Function at 0x18001d400
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x458]
sub rsp, 0x558
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x4c0]
mov r15, r8
mov rbx, qword [rbp + 0x4c8]
mov r12, rcx
mov qword [rsp + 0x40], r8
lea rcx, [rbp + 0x230]
mov qword [rbp - 0x80], rdx
mov r8d, 0x208
xor edx, edx
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x70], r9
call sub.ntdll.dll_memset
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x18001d613
lea r14, str.kbdus.dll
cmp r12, r14
je 0x18001d53a
mov edx, 3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edx, 5
mov rcx, rdi
mov r13, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
mov r14, rax
test rbx, rbx
je 0x18001d60b
test dword [r15], 0x20000000
jne 0x18001d502
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x18001d502
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
jne 0x18001d60b
mov edx, 6
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov r15, rax
test r15, r15
jne 0x180040e26
test r14, r14
jne 0x180040fbd
test r13, r13
jne 0x180040fbd
mov r15, qword [rsp + 0x40]
lea r14, str.kbdus.dll
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x1800410db
call qword [case.0x18001f7d3.0]
mov rcx, qword [rbp - 0x70]
sub eax, edi
mov dword [rcx], eax
test rbx, rbx
je 0x18001d582
mov edx, 0x20
lea rcx, [rbx + 0x244]
mov r9d, edx
mov r8, r12
call fcn.18000fe30
mov word [rbx + 0x282], si
mov rbx, qword [rbp - 0x68]
mov edx, 2
mov rcx, rdi
mov dword [rbx], esi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
jne 0x18004114a
mov r8d, 0x104
lea rdx, [rbp + 0x230]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0x230]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.180033470
add rsp, 0x558
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r15, rsi
jmp 0x18001d513
xor eax, eax
jmp 0x18001d5e8
mov rcx, rbx
mov rax, r15
call qword [case.0x18001f7d3.0]
test eax, eax
je 0x18001d51c
cmp dword [rbx], 8
jae 0x180040fb6
cmp dword [rbx], 0
jbe 0x180040eb6
mov r13, qword [rsp + 0x40]
and qword [rsp + 0x28], 0
lea rcx, [rbx + 4]
mov r14d, esi
lea r9, [rsp + 0x48]
mov r8, r13
xor edx, edx
lea rax, [r14 + r14*8]
lea rcx, [rcx + rax*8]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
call fcn.18001d400
mov edx, esi
add rdx, rdx
mov qword [rbx + rdx*8 + 0x288], rax
test rax, rax
je 0x180040ea6
mov eax, dword [rsp + 0x48]
lea rcx, [r14 + 0x29]
add rcx, rcx
mov dword [rbx + rcx*8], eax
mov eax, dword [rsp + 0x4c]
mov dword [rbx + rdx*8 + 0x294], eax
inc esi
cmp esi, dword [rbx]
jb 0x180040e4d
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
lea rdx, str.RegistryMachineSystemCurrentControlSetServicesi8042prtParameters
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov dword [rbp - 0x50], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x40], rax
xor esi, esi
mov dword [rbp - 0x38], 0x40
lea r8, [rbp - 0x50]
mov qword [rbp - 0x48], rsi
mov edx, 0x20019
lea rcx, [rsp + 0x58]
movdqu xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18001d51c
lea rdx, str.OverrideKeyboardType
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea r8d, [rsi + 2]
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180040f52
mov eax, dword [rbp - 4]
mov dword [rbx + 0x30c], eax
cmp dword [rbx + 0x30c], esi
je 0x180040fa5
lea rdx, str.OverrideKeyboardSubtype
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 8]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180040fa5
mov eax, dword [rbp + 0x14]
mov dword [rbx + 0x310], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x18001d51c
mov dword [rbx], esi
jmp 0x18001d51c
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rbp - 0x78]
mov edx, 0x10
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
mov rax, qword [rsp + 0x40]
test dword [rax], 0x20000000
jne 0x18004102f
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x18004102f
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x18004102f
lea rcx, [rbp - 0x20]
call fcn.18007cefc
test eax, eax
lea rcx, [rbp - 0x20]
cmove rcx, rsi
mov rsi, rcx
test r14, r14
je 0x180041053
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp + 0x20]
xor r9d, r9d
mov r8, rsi
mov rax, r14
call qword [case.0x18001f7d3.0]
xor esi, esi
test eax, eax
je 0x180041055
jmp 0x180041073
xor esi, esi
test r13, r13
je 0x18001d52e
lea rcx, [rbp + 0x20]
mov rax, r13
call qword [case.0x18001f7d3.0]
test eax, eax
je 0x18001d52e
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x1800410ad
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x1800410ad
test r15, r15
jne 0x1800410ad
or dword [rbx + 0x308], 1
xor r8d, r8d
lea rcx, [rbp + 0x20]
xor edx, edx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x1800410d4
mov rcx, rdi
lea r12, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov rdi, rsi
xor esi, esi
jmp 0x18001d52e
test rbx, rbx
je 0x180041116
mov edi, esi
cmp dword [rbx], esi
jbe 0x180041114
cmp edi, 8
jae 0x180041112
mov esi, edi
add rsi, rsi
mov rcx, qword [rbx + rsi*8 + 0x288]
test rcx, rcx
je 0x18004110c
call qword [sym.imp.ntdll.dll_NtClose]
and qword [rbx + rsi*8 + 0x288], 0
inc edi
cmp edi, dword [rbx]
jb 0x1800410e6
xor esi, esi
mov dword [rbx], esi
cmp dword [r15], esi
jge 0x18001d613
cmp r12, r14
je 0x18001d613
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov r12, r14
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x18001d489
jmp 0x18001d613
call qword [case.0x18001f7d3.0]
sub eax, edi
mov dword [rbx], eax
jmp 0x18001d59f