Function at 0x1401d9240
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x890
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor r12d, r12d
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov r9d, 0x108
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov esi, r12d
mov ebp, r12d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d97d0
mov qword [rsp + 0x8b8], rdi
mov qword [rsp + 0x8c0], r13
lea r13d, [r12 + 1]
mov qword [rsp + 0x8b0], rbx
mov edi, r12d
nop
nop
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x480]
mov edx, edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1401d96c5
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x80]
mov edx, 0x200
mov ebx, r12d
call fcn.1402174f0
lea r8, str.Properties
lea rcx, [rsp + 0x80]
mov edx, 0x200
call fcn.1402175a0
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d96c8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
xor r8d, r8d
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d93ba
lea rdx, str.Realtek
lea rcx, [rsp + 0x80]
call fcn.140217480
test rax, rax
cmovne ebx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d96c8
lea r8, str.FXProperties
lea rcx, [rsp + 0x480]
mov edx, 0x200
call fcn.1402175a0
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x480]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d96c8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_6
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d96b8
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
or dword [0x140318538], eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov ebp, r13d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d94a3
mov eax, dword [rsp + 0x54]
or dword [0x140318524], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_1
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d94e7
mov eax, dword [rsp + 0x54]
or dword [0x140318528], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_2
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d952b
mov eax, dword [rsp + 0x54]
or dword [0x14031852c], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_4
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x140318534]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_3
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x140318534], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d95b8
mov eax, dword [rsp + 0x54]
or dword [0x140318530], eax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_7
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x140318544]
lea r9, [rsp + 0x58]
test eax, eax
lea rax, [rsp + 0x50]
lea rdx, str.b7eae14c_6c01_446f_b83f_3181e129b6dd_8
cmove ecx, dword [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov dword [0x140318544], ecx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d966f
cmp dword [rsp + 0x54], r12d
je 0x1401d966f
mov dword [0x140318548], 0x80000000
mov dword [0x140318538], r12d
mov dword [0x140318524], r12d
mov dword [0x140318528], r12d
mov dword [0x14031852c], r12d
mov dword [0x140318530], r12d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14031854c]
test eax, eax
cmove ecx, dword [rsp + 0x54]
mov dword [0x14031854c], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d96c8
mov esi, r13d
add edi, r13d
test esi, esi
je 0x1401d92c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1401d97b8
cmp dword [0x14031857c], r12d
mov dword [0x140318520], 0xaeaeaeae
jne 0x1401d9710
lea rdi, [0x140318520]
mov rdx, rdi
mov rcx, rdi
call fcn.1401d8a60
jmp 0x1401d97b8
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdi, [0x140318520]
test eax, eax
jne 0x1401d979d
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 3]
lea rdx, str.CapProperties
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov ebx, r12d
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d979d
lea rdx, str.WriteRegistry_successful
jmp 0x1401d97a4
lea rdx, str.WriteRegistry_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r12d
or r8d, r9d
call fcn.1401d8ee0
mov rbx, qword [rsp + 0x8b0]
mov rdi, qword [rsp + 0x8b8]
mov r13, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.140216200
add rsp, 0x890
pop r12
pop rsi
pop rbp
ret