Function at 0x140015f20
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x1400163a9
push rbx
push rsi
push rdi
sub rsp, 0x60
cmp byte [rcx], 0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
je 0x1400163a2
lea rax, [rsp + 0x40]
mov rdx, rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400163a2
mov eax, dword [0x1400dd138]
mov qword [rsp + 0x50], r13
test dword [0x1400dd314], eax
je 0x140015f8f
lea rcx, str.RegPatg__s
mov rdx, rsi
call fcn.14000cbb0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.ATIPOLL
xor r13d, r13d
xor r8d, r8d
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], 4
mov dword [rsp + 0x98], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140015ffd
cmp dword [rsp + 0x80], 4
jne 0x140015ffd
mov eax, dword [rsp + 0x98]
mov dword [rdi], eax
jmp 0x140016392
mov dword [rdi], r13d
mov dword [rbx], r13d
mov eax, dword [0x1400df34c]
cmp eax, 8
mov qword [rsp + 0x88], rbp
jbe 0x14001601f
lea rdx, str.ExtEvent_EnablePowerPlay
jmp 0x140016034
lea rdx, str.ExtEvent_EnablePowerPlay
lea rcx, str.ExtEvent_EnablePolling
cmp eax, 8
cmovne rdx, rcx
mov rcx, qword [rsp + 0x40]
mov r9, rdi
mov r8d, 0x1e
call fcn.140015e70
cmp dword [0x1400df34c], 9
jb 0x140016056
and dword [rdi], 0xfffefffd
bt dword [rdi], 0x10
jae 0x140016095
cmp dword [0x1400df34c], 8
jb 0x140016074
lea rdx, str.ExtEvent_EnableMpAtLogOn
mov r8d, 0x10
jmp 0x140016081
lea rdx, str.ExtEvent_EnableMpAtLogOn
mov r8d, 0xf
mov rcx, qword [rsp + 0x40]
mov r9, rbx
call fcn.140015e70
mov ecx, dword [rbx]
call fcn.140015bb0
mov ebp, 2
test byte [rdi], bpl
je 0x140016139
mov qword [rsp + 0x58], r12
mov r12, qword [rsp + 0x40]
mov dword [rbx + 4], r13d
lea rdi, [0x1400aa0a8]
mov rsi, rbp
nop
nop
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140016117
cmp dword [rsp + 0x30], 4
jne 0x140016117
cmp dword [rsp + 0x34], 1
jne 0x140016122
mov eax, dword [rdi]
or dword [rbx + 4], eax
jmp 0x140016122
cmp dword [rdi + 4], r13d
je 0x140016122
mov eax, dword [rdi]
or dword [rbx + 4], eax
add rdi, 0x10
sub rsi, 1
jne 0x1400160c0
mov ecx, dword [rbx + 4]
call fcn.140015bb0
mov r12, qword [rsp + 0x58]
cmp dword [0x1400df34c], 9
jae 0x1400161be
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 8], r13d
lea rdi, [0x1400aa0c8]
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400161a9
cmp dword [rsp + 0x34], 4
jne 0x1400161a9
cmp dword [rsp + 0x30], 1
jne 0x1400161b4
mov eax, dword [rdi]
or dword [rbx + 8], eax
jmp 0x1400161b4
cmp dword [rdi + 4], r13d
je 0x1400161b4
mov eax, dword [rdi]
or dword [rbx + 8], eax
add rdi, 0x10
sub rbp, 1
jne 0x140016152
mov ecx, dword [rbx + 8]
call fcn.140015bb0
mov rbp, qword [rsp + 0x40]
mov dword [rbx + 0xc], r13d
lea rdi, [0x1400aa0e8]
mov esi, 6
nop
nop
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140016237
cmp dword [rsp + 0x34], 4
jne 0x140016237
cmp dword [rsp + 0x30], 1
jne 0x140016242
mov eax, dword [rdi]
or dword [rbx + 0xc], eax
jmp 0x140016242
cmp dword [rdi + 4], r13d
je 0x140016242
mov eax, dword [rdi]
or dword [rbx + 0xc], eax
add rdi, 0x10
sub rsi, 1
jne 0x1400161e0
cmp dword [0x1400df34c], 8
mov rbp, qword [rsp + 0x88]
jb 0x1400162c6
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.EnableLassoSupport
xor r8d, r8d
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400162c6
cmp dword [rsp + 0x34], 4
jne 0x1400162c6
mov eax, dword [rsp + 0x30]
cmp eax, 1
jne 0x1400162ba
or dword [rbx + 0xc], 0x40
jmp 0x1400162c6
cmp eax, 2
jne 0x1400162c6
or dword [rbx + 0xc], 0x80
mov ecx, dword [rbx + 0xc]
call fcn.140015bb0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rbx + 0x10], r13d
mov rdx, qword [str.ExtEvent_EnableSbiosPowerControl]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001632b
cmp dword [rsp + 0x34], 4
jne 0x14001632b
cmp dword [rsp + 0x30], 1
jne 0x14001632b
or dword [rbx + 0x10], 1
mov ecx, dword [rbx + 0x10]
call fcn.140015bb0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rbx + 0x14], r13d
mov rdx, qword [str.ExtEvent_DebugFlags]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140016392
cmp dword [rsp + 0x34], 4
jne 0x140016392
cmp dword [rsp + 0x30], 1
jne 0x140016392
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x14], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0x50]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret 0