Function at 0x140012b90
Capabilities:
Get uefi variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor esi, esi
mov r12d, edx
cmp dword [0x140079940], 2
mov r15, rcx
mov edi, 1
lea r13, [rsi - 1]
jne 0x140012db8
mov rcx, qword [0x14007b328]
test rcx, rcx
je 0x140012bf6
call fcn.14004070c
mov qword [0x14007b328], rsi
mov dword [0x140079940], esi
call fcn.14002af30
test eax, eax
jne 0x140012db8
xor edx, edx
mov dword [rsp + 0x30], 0x600c4
mov r8d, 0x200
mov dword [rsp + 0x50], 0x200
lea rcx, [rsp + 0x60]
call fcn.1400423d0
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140012cfe
lea rax, [rsp + 0x50]
mov r8d, 4
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je 0x140012cfe
movzx ecx, word [rsp + 0x60]
test cx, cx
je 0x140012cfe
test byte [rsp + 0x62], dil
je 0x140012cfe
movzx eax, cx
mov r14d, 0xfe
inc cx
inc eax
cmp eax, r14d
mov eax, 2
cmovb r14w, cx
movzx ecx, r14w
mul rcx
mov word [0x14007b320], r14w
cmovo rax, r13
mov rcx, rax
call fcn.140040704
mov rbx, rax
test rax, rax
je 0x140012cea
movzx ecx, word [rsp + 0x64]
lea r8, [rsp + 0x66]
mov word [rax], cx
movzx ecx, r14w
lea rdx, [rcx*2 - 2]
mov r9, rdx
lea rcx, [rax + 2]
call fcn.140006a90
mov qword [0x14007b328], rbx
cmp qword [0x14007b328], rsi
je 0x140012cfe
mov dword [0x140079940], edi
jmp 0x140012dc0
call fcn.14002b240
test eax, eax
je 0x140012db8
mov eax, dword [0x1400799e8]
cmp eax, 2
jne 0x140012d21
call fcn.14002aa70
mov eax, dword [0x1400799e8]
cmp eax, edi
je 0x140012db8
call fcn.14003e990
test eax, eax
je 0x140012db8
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.1400423d0
mov r9d, 0x100
lea r8, [rsp + 0x60]
lea rdx, str.607005d5_3f75_4b2e_98f0_85ba66797a3e
lea rcx, str.MyASUSStaticField
call qword [sym.imp.api_ms_win_core_firmware_l1_1_0.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
je 0x140012db8
cmp byte [rsp + 0x60], 0x4d
jne 0x140012db8
cmp byte [rsp + 0x61], 0x41
jne 0x140012db8
cmp byte [rsp + 0x62], 0x53
jne 0x140012db8
cmp byte [rsp + 0x63], 0x46
jne 0x140012db8
cmp byte [rsp + 0x66], sil
jne 0x140012db8
mov eax, 0x7e8
cmp word [rsp + 0x64], ax
jb 0x140012db8
call fcn.140012910
test eax, eax
je 0x140012db8
cmp qword [0x14007b328], rsi
je 0x140012db8
mov dword [0x140079940], 3
jmp 0x140012e2e
cmp dword [0x140079940], edi
jne 0x140012e21
test r15, r15
je 0x140012e1a
mov rax, qword [0x14007b328]
test rax, rax
je 0x140012e1a
movzx r9d, word [rax]
lea r8, [0x140066554]
mov rdx, r12
mov rcx, r15
call fcn.140006720
cmp di, word [0x14007b320]
jae 0x140012e1a
mov rax, qword [0x14007b328]
mov edx, r12d
mov ecx, edi
movzx r8d, word [rax + rcx*2]
mov rcx, r15
call fcn.140012ad0
test eax, eax
je 0x140012e1a
movzx eax, word [0x14007b320]
inc edi
cmp edi, eax
jb 0x140012df0
xor eax, eax
jmp 0x1400130bb
cmp dword [0x140079940], 3
jne 0x1400130b8
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1400423d0
lea rcx, [rsp + 0x60]
call fcn.1400131a0
test eax, eax
je 0x1400130b8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400130b8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rsi
lea rdx, [0x1400665c8]
mov ebx, 0x80
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012eff
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DedicatedSegmentSize
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
cmove ebx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x50], esi
lea rcx, [0x140066678]
mov qword [rsp + 0x30], rsi
mov r14d, esi
call qword [sym.imp.dxgi.dll_CreateDXGIFactory]
test eax, eax
jne 0x14001300e
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001300e
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
xor edx, edx
mov r13d, esi
call qword [rax + 0x38]
cmp eax, 0x887a0002
je 0x140012fd5
nop word [rax + rax]
test r14d, r14d
jne 0x140012fd5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140012fb8
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x40]
test eax, eax
jne 0x140012fa8
cmp dword [rbp + 0x60], 0x8086
jne 0x140012fa8
mov rbx, qword [rbp + 0x70]
mov ecx, esi
mov rax, qword [rbp + 0x80]
mov r14d, edi
shr rbx, 0x14
shr rax, 0x14
cmp ebx, eax
sete cl
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
inc r13d
mov edx, r13d
mov rax, qword [rcx]
call qword [rax + 0x38]
cmp eax, 0x887a0002
jne 0x140012f60
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14d, r14d
je 0x14001300e
cmp dword [rsp + 0x50], esi
je 0x14001300e
movzx edx, word [0x14007b320]
mov rcx, qword [0x14007b328]
movzx eax, word [rcx + rdx*2 - 4]
cmp ebx, eax
jbe 0x140013015
movzx eax, word [rcx + rdx*2 - 2]
cmp ebx, eax
cmovb ebx, eax
jmp 0x140013015
mov rcx, qword [0x14007b328]
test r15, r15
je 0x1400130b4
test rcx, rcx
je 0x1400130b4
mov rdx, r12
lea r8, [0x140066554]
mov r9d, ebx
mov rcx, r15
call fcn.140006720
cmp si, word [0x14007b320]
mov r14d, esi
jae 0x1400130a6
test esi, esi
jne 0x140013074
mov rcx, qword [0x14007b328]
mov eax, r14d
movzx edx, word [rcx + rax*2]
cmp ebx, edx
ja 0x14001307b
mov esi, edi
je 0x14001307b
mov r8d, ebx
mov edx, r12d
mov rcx, r15
call fcn.140012ad0
test eax, eax
je 0x1400130b4
mov rcx, qword [0x14007b328]
mov eax, r14d
mov edx, r12d
movzx r8d, word [rcx + rax*2]
mov rcx, r15
call fcn.140012ad0
test eax, eax
je 0x1400130a2
movzx r9d, word [0x14007b320]
inc r14d
cmp r14d, r9d
jb 0x140013048
test esi, esi
jne 0x1400130b4
mov r8d, ebx
mov edx, r12d
mov rcx, r15
call fcn.140012ad0
mov eax, edi
jmp 0x1400130bb
mov eax, r13d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret