Function at 0x140033ed0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r13
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
lea rax, str.c:users_scddocumentsmyworkproject__dynabooksystemdriverdsd_for_tos6208_v6dsd_branch_dev_6.01.0029.xxcentennial_rs5dynabookecoservice_batmgr_batmgrfunc.cpp
mov dword [rbp - 0x80], 0x237
mov qword [rsp + 0x78], rax
lea r8, str.CBatmgrFunc::CheckAuditMode
lea rax, str.__CBatmgrFunc::CheckAuditMode_
mov qword [rsp + 0x70], r8
mov r13, rdx
mov qword [rbp - 0x78], rax
lea rdi, [0x1402a214c]
mov dword [rbp - 0x68], 3
lea rdx, str.ENTER__s
mov qword [rbp - 0x70], rdi
lea rcx, [rsp + 0x78]
call fcn.140008d50
lea rax, vtable.RegConfigAccess.0
xor r12d, r12d
mov qword [rsp + 0x30], rax
mov dword [r13], r12d
mov qword [rsp + 0x38], r12
call fcn.140002c10
mov rcx, rax
test rax, rax
je 0x1400344f1
mov rax, qword [rax]
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1e0], r15
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, str.c:users_scddocumentsmyworkproject__dynabooksystemdriverdsd_for_tos6208_v6dsd_branch_dev_6.01.0029.xxcentennial_rs5_toscommonlib_rs5include_regconfig.h
xorps xmm0, xmm0
lea r15, str.__RegConfigAccess::Open_
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x40], xmm0
lea rbx, [rax + 0x18]
mov qword [rbp + 0x130], rbx
cmp qword [rsp + 0x38], r12
je 0x140033ff2
mov qword [rbp - 0x48], rdi
lea rdx, str.Error_Code:_0x_x
mov edi, 0x80070006
mov qword [rbp - 0x60], rsi
mov r8d, edi
mov dword [rbp - 0x58], 0x61
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x40], r12d
call fcn.140008d50
lea r15, [0x1402a214c]
jmp 0x1400340a9
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupState
mov qword [rbp - 0x38], rsi
lea r8, str.pszSubKey
mov dword [rbp - 0x30], 0x63
lea rdx, str._s___s
mov qword [rbp - 0x28], r15
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x18], 3
call fcn.140008d50
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
je 0x1400340e6
movzx edi, r14w
mov r8d, eax
or edi, 0x80070000
test eax, eax
jle 0x140034070
mov r8d, edi
mov qword [rbp], r15
lea rdx, str.Error_Code:_0x_x
lea r15, [0x1402a214c]
mov qword [rbp - 0x10], rsi
lea rcx, [rbp - 0x10]
mov qword [rbp + 8], r15
mov dword [rbp - 8], 0x67
mov dword [rbp + 0x10], r12d
call fcn.140008d50
test r14d, r14d
cmovle edi, r14d
test edi, edi
jns 0x1400340ed
lea rax, str.c:users_scddocumentsmyworkproject__dynabooksystemdriverdsd_for_tos6208_v6dsd_branch_dev_6.01.0029.xxcentennial_rs5dynabookecoservice_batmgr_batmgrfunc.cpp
mov dword [rbp + 0x20], 0x23f
mov qword [rbp + 0x18], rax
lea rdx, str.Error_Code:_0x_x
lea rax, str.__CBatmgrFunc::CheckAuditMode_
mov qword [rbp + 0x30], r15
mov r8d, edi
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x38], r12d
call fcn.140008d50
jmp 0x14003439d
lea r15, [0x1402a214c]
lea rdi, str.__RegConfigAccess::GetValue_
cmp qword [rsp + 0x38], r12
jne 0x14003412d
mov r8d, 0x80070006
mov qword [rbp + 0x40], rsi
lea rdx, str.Error_Code:_0x_x
mov dword [rbp + 0x48], 0x138
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x60], r12d
call fcn.140008d50
jmp 0x1400342e4
lea r9, str.ImageState
mov qword [rbp + 0x68], rsi
lea r8, str.pszName
mov dword [rbp + 0x70], 0x13a
lea rdx, str._s___s
mov qword [rbp + 0x78], rdi
lea rcx, [rbp + 0x68]
mov qword [rbp + 0x80], r15
mov dword [rbp + 0x88], 3
call fcn.140008d50
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x120]
mov qword [rsp + 0x28], rax
lea rdx, str.ImageState
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov dword [rbp + 0x120], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400341ea
