Function at 0x14000cbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov qword [rbp + 0x38], 0xfffffffffffffffe
lea r8, str.GetCurrentKeyboardStatus
mov qword [rsp + 0x40], r8
lea rbx, str.TOSTABSYSSVC.cpp
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 0x8de
lea rdi, str.__GetCurrentKeyboardStatus_
mov qword [rsp + 0x58], rdi
lea r14, [0x14002b804]
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], 3
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x48]
call fcn.1400012a0
nop
or rsi, 0xffffffffffffffff
mov r15d, esi
xor r13d, r13d
mov qword [rbp + 0xa8], r13
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceskbdclassEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, r13d
test eax, eax
setne cl
test ecx, ecx
je 0x14000cc89
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x10], 0x8e4
mov qword [rbp - 8], rdi
mov qword [rbp], r14
mov dword [rbp + 8], r13d
lea rcx, [rbp - 0x18]
jmp 0x14000ccf6
mov dword [rbp + 0x90], 4
mov dword [rbp + 0x98], r13d
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Count
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, r13d
test eax, eax
setne cl
test ecx, ecx
je 0x14000cd0a
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x8e8
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r14
mov dword [rbp - 0x70], r13d
lea rcx, [rsp + 0x70]
mov r8d, esi
lea rdx, str.Error_Code:_0x_x
call fcn.1400012a0
jmp 0x14000d097
call fcn.140004550
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000cd2a
mov ecx, 0x80004005
call fcn.140004450
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140004550
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000cd5c
mov ecx, 0x80004005
call fcn.140004450
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
call fcn.140004550
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000cd8e
mov ecx, 0x80004005
call fcn.140004450
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa0], rax
movzx r9d, word [0x1400378ca]
movzx r8d, word [0x1400378c8]
lea rdx, str.VID__04xPID__04x
lea rcx, [rbp + 0xa0]
call fcn.1400070b0
mov rdi, qword [rbp + 0xa0]
movsxd r14, dword [rdi - 0x10]
test r14d, r14d
jns 0x14000cde0
mov ecx, 0x80070057
call fcn.140004450
int3
sub r12d, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, r12d
jge 0x14000ce05
mov edx, r14d
lea rcx, [rbp + 0xa0]
call fcn.140007190
mov rdi, qword [rbp + 0xa0]
lea eax, [r14 + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140012ec0
cmp r14d, dword [rdi - 0xc]
jg 0x14000d0b2
mov dword [rdi - 0x10], r14d
mov word [rdi + r14*2], r13w
mov r14d, r13d
cmp dword [rbp + 0x98], r13d
jle 0x14000d04d
lea r12, str.TOSTABSYSSVC.cpp
nop
lea rdx, [rbx - 0x18]
mov r15, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000ce90
cmp dword [rdx + 0x10], 0
jge 0x14000ce67
cmp dword [rbx - 0xc], 0
jl 0x14000cfd4
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14000ce90
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ce77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdi, qword [rbp + 0xa0]
mov r8d, r14d
lea rdx, [0x14002e4a8]
lea rcx, [rsp + 0x38]
call fcn.1400070b0
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, r13d
test eax, eax
setne cl
test ecx, ecx
jne 0x14000d012
mov ecx, dword [rbp + 0x90]
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.140010f40
mov r15, rax
mov r8d, dword [rbp + 0x90]
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.140016a20
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, r13d
test eax, eax
setne cl
test ecx, ecx
jne 0x14000cfe7
mov r8, r15
lea rdx, [0x1400304cc]
lea rcx, [rsp + 0x30]
call fcn.1400070b0
mov qword [rbp - 0x40], r12
mov dword [rbp - 0x38], 0x90a
lea rax, str.__GetCurrentKeyboardStatus_
mov qword [rbp - 0x30], rax
lea rax, [0x14002b804]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 3
mov r9, rdi
mov rbx, qword [rsp + 0x30]
mov r8, rbx
lea rdx, str.regString___s_strPidVid__s
lea rcx, [rbp - 0x40]
call fcn.1400012a0
cmp dword [rbx - 0x10], 0
jl 0x14000cfc0
mov rdx, rdi
mov rcx, rbx
call fcn.140012f34
test rax, rax
je 0x14000cfc0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x14000cfdf
mov r15d, r13d
inc r14d
cmp r14d, dword [rbp + 0x98]
jge 0x14000d04d
jmp 0x14000ce40
mov ecx, 0x80070057
call fcn.140004450
int3
mov r15d, 2
jmp 0x14000d04d
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x60], 0x906
lea rax, str.__GetCurrentKeyboardStatus_
mov qword [rbp - 0x58], rax
lea rax, [0x14002b804]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], r13d
lea rcx, [rbp - 0x68]
jmp 0x14000d03b
mov qword [rbp + 0x10], r12
mov dword [rbp + 0x18], 0x900
lea rax, str.__GetCurrentKeyboardStatus_
mov qword [rbp + 0x20], rax
lea rax, [0x14002b804]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], r13d
lea rcx, [rbp + 0x10]
mov r8d, esi
lea rdx, str.Error_Code:_0x_x
call fcn.1400012a0
mov r15d, esi
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d062
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d07c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d097
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov r8, qword [rsp + 0x40]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x48]
call fcn.1400012a0
mov eax, r15d
jmp 0x14000d0bd
mov ecx, 0x80070057
call fcn.140004450
nop
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret