Function at 0x14000e350
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor dil, dil
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], 0
test rcx, rcx
je 0x14000e413
cmp byte [rcx], dil
je 0x14000e413
mov rdx, rcx
lea r8, [0x14005e960]
lea rcx, [rsp + 0x40]
call fcn.140025ac8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000e413
xor edx, edx
lea r8d, [rdx + 2]
call fcn.1400261c0
mov rcx, qword [rsp + 0x40]
call fcn.140026038
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
movsxd rbx, eax
call fcn.1400261c0
test ebx, ebx
jle 0x14000e3f5
mov rdx, rbx
mov rcx, rsi
call fcn.1400152f0
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.140025dfc
cmp rax, 1
sete dil
mov rcx, qword [rsp + 0x40]
call fcn.140026360
movzx eax, dil
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea rax, str.Failed_to_open____s___file
lea rcx, str...SharedControlMaxxAudioAPO.cpp
lea edx, [r9 + 0x41]
lea r8d, [r9 + 1]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140008300
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movzx eax, dil
add rsp, 0x30
pop rdi
ret

Function at 0x140010350
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rcx + 0xda8]
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx + 0xc18]
lea r9, [rsp + 0x48]
lea rdx, str.ActiveOutputMode
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx + 0xc18]
lea rax, [rbx + 0xdac]
lea r9, [rsp + 0x48]
lea rdx, str.ActiveSoundMode
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add rsp, 0x30
pop rbx
ret

Function at 0x140010530
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
mov rsi, r9
mov rbp, r8
mov rbx, rcx
cmp qword [rcx + 0x10], rdi
jne 0x1400105a4
mov rax, qword [rcx + 8]
mov qword [r11 - 0x38], rdi
lea rdx, [r11 - 0x20]
mov dword [rsp + 0x38], edi
add rcx, 8
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x84000000
mov qword [r11 - 0x58], rdx
lea r9, str.ChangeNotify
lea rdx, str.WavesNotifications
xor r8d, r8d
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x18], rdi
call qword [rax + VariantCopy]
mov qword [rbx + 0xde0], rbp
mov qword [rbx + 0xde8], rsi
cmp qword [rbx + 0xdd8], rdi
jne 0x1400105eb
lea rax, [rsp + 0x50]
lea r8, [0x14000e4d0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xdd8], rax
cmp rax, rdi
setne al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140023ca0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret