Function at 0x140035140
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
xor edi, edi
mov dword [rbp + 0x77], edi
mov rax, qword [0x1403df148]
test eax, eax
jg 0x14003518e
lea r8, str.DriverPropertyClient.cpp
lea edx, [rdi + 0x61]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov r14d, edi
jmp 0x1400351dc
movups xmm0, xmmword [0x1403434b0]
movaps xmmword [rbp + 7], xmm0
test rax, rax
jle 0x140035400
mov rcx, qword [0x1403df140]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 0x36]
lea rdx, [rbp + 7]
mov rcx, qword [rcx]
call fcn.14005f420
mov r14d, eax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x1400353ea
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rbx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140015a40
or rsi, 0xffffffffffffffff
test al, al
jne 0x14003523a
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140035220
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1400105e0
nop
mov qword [rbp + 0x17], rdi
mov dword [rbp + 0x1f], edi
mov qword [rbp + 0x27], rdi
mov r9d, 0x2001f
mov rbx, qword [rbp - 0x19]
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x17]
call fcn.140015610
test eax, eax
je 0x1400352b5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x17]
call fcn.1400153d0
test eax, eax
je 0x1400352b5
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x1400353b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
mov qword [rbp + 0x17], rcx
jmp 0x1400353b6
mov dword [rbp + 0x67], edi
lea rax, str.AsusGPIOHigh
lea rbx, str.AsusGPIOLow
cmp dword [rbp + 0x6f], 0
cmovne rbx, rax
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x1400353f5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x11], rax
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.140015a40
test al, al
jne 0x14003531a
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140035300
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400105e0
nop
mov dword [rbp + 0x7f], 4
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rbx, qword [rbp - 0x11]
mov rdx, rbx
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, dword [rbp + 0x67]
inc r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 5
imul eax, edx, 0x64
sub r8d, eax
mov dword [rbp + 0x67], r8d
mov dword [rbp - 0x29], r8d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, r14d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400353ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x17]
mov rbx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400353c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400353da
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
nop
call fcn.1400f91a0
int3