Function at 0x14000c280
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x528]
sub rsp, 0x600
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor r13d, r13d
mov r15d, r13d
mov dword [rbp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
mov r8d, 0x25
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rcx, [rbp + 0xb8]
call fcn.1400078d0
nop
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 7
cmova rdx, qword [rbp + 0xb8]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c35b
lea rdx, str.Failed_to_open_DISPLAY_reg_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x14000cbfb
mov dword [rbp + 0x2c], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000c3d5
lea rdx, str.Failed_to_query_DISPLAY_key_info.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x14000cbfb
mov r12d, r13d
cmp dword [rbp + 0x2c], r13d
jbe 0x14000cbef
movabs rbx, 0x7ffffffffffffffe
lea rdi, [0x1400183a4]
lea rsi, [0x1400183a8]
nop word [rax + rax]
mov dword [rbp + 0x70], pe_nt_image_headers64
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x70]
lea r8, [rbp + 0xe0]
mov edx, r12d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000cbe2
mov rax, rbx
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
cmp rax, 1
jb 0x14000ccb4
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 7
cmova r9, qword [rbp + 0xb8]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x80]
call fcn.14000dd40
or r15d, 2
lea rax, [rbp + 0xe0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c4a0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call fcn.140006930
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
or r15d, 4
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000c53c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc3f
call fcn.140013d44
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova rdx, qword [rbp + 0x98]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000cb9c
mov dword [rbp + 0x28], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000cb91
mov r14d, r13d
cmp dword [rbp + 0x28], r13d
jbe 0x14000cb91
mov dword [rbp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x2e0]
mov edx, r14d
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000cb84
mov rax, rbx
mov rcx, qword [rbp + 0xa8]
sub rax, rcx
cmp rax, 1
jb 0x14000ccd2
lea r9, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova r9, qword [rbp + 0x98]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x38]
call fcn.14000dd40
nop
lea rax, [rbp + 0x2e0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c680
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x38]
call fcn.140006930
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm6
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000c6fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c6f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc46
call fcn.140013d44
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rax
mov rax, rbx
movq rcx, xmm6
sub rax, rcx
cmp rax, 0x12
jb 0x14000cccc
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.14000dd40
nop
mov rax, rbx
mov rcx, qword [rbp + 0x88]
sub rax, rcx
cmp rax, 0x1a
jb 0x14000ccc6
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x1a
lea rax, str.ControlDevice_Parameters
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.14000dd40
nop
mov rax, rbx
mov rcx, qword [rbp + 0x88]
sub rax, rcx
cmp rax, 0x1a
jb 0x14000ccc0
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x1a
lea rax, str.MonitorDevice_Parameters
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.14000dd40
or r15d, 0xf8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r13
mov ecx, 0x60
call fcn.1400139f0
mov rbx, rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
lea rcx, [rax + 0x60]
mov qword [rbp + 0x68], rcx
lea rax, [rbp + 0x58]
mov qword [rbp - 0x60], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
lea rax, [rbp + 0x58]
mov qword [rbp + 0x48], rax
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.1400069b0
add rbx, 0x20
mov qword [rbp + 0x40], rbx
add rdi, 0x20
lea rax, [rbp + 0x10]
cmp rdi, rax
jne 0x14000c850
mov rdx, rbx
mov rcx, rbx
call fcn.14000dc60
mov qword [rbp + 0x60], rbx
lea r9, [fcn.140003570]
mov edx, 0x20
mov r8d, 3
lea rcx, [rbp - 0x50]
call fcn.140013a2c
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
cmp rbx, rsi
je 0x14000cb1f
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 5
jb 0x14000ccba
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000c8d8
mov r9, qword [rbx]
mov qword [rsp + 0x30], 5
lea rax, [0x140018440]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.14000dd40
or r15d, 1
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000c974
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c96f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc4d
call fcn.140013d44
test edi, edi
jne 0x14000cb12
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8d, 4
lea rdx, str.EDID
lea rcx, [rsp + 0x60]
call fcn.1400078d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r13
mov r8d, 4
lea rdx, str.EDID
lea rcx, [rbp + 0x38]
call fcn.1400078d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
call fcn.14000b850
movzx edi, al
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000ca21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc54
call fcn.140013d44
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000ca74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc5b
call fcn.140013d44
test dil, dil
je 0x14000cb08
lea rdx, str.Spoofed_EDID_for:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
mov rdi, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140011f20
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000caaf
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000cb08
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc62
call fcn.140013d44
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x20
cmp rbx, rsi
jne 0x14000c8b0
lea rcx, [rbp + 0x58]
call fcn.14000d840
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000cb6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc69
call fcn.140013d44
lea rsi, [0x1400183a8]
lea rdi, [0x1400183a4]
movabs rbx, 0x7ffffffffffffffe
inc r14d
cmp r14d, dword [rbp + 0x28]
jb 0x14000c5e2
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14000cbe2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cbdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cc70
call fcn.140013d44
inc r12d
cmp r12d, dword [rbp + 0x2c]
jb 0x14000c400
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x14000cc7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140013d44
movzx eax, bl
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.1400139d0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002960
nop
call fcn.140002960
nop
call fcn.140002960
nop
call fcn.140002960
nop
call fcn.140002960
nop
call fcn.140002960
int3