Function at 0x140027310
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ecx, dword [0x14007b9f8]
xor edi, edi
lea r15d, [rdi + 1]
test ecx, ecx
jne 0x1400273ff
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400273ff
lea rax, [rbp - 0x2d]
mov dword [rbp - 0x29], 0x50021
lea r9, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 4]
mov dword [rbp - 0x2d], 4
lea rdx, [rbp - 0x29]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je 0x1400273f9
cmp dword [rbp - 0x2d], 4
mov ecx, edi
cmovae ecx, dword [rbp - 0x31]
mov eax, ecx
and eax, 0x50000
cmp eax, 0x50000
jne 0x1400273f9
mov eax, dword [0x140079b30]
bt ecx, 0x13
mov dword [0x14007b9fc], r15d
cmovb eax, r15d
bt ecx, 0x14
mov dword [0x140079b30], eax
mov eax, dword [0x140079b34]
cmovb eax, r15d
mov dword [0x140079b34], eax
bt ecx, 0x15
jae 0x1400273dc
mov qword [0x140079b38], r15
test eax, eax
jne 0x14002740d
mov eax, ecx
shr ecx, 7
and eax, 3
and ecx, r15d
mov dword [0x140079b3c], eax
mov dword [0x140079b40], ecx
jmp 0x14002740d
mov ecx, dword [0x14007b9f8]
cmp dword [0x14007b9fc], edi
jne 0x14002740d
mov edx, edi
test ecx, ecx
je 0x140027410
mov edx, r15d
lea rcx, str.CheckKeyboardLightStatus
call fcn.14003f770
cmp dword [0x14007b9fc], edi
jne 0x140027465
cmp dword [0x14007b9f8], edi
jne 0x14002746d
mov rcx, qword [0x14007d0d8]
test rcx, rcx
je 0x140027445
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14007d0d8], rdi
mov rcx, qword [0x14007d100]
test rcx, rcx
je 0x14002745e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14007d100], rdi
xor eax, eax
jmp 0x140027811
cmp dword [0x14007b9f8], edi
je 0x1400274db
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400274db
lea rax, [rbp - 0x2d]
mov dword [rbp - 0x31], 0x50021
lea r9, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rbp - 0x2d], 4
lea rdx, [rbp - 0x31]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je 0x1400274db
cmp dword [rbp - 0x2d], 4
mov ecx, edi
mov eax, dword [0x140079b30]
cmovae ecx, dword [rbp - 0x29]
bt ecx, 0x13
cmovb eax, r15d
mov dword [0x140079b30], eax
bt ecx, 0x15
jae 0x1400274db
mov qword [0x140079b38], r15
mov qword [rsp + 0xd0], rbx
lea rcx, [rbp - 0x39]
mov qword [rsp + 0xd8], rsi
xor edx, edx
mov qword [rsp + 0xe0], r14
mov ebx, edi
mov qword [rbp - 0x39], rdi
call fcn.140031c50
test eax, eax
je 0x140027565
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x2d]
lea rax, [rbp - 0x29]
mov dword [rbp - 0x31], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.TurnOffKeybdLight
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140027545
mov esi, dword [rbp - 0x29]
mov r14d, r15d
jmp 0x14002754b
mov esi, dword [rbp - 0x31]
mov r14d, edi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r14d, r14d
je 0x140027565
lea eax, [rsi - 0x1e]
cmp eax, 0x4632
cmovbe ebx, esi
lea eax, [rbx + rbx*4]
add eax, eax
mov dword [0x140079b44], eax
call fcn.140026ad0
call fcn.140028cb0
mov edx, r15d
mov ecx, r15d
call fcn.140026d70
call fcn.140026cf0
call fcn.14002af30
test eax, eax
je 0x14002759e
call fcn.140028b10
mov dword [0x140079b50], eax
call fcn.1400282a0
call fcn.140028fe0
movaps xmm0, xmmword [str.745a17a0_74d3_11d0_b6fe_00a0c90f57da]
lea rdx, [rbp - 0x19]
movaps xmm1, xmmword [0x140068850]
lea rcx, [rbp - 0x2d]
mov eax, dword [0x140068888]
mov r8d, 0x300
movaps xmmword [rbp - 0x19], xmm0
mov esi, edi
movaps xmm0, xmmword [0x140068860]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [0x140068880]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [0x140068870]
mov dword [rbp + 0x2f], eax
movzx eax, word [0x14006888c]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
mov word [rbp + 0x33], ax
mov dword [rbp - 0x2d], edi
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_List_SizeW]
test eax, eax
jne 0x1400276b8
mov ebx, dword [rbp - 0x2d]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x1400276b8
mov r8d, dword [rbp - 0x2d]
lea rcx, [rbp - 0x19]
mov r9d, 0x300
mov rdx, rax
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_ListW]
test eax, eax
jne 0x1400276a0
mov rbx, r14
cmp word [r14], di
je 0x1400276a0
nop
test esi, esi
jne 0x1400276a0
xor r8d, r8d
lea rcx, [rbp - 0x31]
mov rdx, rbx
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Locate_DevNodeW]
test eax, eax
jne 0x140027686
mov ecx, dword [rbp - 0x31]
call fcn.140029080
test eax, eax
cmovne esi, r15d
mov edx, 0xc8
mov rcx, rbx
call fcn.14004d7f4
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], di
jne 0x140027660
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jne 0x1400276d1
mov rcx, qword [0x14007d100]
test rcx, rcx
je 0x1400276d1
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14007d100], rdi
mov eax, dword [0x140079924]
cmp eax, 2
jne 0x1400276ff
mov ecx, dword [0x1400799b4]
cmp ecx, eax
jne 0x1400276f1
call fcn.14002aa70
mov ecx, dword [0x1400799b4]
mov eax, edi
cmp ecx, r15d
sete al
mov dword [0x140079924], eax
cmp eax, r15d
jne 0x1400277f6
xor edx, edx
mov qword [rbp - 0x39], rdi
lea rcx, [rbp - 0x39]
mov esi, r15d
call fcn.140031c50
test eax, eax
je 0x14002777b
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x2d]
lea rax, [rbp - 0x29]
mov dword [rbp - 0x31], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.KeybdBatteryAutoLight
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002775b
mov ebx, dword [rbp - 0x29]
mov r14d, r15d
jmp 0x140027761
mov ebx, dword [rbp - 0x31]
mov r14d, edi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r14d, r14d
je 0x14002777b
cmp ebx, r15d
ja 0x14002777b
mov esi, edi
sete sil
xor edx, edx
mov dword [0x140079b24], esi
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], rdi
mov ebx, 0x14
call fcn.140031c50
test eax, eax
je 0x1400277f0
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x2d]
lea rax, [rbp - 0x29]
mov dword [rbp - 0x31], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.KeybdBatteryThreshold
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400277d6
mov esi, dword [rbp - 0x29]
mov edi, r15d
jmp 0x1400277d9
mov esi, dword [rbp - 0x31]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400277f0
lea ecx, [rsi - 0xa]
cmp ecx, 0x28
cmovbe ebx, esi
mov dword [0x140079b28], ebx
mov r14, qword [rsp + 0xe0]
mov eax, r15d
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0xb0
pop r15
pop rdi
pop rbp
ret