Function at 0x1400c76d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbc0]
sub rsp, 0xcc0
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0xbb0], rax
mov edi, r9d
mov rsi, r8
mov qword [rsp + 0x30], rcx
mov r13d, dword [rbp + 0xc28]
mov r14, qword [rbp + 0xc20]
mov r12, qword [rbp + 0xc30]
xor r15d, r15d
mov dword [r12], r15d
add edx, 0xcffffffe
cmp edx, 0x15
ja case.0x1400c7749.805306374
mov eax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xc8344]
add rcx, rdx
jmp rcx
mov r8d, 0x2e
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_RestoreDefaultVolume
call fcn.14006dd20
call fcn.14000bd10
mov rcx, rax
call fcn.1400a2b90
jmp case.0x1400c7749.805306374
mov r8d, 0x35
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_LaunchPropertyPage
call fcn.14006dd20
test rsi, rsi
jne 0x1400c77b2
lea r8d, [rsi + 0x36]
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_RETURN_FALSE_ON_FALSE
call fcn.14006dd20
xor eax, eax
jmp 0x1400c830f
mov r8, rdi
test edi, edi
je 0x1400c77f2
lea rcx, [rbp + 0x3b0]
cmp rdi, 0x800
ja 0x1400c77d3
mov rdx, rsi
call fcn.1400e5de0
jmp 0x1400c77f2
xor edx, edx
mov r8d, 0x800
call fcn.1400e5b40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400c8339
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x30]
call fcn.140004560
mov rbx, 0xffffffffffffffff
test al, al
jne 0x1400c786f
lea rcx, [rbp + 0x3b0]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c7850
mov r8d, eax
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x30]
call fcn.1400047f0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x58]
call fcn.1400e5b40
mov qword [rbp - 0x60], 0x30000003
mov edx, 0xff
lea rcx, [rbp - 0x58]
lea rax, [rbp - 0x58]
mov r8, qword [rsp + 0x30]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffeff]
test rax, rax
je 0x1400c78d3
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400c78d3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400c78b0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r15w
lea rcx, [rbp - 0x60]
call fcn.140081c70
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg case.0x1400c7749.805306374
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
jmp case.0x1400c7749.805306374
mov r8d, 0x56
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_GetForceDefaultVolume
call fcn.14006dd20
test r14, r14
jne 0x1400c7942
lea r8d, [r14 + 0x57]
jmp 0x1400c7798
mov rax, qword [0x140178490]
xor r9d, r9d
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x140178490]
mov rax, qword [rax + 0x20]
call qword [case.0x140050923.0]
mov ebx, eax
mov dword [rsp + 0x38], eax
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, 0x60
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_nValue_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
mov r8d, 0x66
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_SetForceDefaultVolume
call fcn.14006dd20
test rsi, rsi
jne 0x1400c79ef
lea r8d, [rsi + 0x67]
jmp 0x1400c7798
mov ebx, r15d
mov dword [rsp + 0x5c], ebx
mov r8, rdi
test edi, edi
je 0x1400c7a28
cmp rdi, 4
ja 0x1400c7a16
mov rdx, rsi
lea rcx, [rsp + 0x5c]
call fcn.1400e5de0
mov ebx, dword [rsp + 0x5c]
jmp 0x1400c7a28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov rax, qword [0x140178490]
mov r9d, ebx
lea r8, str.ForceRestoreDefaultVolumeWhenStart
lea rdx, str.Others
lea rcx, [0x140178490]
mov rax, qword [rax + 0x28]
call qword [case.0x140050923.0]
mov r9d, ebx
mov r8d, 0x6e
lea rcx, str._s__d_nValue_d
jmp 0x1400c82f7
mov r8d, 0x74
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_GetPresetAutoSwitch
call fcn.14006dd20
test r14, r14
jne 0x1400c7a8d
lea r8d, [r14 + 0x75]
jmp 0x1400c7798
mov dword [r12], r15d
mov rax, qword [0x140178490]
xor r9d, r9d
lea r8, str.PresetAutoSwitch
lea rdx, str.Others
lea rcx, [0x140178490]
mov rax, qword [rax + 0x20]
call qword [case.0x140050923.0]
mov ebx, eax
mov dword [rsp + 0x3c], eax
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x3c]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, 0x81
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_bPresetAutoSwitch_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
mov r8d, 0x86
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_SetPresetAutoSwitch
call fcn.14006dd20
test rsi, rsi
jne 0x1400c7b40
mov r8d, 0x87
jmp 0x1400c7798
mov ebx, r15d
mov dword [rsp + 0x60], ebx
cmp edi, 4
ja 0x1400c7b6b
test rdi, rdi
je 0x1400c7b84
cmp rdi, 4
jbe 0x1400c7b70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x1400c7b84
mov edi, 4
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400e5de0
mov ebx, dword [rsp + 0x60]
mov ecx, ebx
call fcn.140040430
mov r9d, ebx
mov r8d, 0x8f
lea rcx, str._s__d_bPresetAutoSwitch_d
jmp 0x1400c82f7
test rsi, rsi
jne 0x1400c7bb0
mov r8d, 0x94
jmp 0x1400c7798
test r9d, r9d
jne 0x1400c7bc0
mov r8d, 0x95
jmp 0x1400c7798
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1b0]
call fcn.1400e5b40
mov r8, rdi
cmp rdi, 0x200
ja 0x1400c7bf1
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call fcn.1400e5de0
jmp 0x1400c7c03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov r8d, 1
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rsp + 0x30]
call fcn.1400d2160
mov ebx, eax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
mov r8d, ebx
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s_bFound_d_PFN_s_Name_s
call fcn.14006dd20
cmp r13d, dword [r12]
jb case.0x1400c7749.805306374
mov dword [r14], ebx
mov edi, 4
mov dword [r12], edi
jmp case.0x1400c7749.805306374
test rsi, rsi
jne 0x1400c7c6e
mov r8d, 0xa6
jmp 0x1400c7798
mov ebx, 1
mov dword [rsp + 0x64], ebx
cmp edi, 4
ja 0x1400c7c9d
test r9d, r9d
je 0x1400c7cb6
cmp rdi, 4
jbe 0x1400c7ca2
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x1400c7cb6
mov edi, 4
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x64]
call fcn.1400e5de0
mov ebx, dword [rsp + 0x64]
mov r9d, ebx
mov r8d, 0x2c2
lea rdx, str.CStoreAppMgr::ExecuteWakeUWPUpCommand
lea rcx, str._s__d_SRV_CMD_WAKE_ME_UP_bIsWakeUpCommand___d
call fcn.14006dd20
test ebx, ebx
je 0x1400c7d05
call fcn.14000be90
mov rcx, rax
mov edx, 0x40c
call fcn.1400d4070
call fcn.14000be90
mov rcx, rax
mov edx, 0x40c
mov r8d, 0xa
call fcn.1400d3e30
jmp case.0x1400c7749.805306374
mov dword [0x140180854], r15d
jmp case.0x1400c7749.805306374
mov r8d, 0xae
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_GetIntMicStreamActivityStatus
call fcn.14006dd20
test r14, r14
jne 0x1400c7d3a
mov r8d, 0xaf
jmp 0x1400c7798
call fcn.14000bb10
test dword [rax + reloc.OLEAUT32.dll_LPSAFEARRAY_UserUnmarshal], 0x100
jne 0x1400c7d56
mov r8d, 0xb1
jmp 0x1400c7798
mov dword [r12], r15d
call fcn.1400231a0
mov ebx, dword [0x140180000]
mov dword [rsp + 0x40], ebx
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, 0xbc
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_bIntMicStreamActivity_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
mov r8d, 0xc1
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_UwpLockStatus
call fcn.14006dd20
test r14, r14
jne 0x1400c7de9
mov r8d, 0xc2
jmp 0x1400c7798
mov dword [r12], r15d
mov rax, qword [0x140178490]
xor r9d, r9d
lea r8, str.UwpLock
lea rdx, str.Others
lea rcx, [0x140178490]
mov rax, qword [rax + 0x20]
call qword [case.0x140050923.0]
mov ebx, eax
mov dword [rsp + 0x44], eax
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x44]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, 0xcd
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_bUwpLock_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
mov r8d, 0xd2
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_HP_GetGlobalNN
call fcn.14006dd20
test r14, r14
jne 0x1400c7e9c
mov r8d, 0xd3
jmp 0x1400c7798
mov dword [r12], r15d
mov ebx, 1
mov dword [rsp + 0x58], ebx
call fcn.140063590
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xd0]
lea rdx, [rsp + 0x58]
mov rcx, r8
call qword [case.0x140050923.0]
test eax, eax
jne 0x1400c7ee6
mov r8d, 0xda
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_GetGlobalNN_fail__
call fcn.14006dd20
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x58]
mov r8d, 0xe0
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_bGlobalNN_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
mov r8d, 0xe5
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_HP_SetGlobalNN
call fcn.14006dd20
test rsi, rsi
jne 0x1400c7f68
mov r8d, 0xe6
jmp 0x1400c7798
mov ebx, 1
mov dword [rsp + 0x68], ebx
cmp edi, 4
ja 0x1400c7f97
test rdi, rdi
je 0x1400c7fb0
cmp rdi, 4
jbe 0x1400c7f9c
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x1400c7fb0
mov edi, 4
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.1400e5de0
mov ebx, dword [rsp + 0x68]
call fcn.140063590
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xd8]
mov edx, ebx
mov rcx, r8
call qword [case.0x140050923.0]
mov r9d, ebx
mov r8d, 0xed
lea rcx, str._s__d_bGlobalNN_d
jmp 0x1400c82f7
mov r8d, 0xf2
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_RestoreNs
call fcn.14006dd20
call fcn.140063590
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe0]
xor edx, edx
mov rcx, r8
call qword [case.0x140050923.0]
jmp case.0x1400c7749.805306374
mov r8d, 0xfb
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d___SRV_CMD_HP_GetMachineDisplayMode
call fcn.14006dd20
call fcn.140063590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0xf8]
mov rcx, rdx
call qword [case.0x140050923.0]
mov ebx, eax
mov dword [rsp + 0x48], eax
mov r8, r13
mov edi, 4
cmp r13d, edi
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400e5de0
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, 0x102
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_dwMachineDisplayMode_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
test r14, r14
jne 0x1400c80be
mov r8d, 0x10a
jmp 0x1400c7798
mov esi, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x70], r15
mov dword [rsp + 0x6c], r15d
mov r9d, 1
lea r8, str.SOFTWARERealtekAudioExtSettings
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.14002b400
test eax, eax
je 0x1400c812a
lea r9, str.SOFTWARERealtekAudioExtSettings
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400c81bd
jmp 0x1400c81b7
mov edi, 4
mov dword [rsp + 0x74], edi
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DefaultDisableAINR
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c81af
cmp dword [rsp + 0x78], edi
jne 0x1400c81af
mov esi, dword [rsp + 0x6c]
mov dword [rsp + 0x50], esi
test rbx, rbx
je 0x1400c8183
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r8, r13
cmp r13d, 4
cmovbe rdi, r13
mov dword [r12], edi
xor edx, edx
mov rcx, r14
call fcn.1400e5b40
mov r8d, dword [r12]
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1400e5de0
jmp 0x1400c81bd
test rbx, rbx
je 0x1400c81bd
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9d, esi
mov r8d, BSTR_UserFree
lea rdx, str.ServiceCommandForSystem
lea rcx, str._s__d_SRV_CMD_GetTotalRemoveGen4AINR_bTotalRemoveGen4AINR_d_ulBytesReturned_d
call fcn.14006dd20
jmp case.0x1400c7749.805306374
test rsi, rsi
jne 0x1400c81f6
mov r8d, reloc.OLEAUT32.dll_BSTR_UserFree
jmp 0x1400c7798
mov ebx, r15d
mov dword [rsp + 0x70], ebx
cmp edi, 4
ja 0x1400c8221
test r9d, r9d
je 0x1400c827a
cmp rdi, 4
jbe 0x1400c8226
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x1400c823a
mov edi, 4
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1400e5de0
mov ebx, dword [rsp + 0x70]
test ebx, ebx
je 0x1400c827a
mov r9d, ebx
lea r8, str.DefaultDisableAINR
lea rdx, str.SOFTWARERealtekAudioExtSettings
mov rcx, 0xffffffff80000002
call fcn.140090400
mov r9d, ebx
lea r8, str.DisableAllAINROnce
lea rdx, str.SOFTWARERealtekAudioExtSettings
mov rcx, 0xffffffff80000002
call fcn.140090400
jmp 0x1400c82b4
xor r9d, r9d
lea r8, str.DisableAllAINROnce
lea rdx, str.SOFTWARERealtekAudioExtSettings
mov rcx, 0xffffffff80000002
call fcn.1400908e0
xor r9d, r9d
lea r8, str.DefaultDisableAINR
lea rdx, str.SOFTWARERealtekAudioExtSettings
mov rcx, 0xffffffff80000002
call fcn.1400908e0
mov r9d, ebx
mov r8d, 0x130
lea rcx, str._s__d_SRV_CMD_SetTotalRemoveGen4AINR_bTotalRemoveGen4AINR_d
jmp 0x1400c82f7
mov dword [r12], 8
call fcn.14000bb10
mov rcx, qword [rax + 0x340]
mov qword [r14], rcx
call fcn.14000bb10
movzx r9d, word [rax + 0x342]
mov r8d, 0x137
lea rcx, str._s__d_wSubVendorID_x
lea rdx, str.ServiceCommandForSystem
call fcn.14006dd20
cmp dword [r12], 0
seta r15b
mov rax, r15
mov rcx, qword [rbp + 0xbb0]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0xd08]
add rsp, 0xcc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004f30
int3