Function at 0x140089390
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x49], r15d
mov dword [rbp - 0x11], r15d
mov qword [rbp - 0x21], r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rcx + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140089439
mov dword [rbp - 1], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x27]
xor r8d, r8d
lea rdx, str.DeviceState
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rbp - 0x11]
mov dword [rdi + 0x80], eax
mov qword [rbp - 0x41], r15
mov rax, qword [rdi + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140089468
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14004487d.0]
mov rcx, rax
test rax, rax
jne 0x140089483
call fcn.140039c50
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x14004487d.0]
mov rcx, rax
test rcx, rcx
je 0x1400897f4
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x49], 1
lea r12, str.FxProperties
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x1400894c0
mov rdx, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x41]
call fcn.1400666a0
mov dword [rbp - 0xd], r15d
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp - 0x41]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140089551
mov dword [rbp + 3], 4
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0xd]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2b]
xor r8d, r8d
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rbp - 0x49], r15d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140089575
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov eax, r15d
cmp dword [rbp - 0xd], r15d
sete al
mov dword [rdi + 0x7c], eax
mov dword [rdi + 0x88], r15d
mov qword [rbp - 9], r15
mov edx, dword [rdi + 0x78]
lea rcx, [rbp - 9]
call fcn.140088c50
nop
mov rax, qword [rbp - 9]
cmp dword [rax - 0x10], 0
je 0x140089795
xor eax, eax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
mov dword [rbp + 0x1f], r15d
mov qword [rbp - 0x39], r15
mov rax, qword [rdi + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400895e4
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14004487d.0]
mov rcx, rax
test rax, rax
jne 0x1400895ff
call fcn.140039c50
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x14004487d.0]
mov rcx, rax
test rcx, rcx
je 0x1400897ff
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x49], 2
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x140089630
mov rdx, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.1400666a0
mov r8, qword [rbp - 9]
mov rbx, qword [rbp - 0x39]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.140058280
mov r14d, eax
mov dword [rbp - 0x49], r15d
lea rdx, [rbx - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140089691
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14004487d.0]
test r14d, r14d
je 0x14008976c
mov qword [rbp - 0x31], r15
mov rax, qword [rdi + 0x48]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400896c0
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14004487d.0]
mov rcx, rax
test rax, rax
jne 0x1400896db
call fcn.140039c50
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x14004487d.0]
mov rcx, rax
test rcx, rcx
je 0x1400897e9
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
add rax, 0x18
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x49], 4
mov rax, rsi
inc rax
cmp word [r12 + rax*2], 0
jne 0x140089703
mov rdx, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x31]
call fcn.1400666a0
lea r9, [rbp + 7]
mov r8, qword [rbp - 9]
mov rbx, qword [rbp - 0x31]
mov rdx, rbx
call fcn.140057700
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008975b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
lea rcx, [rbp + 7]
call fcn.14006a3e0
mov dword [rdi + 0x88], eax
jmp 0x140089776
mov dword [rdi + 0x88], 0xfffffffe
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x14008979f
mov rdx, qword [rbp + 0xf]
mov rcx, rbx
call fcn.140059000
mov rcx, rbx
call fcn.1402384fc
jmp 0x14008979f
mov dword [rdi + 0x88], 0xfffffffe
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400897c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
nop
mov ecx, 0x80004005
call fcn.140039950
int3