Function at 0x14006a340
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140210348]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov rax, qword [rcx + 0x98]
test byte [rax + 0x1a0], 8
je 0x14006ae3f
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATIONDeviceDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006ae3f
mov r15, qword [rsp + 0x38]
mov qword [rsp + 0x60], r15
call fcn.14013d07c
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14006a3f3
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov edx, 0xa
lea rcx, [rsp + 0x68]
call fcn.1401555fc
nop
mov rdi, qword [rdi + 0xf48]
test rdi, rdi
je 0x14006a453
mov rdx, rdi
test rdi, rdi
je 0x14006a44d
mov rdi, qword [rdi]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x14006a446
add rdx, 0x118
lea rcx, [rsp + 0x68]
call fcn.1401559ac
test rdi, rdi
jne 0x14006a421
jmp 0x14006a453
call fcn.14013d908
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
mov dword [rsp + 0x44], 0x200
mov r13d, esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.DefaultPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, 1
or r12, 0xffffffffffffffff
test eax, eax
jne 0x14006a6b1
mov eax, dword [rsp + 0x5c]
cmp eax, r14d
je 0x14006a4c6
cmp eax, 2
jne 0x14006a6b1
mov ecx, dword [rsp + 0x44]
test ecx, ecx
je 0x14006a4ed
test r14b, cl
jne 0x14006a6b1
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], r13w
je 0x14006a4f6
jmp 0x14006a6b1
mov word [rsp + 0xb0], r13w
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
xor ecx, ecx
call fcn.14007bc00
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006a536
add rax, 2
test cx, cx
jne 0x14006a520
mov eax, esi
jmp 0x14006a53b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006a675
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006a5c4
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006a646
cmp dword [rdx + 0x10], eax
jge 0x14006a590
cmp dword [rbx - 0xc], eax
jge 0x14006a585
mov ecx, 0x80070057
call fcn.140001c00
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006a646
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006a5a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006a646
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006a5f5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001df0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006a615
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015cf60
jmp 0x14006a632
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015cd30
test edi, edi
js 0x14006a66a
cmp edi, dword [rbx - 0xc]
jg 0x14006a66a
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140155730
test rax, rax
je 0x14006a675
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14007bdb0
jmp 0x14006a675
mov ecx, 0x80070057
call fcn.140001c00
int3
test rbx, rbx
jne 0x14006a67e
mov ecx, esi
jmp 0x14006a693
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006a6a6
cmp ecx, dword [rbx - 0xc]
jg 0x14006a6a6
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006a6b1
mov ecx, 0x80070057
call fcn.140001c00
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r13 + r13]
mov dword [rsp + 0x4c], edx
mov r13d, esi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.DefaultCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a906
mov eax, dword [rsp + 0x54]
cmp eax, r14d
je 0x14006a71b
cmp eax, 2
jne 0x14006a906
mov ecx, dword [rsp + 0x4c]
test ecx, ecx
je 0x14006a742
test r14b, cl
jne 0x14006a906
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006a74c
jmp 0x14006a906
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, r14d
mov ecx, r14d
call fcn.14007bc00
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006a78b
add rax, 2
test cx, cx
jne 0x14006a775
mov eax, esi
jmp 0x14006a790
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006a8ca
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006a819
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006a89b
cmp dword [rdx + 0x10], eax
jge 0x14006a7e5
cmp dword [rbx - 0xc], eax
jge 0x14006a7da
mov ecx, 0x80070057
call fcn.140001c00
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006a89b
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006a7fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006a89b
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006a84a
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001df0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006a86a
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015cf60
jmp 0x14006a887
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015cd30
test edi, edi
js 0x14006a8bf
cmp edi, dword [rbx - 0xc]
jg 0x14006a8bf
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140155730
test rax, rax
je 0x14006a8ca
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14007bdb0
jmp 0x14006a8ca
mov ecx, 0x80070057
call fcn.140001c00
int3
test rbx, rbx
jne 0x14006a8d3
mov ecx, esi
jmp 0x14006a8e8
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006a8fb
cmp ecx, dword [rbx - 0xc]
jg 0x14006a8fb
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006a906
mov ecx, 0x80070057
call fcn.140001c00
int3
mov eax, dword [0x14022e714]
test eax, eax
jne 0x14006a92d
mov dword [0x14022e710], 0x114
lea rcx, [0x14022e710]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022e714]
cmp eax, 6
jne 0x14006a940
cmp dword [0x14022e718], r14d
jae 0x14006a949
jmp 0x14006adee
cmp eax, 6
jbe 0x14006adee
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r13 + r13]
mov dword [rsp + 0x40], edx
mov r13d, esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DefaultCommPlaybackDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006aba3
mov eax, dword [rsp + 0x50]
cmp eax, r14d
je 0x14006a9b3
cmp eax, 2
jne 0x14006aba3
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14006a9da
test r14b, cl
jne 0x14006aba3
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006a9e4
jmp 0x14006aba3
mov word [rsp + 0xb0], 0
mov r13d, ecx
shr r13d, 1
lea r8, [rsp + 0x30]
mov edx, 2
xor ecx, ecx
call fcn.14007bc00
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006aa26
add rax, 2
test cx, cx
jne 0x14006aa10
mov eax, esi
jmp 0x14006aa2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006ab67
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006aab4
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006ab36
cmp dword [rdx + 0x10], eax
jge 0x14006aa80
cmp dword [rbx - 0xc], eax
jge 0x14006aa75
mov ecx, 0x80070057
call fcn.140001c00
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006ab36
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006aa98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006ab36
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006aae5
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001df0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006ab05
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015cf60
jmp 0x14006ab22
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015cd30
test edi, edi
js 0x14006ab5c
cmp edi, dword [rbx - 0xc]
jg 0x14006ab5c
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor esi, esi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140155730
test rax, rax
je 0x14006ab67
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.14007bdb0
jmp 0x14006ab67
mov ecx, 0x80070057
call fcn.140001c00
int3
test rbx, rbx
jne 0x14006ab70
mov ecx, esi
jmp 0x14006ab85
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
test ecx, ecx
js 0x14006ab98
cmp ecx, dword [rbx - 0xc]
jg 0x14006ab98
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006aba3
mov ecx, 0x80070057
call fcn.140001c00
int3
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140160e90
lea edx, [r13 + r13]
mov dword [rsp + 0x48], edx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.DefaultCommCaptureDevice
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006adee
mov eax, dword [rsp + 0x58]
cmp eax, r14d
je 0x14006ac0a
cmp eax, 2
jne 0x14006adee
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14006ac2e
test r14b, al
jne 0x14006adee
shr rax, 1
cmp word [rsp + rax*2 + 0xae], 0
je 0x14006ac38
jmp 0x14006adee
mov word [rsp + 0xb0], 0
lea r8, [rsp + 0x30]
mov edx, 2
mov ecx, r14d
call fcn.14007bc00
mov rbx, qword [rsp + 0x30]
mov rax, rbx
lea rdx, [rsp + 0xb0]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14006ac76
add rax, 2
test cx, cx
jne 0x14006ac60
mov eax, esi
jmp 0x14006ac7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14006adb1
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov rdi, rcx
test ecx, ecx
jne 0x14006ad01
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006ad80
cmp dword [rdx + 0x10], eax
jge 0x14006acd0
cmp dword [rbx - 0xc], eax
jge 0x14006acc5
mov ecx, 0x80070057
call fcn.140001c00
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x14006ad80
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14006ace8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x38]
jmp 0x14006ad80
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xb0]
sub rbp, rbx
sar rbp, 1
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, r14d
jge 0x14006ad31
mov edx, ecx
lea rcx, [rsp + 0x30]
call fcn.140001df0
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x14006ad51
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14015cf60
jmp 0x14006ad6e
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.14015cd30
test edi, edi
js 0x14006ada6
cmp edi, dword [rbx - 0xc]
jg 0x14006ada6
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140155730
test rax, rax
je 0x14006adb1
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.14007bdb0
jmp 0x14006adb1
mov ecx, 0x80070057
call fcn.140001c00
int3
test rbx, rbx
jne 0x14006adba
xor ecx, ecx
jmp 0x14006add0
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14006ade3
cmp ecx, dword [rbx - 0xc]
jg 0x14006ade3
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x14006adee
mov ecx, 0x80070057
call fcn.140001c00
int3
test r15, r15
je 0x14006ae05
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x68]
call fcn.1401557fc
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14006ae2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006ae3f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006ae3f
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14015d000
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret