Function at 0x140028cb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x50
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [0x14007d110]
xor ebx, ebx
dec rax
mov qword [rsp + 0x70], rdi
lea r14d, [rbx + 1]
cmp rax, 0xfffffffffffffffd
ja 0x140028d3b
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], 0x5002f
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 4]
mov dword [rsp + 0x38], 4
lea rdx, [rsp + 0x40]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je 0x140028d3b
cmp dword [rsp + 0x38], 4
mov eax, ebx
cmovae eax, dword [rsp + 0x3c]
bt eax, 0x10
mov eax, dword [0x14007ba00]
cmovb eax, r14d
mov dword [0x14007ba00], eax
xor edx, edx
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov edi, ebx
call fcn.140031c50
test eax, eax
je 0x140028dc4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.OOBEKeybdLight
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x3c], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140028d9f
mov esi, dword [rsp + 0x40]
mov ebp, r14d
jmp 0x140028da5
mov esi, dword [rsp + 0x3c]
mov ebp, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebp, ebp
mov rbp, qword [rsp + 0x60]
je 0x140028dbf
cmp esi, 2
cmovbe edi, esi
mov rsi, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
mov dword [0x140079b64], edi
mov dword [rsp + 0x38], ebx
call qword [sym.imp.api_ms_win_oobe_notification_l1_1_0.dll_OOBEComplete]
mov rdi, qword [rsp + 0x70]
cmp dword [rsp + 0x38], ebx
je 0x140028de9
mov eax, r14d
jmp 0x140028e1e
cmp qword [0x14007ba08], rbx
jne 0x140028e1c
lea r8, [0x14007ba08]
xor edx, edx
lea rcx, [0x140028fc0]
call qword [sym.imp.api_ms_win_oobe_notification_l1_1_0.dll_RegisterWaitUntilOOBECompleted]
test eax, eax
jne 0x140028e1c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x139f
mov eax, r14d
je 0x140028e1e
mov eax, ebx
mov ecx, dword [0x140079b64]
mov dword [0x1400799ac], eax
test ecx, ecx
jne 0x140028e7a
cmp dword [0x140079b38], ebx
je 0x140028f1a
cmp dword [0x140079b3c], ebx
jne 0x140028f1a
test eax, eax
jne 0x140028f1a
mov edx, r14d
mov dword [0x140079b64], r14d
lea rcx, str.OOBEKeyboardLight
call fcn.14003f770
mov edx, r14d
lea rcx, str.OOBEKeybdLight
call fcn.1400320f0
mov ebx, 3
jmp 0x140028ed3
cmp ecx, r14d
jne 0x140028f1a
test eax, eax
je 0x140028f1a
mov ecx, dword [0x1400799a4]
cmp ecx, 3
jne 0x140028e9d
call fcn.14003e930
jmp 0x140028ea5
cmp ecx, r14d
mov eax, ebx
sete al
test eax, eax
je 0x140028f1a
xor edx, edx
mov dword [0x140079b64], ebx
lea rcx, str.OOBEKeyboardLight
call fcn.14003f770
xor edx, edx
lea rcx, str.OOBEKeybdLight
call fcn.1400320f0
cmp dword [0x140079b3c], ebx
je 0x140028f1a
cmp dword [0x14007b9f8], 0
mov dword [0x140079b3c], ebx
je 0x140028ef7
cmp dword [0x140079b40], 0
je 0x140028eee
sub ebx, 0xffffff80
lea rcx, str.HidKeybdLightLevel
jmp 0x140028f13
cmp dword [0x140079b34], 0
je 0x140028f1a
cmp dword [0x140079b40], 0
je 0x140028f0c
sub ebx, 0xffffff80
lea rcx, str.KeybdLightLevel
mov edx, ebx
call fcn.1400320f0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret