Function at 0x14002ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1400cfdf0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f041
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x48], rax
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f04c
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x50], rax
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f057
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x58], rax
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f062
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x60], rax
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f06d
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x68], rax
call fcn.140015220
mov rsi, rax
test rax, rax
je 0x14002f078
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
add rax, 0x18
mov qword [rdi + 0x70], rax
call fcn.140015220
mov r14, rax
test rax, rax
je 0x14002f083
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x78], rbp
lea rcx, [rdi + 0x80]
call fcn.1400294a0
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareIntelDisplayigfxcui
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f016
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002f016
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x4c], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.AGSDevMode
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ef98
cmp dword [rsp + 0x50], 1
jne 0x14002ef98
mov dword [rdi + 0x7c], 1
cmp dword [rdi + 0x7c], 0
je 0x14002f00a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140054000
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x4c], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.AGSDevModePlatform
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002f00a
lea r8, [rsp + 0x60]
lea rdx, [0x14009c5ec]
lea rcx, [rdi + 0x80]
call fcn.140039f50
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14004e4a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
int3