jle 0x1400341a9
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov qword [rbp + 0x90], rsi
lea rdx, str.Error_Code:_0x_x
mov dword [rbp + 0x98], 0x141
lea rcx, [rbp + 0x90]
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], r15
mov dword [rbp + 0xb0], r12d
call fcn.140008d50
jmp 0x1400342e4
mov edx, dword [rbp + 0x120]
lea r8, [rsp + 0x58]
shr rdx, 1
lea rcx, [rsp + 0x58]
xorps xmm0, xmm0
mov qword [rsp + 0x68], r12
inc rdx
movdqu xmmword [rsp + 0x58], xmm0
call fcn.140036e80
mov rcx, qword [rsp + 0x58]
lea rdx, str.ImageState
mov rax, qword [rsp + 0x60]
xor r9d, r9d
sub rax, rcx
xor r8d, r8d
sar rax, 1
add eax, eax
mov dword [rbp + 0x128], eax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140034466
jle 0x140034266
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov qword [rbp + 0xb8], rsi
lea rdx, str.Error_Code:_0x_x
mov dword [rbp + 0xc0], 0x14b
lea rcx, [rbp + 0xb8]
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xd8], r12d
call fcn.140008d50
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400342e4
mov rdx, qword [rsp + 0x68]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x1400342df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400344eb
call fcn.14001dee0
mov rax, qword [rsp + 0x48]
mov r15d, r12d
mov rdx, qword [rsp + 0x40]
sub rax, rdx
sar rax, 1
je 0x140034375
mov r14, r12
nop dword [rax]
movsxd rsi, dword [rbx - 0x10]
movzx r12d, word [r14 + rdx]
lea edi, [rsi + 1]
test edi, edi
js 0x1400344e0
mov eax, dword [rbx - 0xc]
mov ecx, 1
sub ecx, dword [rbx - 8]
sub eax, edi
or ecx, eax
jge 0x14003433a
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.140004670
mov rbx, qword [rbp + 0x130]
mov eax, esi
mov word [rbx + rax*2], r12w
cmp edi, dword [rbx - 0xc]
jg 0x1400344e0
mov dword [rbx - 0x10], edi
xor r12d, r12d
mov word [rbx + rsi*2 + 2], r12w
inc r15d
mov rcx, qword [rsp + 0x48]
add r14, 2
mov rdx, qword [rsp + 0x40]
sub rcx, rdx
movsxd rax, r15d
sar rcx, 1
cmp rax, rcx
jb 0x140034300
lea rdx, str.IMAGE_STATE_COMPLETE
mov rcx, rbx
call fcn.140202474
test eax, eax
je 0x140034390
mov dword [r13], 1
lea rcx, [rsp + 0x30]
call fcn.140005d10
mov edi, r12d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400343ed
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x1400343da
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400344fc
call fcn.14001dee0
xorps xmm0, xmm0
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003440a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, vtable.RegConfigAccess.0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140005d10
mov r8, qword [rsp + 0x70]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x78]
call fcn.140008d50
mov r14, qword [rsp + 0x1e8]
mov eax, edi
mov rsi, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x238]
mov r15, qword [rsp + 0x1e0]
add rsp, 0x1f8
pop r13
pop r12
pop rdi
pop rbp
ret
movzx r9d, byte [rbp + 0x120]
lea rcx, [rsp + 0x40]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
call fcn.140036cd0
mov edx, dword [rbp + 0x128]
lea r8, [rsp + 0x40]
shr rdx, 1
lea rcx, [rsp + 0x40]
call fcn.140036e80
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400342e4
mov rdx, qword [rsp + 0x68]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x1400342df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400344eb
jmp 0x1400342df
mov ecx, 0x80070057
call fcn.140002ad0
int3
call fcn.1401f802c
int3
mov ecx, 0x80004005
call fcn.140002ad0
int3
call fcn.1401f802c
int3