Function at 0x1400667a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x30], 0
mov rdi, rcx
lea rax, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.DisplayConfig
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, rbx
mov rcx, rdi
test eax, eax
jne 0x140066318
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp 0x140066580
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp 0x1400667a0
push rbx
push rbp
push r14
sub rsp, 0xa0
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rcx
mov dword [rsp + 0x30], 4
mov rax, rdx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
lea rdx, str.DisplayConfig
movzx ebx, r8b
xor r14d, r14d
mov rcx, rax
mov dword [rsp + 0x34], r14d
mov r9d, 0xf003f
mov qword [rsp + 0x48], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test bl, bl
je 0x1400665ee
test eax, eax
sete al
jmp 0x14006677b
mov qword [rsp + 0xd0], rsi
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov r9d, 0x157
mov qword [rsp + 0xd8], rdi
lea rdx, str.DisplayConfig::restore
mov ecx, eax
call fcn.140058d30
test eax, eax
jne 0x140066769
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rsi, [rbp + 8]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rdx, str.pathInfoCount
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, 0x15b
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restore
call fcn.140058d30
test eax, eax
jne 0x140066769
mov edi, r14d
cmp dword [rsi], r14d
jbe 0x14006675a
nop dword [rax]
mov r8d, edi
mov qword [rsp + 0x40], r14
lea rdx, str.pathInfo_d
lea rcx, [rsp + 0x50]
call fcn.1400652e0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x163
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restore
call fcn.140058d30
test eax, eax
jne 0x140066769
mov rcx, qword [rsp + 0x40]
mov eax, edi
imul rbx, rax, 0x38
add rbx, rbp
call fcn.1400683b0
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rbx + 0x28], rax
lea rdx, str.targetInfoCount
lea rax, [rsp + 0x30]
mov dword [rbx + 0x40], 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov dword [rbx + 0x18], ecx
call fcn.140067060
mov rcx, qword [rsp + 0x40]
mov qword [rbx + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, dword [rsi]
jb 0x140066680
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14006676b
xor al, al
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0xa0
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rcx
mov rax, rdx
lea rcx, [rsp + 0x38]
xor r15d, r15d
mov qword [rsp + 0x20], rcx
lea rdx, str.ModeInfo2
mov rcx, rax
mov qword [rsp + 0x38], r15
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x17a
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restoreLegacyFormat
call fcn.140058d30
test eax, eax
jne 0x1400669f8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rsi, [r14 + 8]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rsp + 0x40], 4
lea rdx, str.devCount
mov dword [rsp + 0x44], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, 0x17f
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restoreLegacyFormat
call fcn.140058d30
test eax, eax
jne 0x1400669f8
mov edi, r15d
cmp dword [rsi], r15d
jbe 0x1400669e9
lea r12, str.unsupported_mode
nop dword [rax]
mov r8d, edi
mov qword [rsp + 0x50], r15
lea rdx, str.Dev_d
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x187
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restoreLegacyFormat
call fcn.140058d30
test eax, eax
jne 0x1400669f8
mov rbp, qword [rsp + 0x50]
mov eax, edi
mov rcx, rbp
imul rbx, rax, 0x38
add rbx, r14
call fcn.140068720
mov qword [rbx + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x4c], r15d
mov qword [rsp + 0x28], rax
lea rdx, str.dwMode
lea rax, [rsp + 0x30]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, OleCreatePictureIndirect
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::restoreLegacyPath
call fcn.140058d30
test eax, eax
jne 0x1400669d4
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400669c0
sub eax, 1
je 0x1400669c0
cmp eax, 1
je 0x1400669b2
mov dword [rbx + 0x18], 1
call fcn.1400588c0
mov rcx, rax
mov qword [rsp + 0x28], r12
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov dword [rsp + 0x20], 0x1b2
lea r8, str.DisplayConfig::restoreLegacyPath
mov edx, 2
call fcn.140058e40
mov ecx, dword [rbx + 0x18]
jmp 0x1400669c8
mov dword [rbx + 0x18], 2
mov ecx, 2
jmp 0x1400669c8
mov ecx, 1
mov dword [rbx + 0x18], ecx
mov rdx, rbp
call fcn.140067460
mov qword [rbx + 0x20], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, dword [rsi]
jb 0x140066890
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400669fa
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret