
call fcn.1400fce30
movabs r11, 0x630069004d
mov qword [rsp + 0x27e0], r11
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x27e8]
call fcn.1400fce30
lea r11, [rsp + 0x29e8]
mov rax, qword [rbx + 0x12e010]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e018]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12e020]
mov dword [r11 + 0x10], eax
movzx eax, word [rbx + 0x12e024]
mov word [r11 + 0x14], ax
xor edx, edx
mov r8d, 0x1f2
lea rcx, [rsp + 0x29fe]
call fcn.1400fce30
lea r11, [rsp + 0x2bf0]
mov rax, qword [rbx + 0x12e028]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e030]
mov qword [r11 + 8], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x2c00]
call fcn.1400fce30
lea r11, [rsp + 0x2df8]
mov rax, qword [rbx + 0x12e038]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e040]
mov qword [r11 + 8], rax
movzx eax, word [rbx + 0x12e048]
mov word [r11 + 0x10], ax
xor edx, edx
mov r8d, 0x1f6
lea rcx, [rsp + 0x2e0a]
call fcn.1400fce30
lea r11, [rsp + 0x3000]
mov rax, qword [rbx + 0x12c860]
mov qword [r11], rax
mov rax, qword [rbx + 0x12c868]
mov qword [r11 + 8], rax
movzx eax, word [rbx + 0x12c870]
mov word [r11 + 0x10], ax
xor edx, edx
mov r8d, 0x1f6
lea rcx, [rsp + 0x3012]
call fcn.1400fce30
lea r11, [rsp + 0x3208]
mov rax, qword [rbx + 0x12e050]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e058]
mov qword [r11 + 8], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x3218]
call fcn.1400fce30
movabs r11, 0x4100430052
mov qword [rsp + 0x3410], r11
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x3418]
call fcn.1400fce30
lea r11, [rsp + 0x3618]
mov rax, qword [rbx + 0x12e060]
mov qword [r11], rax
mov rax, qword [rbx + 0x12e068]
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x12e070]
mov dword [r11 + 0x10], eax
movzx eax, word [rbx + 0x12e074]
mov word [r11 + 0x14], ax
xor edx, edx
mov r8d, 0x1f2
lea rcx, [rsp + 0x362e]
call fcn.1400fce30
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x90]
call fcn.1400fce30
lea rbp, [r14 + 0x27568]
lea rdi, [rsp + 0x94]
lea rsi, [rsp + 0x17a0]
mov r12d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r13, str.OPTIONS
mov r8, rsi
lea rdx, str._s_SR
lea rcx, [rsp + 0x1380]
call fcn.14001e4d0
test rbp, rbp
je 0x14001d135
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], r13
mov r9, rbp
lea r8, str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_DefaultVDeckINI
lea rdx, str._s_s_s_
lea rcx, [rsp + 0x1590]
call fcn.14001e4d0
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x1590]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001d0e1
xor eax, eax
jmp 0x14001d137
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1380]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14001d126
xor eax, eax
jmp 0x14001d137
lea rcx, [rsp + 0x1170]
call fcn.1400fa6e0
jmp 0x14001d137
xor eax, eax
mov dword [rdi - 4], eax
mov r8, rsi
lea rdx, str._s_BD
lea rcx, [rsp + 0x1380]
call fcn.14001e4d0
test rbp, rbp
je 0x14001d209
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], r13
mov r9, rbp
lea r8, str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_DefaultVDeckINI
lea rdx, str._s_s_s_
lea rcx, [rsp + 0x1170]
call fcn.14001e4d0
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x1170]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001d1b5
xor eax, eax
jmp 0x14001d20b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1590]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1380]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14001d1fa
xor eax, eax
jmp 0x14001d20b
lea rcx, [rsp + 0x1590]
call fcn.1400fa6e0
jmp 0x14001d20b
xor eax, eax
mov word [rdi], ax
add rsi, 0x208
add rdi, 8
sub r12, 1
jne 0x14001d066
mov r13, qword [r14 + 0xac0]
mov qword [rsp + 0x38], r13
test r13d, r13d
jle 0x14001d4eb
lea rdi, [r14 + 0xa88]
xor ebx, ebx
mov dword [rsp + 0x30], 4
test r12d, r12d
js 0x14001d4da
cmp rbx, qword [rdi + 0x38]
jge 0x14001d4da
mov rcx, rbx
cmp rbx, qword [rdi + 0x38]
jge 0x14001d27e
test rbx, rbx
js 0x14001d27e
mov rax, qword [rdi + 0x28]
test rbx, rbx
je 0x14001d280
sub rcx, 1
mov rax, qword [rax]
jne 0x14001d273
jmp 0x14001d280
xor eax, eax
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001d4da
cmp qword [rcx + 0x828], 0
je 0x14001d4da
mov rcx, qword [rcx + 0x828]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x30]
mov r11d, dword [rsp + 0x30]
cmp r11d, 1
je 0x14001d2c8
cmp r11d, 2
je 0x14001d2c8
cmp r11d, 8
jne 0x14001d4da
xor edx, edx
mov r8d, 0x828
lea rcx, [rsp + 0x110]
call fcn.1400fce30
cmp rbx, qword [rdi + 0x38]
jge 0x14001d348
mov rcx, rbx
cmp rbx, qword [rdi + 0x38]
jge 0x14001d30b
test rbx, rbx
js 0x14001d30b
mov rax, qword [rdi + 0x28]
test rbx, rbx
je 0x14001d30d
nop
nop
sub rcx, 1
mov rax, qword [rax]
jne 0x14001d300
jmp 0x14001d30d
xor eax, eax
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x14001d333
lea rcx, [rsp + 0x940]
lea rdx, [rsp + 0x110]
mov r8d, 0x828
call fcn.1400fd180
jmp 0x14001d363
lea rcx, [rsp + 0x940]
mov r8d, 0x828
call fcn.1400fd180
jmp 0x14001d363
lea rcx, [rsp + 0x940]
lea rdx, [rsp + 0x110]
mov r8d, 0x828
call fcn.1400fd180
movsxd r14, dword [rsp + 0xd54]
mov r15d, dword [rsp + r14*8 + 0x90]
test r15d, r15d
jne 0x14001d387
cmp word [rsp + r14*8 + 0x94], r15w
je 0x14001d4da
xor esi, esi
xor bp, bp
cmp rbx, qword [rdi + 0x38]
jge 0x14001d4b1
mov rcx, rbx
cmp rbx, qword [rdi + 0x38]
jge 0x14001d3bb
test rbx, rbx
js 0x14001d3bb
mov rax, qword [rdi + 0x28]
test rbx, rbx
je 0x14001d3bd
nop
sub rcx, 1
mov rax, qword [rax]
jne 0x14001d3b0
jmp 0x14001d3bd
xor eax, eax
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001d4b1
cmp qword [rcx + 0x828], rsi
je 0x14001d4b1
xor bp, bp
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x70]
lea r8, [0x140000000]
mov rax, qword [r8 + 0x12ea78]
mov qword [rdx], rax
mov rax, qword [r8 + 0x12ea80]
mov qword [rdx + 8], rax
mov eax, dword [r8 + 0x12ea88]
mov dword [rdx + 0x10], eax
mov rcx, qword [rcx + 0x828]
test rcx, rcx
je 0x14001d4a6
mov qword [rsp + 0x30], rsi
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
xor edx, edx
call qword [rax + 0x20]
mov r13d, eax
test eax, eax
js 0x14001d457
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [rax + 0x28]
mov r13d, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001d467
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test r13d, r13d
js 0x14001d49a
cmp word [rsp + 0x48], 0x41
jne 0x14001d4a1
mov rax, qword [rsp + 0x58]
cmp word [rax], 0x92
jne 0x14001d48c
xor esi, esi
xor bp, bp
mov r13, qword [rsp + 0x38]
jmp 0x14001d4a6
mov esi, dword [rax + 4]
movzx ebp, word [rax + 0x12]
mov r13, qword [rsp + 0x38]
jmp 0x14001d4a6
mov r13, qword [rsp + 0x38]
jmp 0x14001d4a6
mov r13, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_PropVariantClear]
test r15d, r15d
cmovne esi, r15d
movzx eax, word [rsp + r14*8 + 0x94]
test ax, ax
cmovne bp, ax
movzx r9d, bp
mov r8d, esi
mov edx, r12d
mov rcx, rdi
call fcn.140089b70
add r12d, 1
add rbx, 1
cmp r12d, r13d
jl 0x14001d241
mov rcx, qword [rsp + 0x3820]
xor rcx, rsp
call fcn.1400f9790
lea r11, [rsp + 0x3830]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret