Function at 0x140002c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rsi, rcx
xor r12d, r12d
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0x208
mov edi, r12d
call fcn.1400087b0
mov r14, qword [rsi + 0x88]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.InputLocale
mov dword [rsp + 0x50], 4
mov rcx, r14
mov dword [rsp + 0x40], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140002cf2
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140002d8a
mov ecx, eax
call fcn.140006a44
mov rbx, rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.InputLocale
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
je 0x140002d79
call fcn.1400069ec
mov rsi, qword [rsi + 0x90]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov rcx, rsi
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov dword [rsp + 0x50], 4
lea rdx, str.InputLocale
mov dword [rsp + 0x40], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140003318
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140002d8a
mov ecx, eax
call fcn.140006a44
mov rbx, rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.InputLocale
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x140002ed8
movzx edi, byte [rbx + 1]
movzx eax, byte [rbx]
shl edi, 8
or edi, eax
call fcn.1400069ec
mov qword [rsp + 0x4f8], r13
lea rcx, str.kernel32
mov qword [rsp + 0x500], r15
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140002dde
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002dde
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call rbx
cmp dword [rsp + 0x50], r12d
lea rdx, str.SYSTEMCurrentControlSetServicesi8042prtParameters
mov eax, 0x20119
mov r15d, 0x20019
mov r9d, r15d
mov rcx, 0xffffffff80000002
cmovne r9d, eax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002ee2
mov r14, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov rcx, r14
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov dword [rsp + 0x58], 1
lea rdx, str.LayerDriver_JPN
mov dword [rsp + 0x40], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140002eb7
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140002eb7
mov ecx, eax
call fcn.140006a44
mov rsi, rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.LayerDriver_JPN
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140002eaf
mov edx, dword [rsp + 0x40]
lea rcx, [rbp - 0x70]
mov r9d, edx
mov r8, rsi
call fcn.14000cf4c
mov rcx, rsi
call fcn.1400069ec
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140002ef3
lea rdx, [rbp - 0x70]
lea rcx, str.AsusPTPService::_Jp_Kb_Layout_is__s_n
call fcn.140005650
jmp 0x140002ef3
call fcn.1400069ec
jmp 0x140003318
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movzx edx, word [0x14002eae4]
lea r13, str.kbd106.dll
movzx ecx, word [0x14002eae6]
xorps xmm0, xmm0
movzx r8d, word [0x14002eae2]
mov rbx, 0xffffffffffffffff
movzx eax, word [0x14002eae8]
mov word [rsp + 0x64], dx
mov word [rsp + 0x68], cx
mov word [rsp + 0x66], dx
lea rdx, [rbp - 0x70]
mov word [rsp + 0x6a], cx
mov rcx, rbx
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov dword [rbp - 0x78], 4
mov word [rsp + 0x60], r8w
mov word [rsp + 0x6c], ax
mov word [rsp + 0x62], r8w
mov word [rsp + 0x6e], ax
movzx eax, word [rdx + rcx*2 + 2]
lea r10, [0x14002eae0]
lea r8, [0x14002ed20]
mov r14d, 0x411
cmp ax, word [r13 + rcx*2 + 2]
jne 0x140002f9e
add rcx, 2
cmp rcx, 0xb
je 0x14000316f
movzx eax, word [rdx + rcx*2]
cmp ax, word [r13 + rcx*2]
je 0x140002f63
mov r8d, r12d
mov r9, r10
movzx eax, word [r9]
cmp edi, eax
je 0x140003239
inc r8d
add r9, 0xa
cmp r8d, 0x39
jb 0x140002fa4
lea rcx, str.kernel32
mov dword [rsp + 0x58], r12d
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140002ffc
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140002ffc
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x58]
call rsi
xor edx, edx
mov qword [rsp + 0x48], r12
mov r8d, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.1400087b0
cmp dword [rsp + 0x58], r12d
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov eax, 0x20119
mov rcx, 0xffffffff80000002
cmovne r15d, eax
lea rax, [rsp + 0x48]
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003105
mov r14, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov rcx, r14
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rdx, str.InstallLanguage
mov dword [rsp + 0x40], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400030ff
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400030eb
mov ecx, eax
call fcn.140006a44
mov rsi, rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLanguage
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400031c8
mov edx, dword [rsp + 0x40]
lea rcx, [rbp + 0x1a0]
mov r9d, edx
mov r8, rsi
call fcn.14000cf4c
mov rcx, rsi
call fcn.1400069ec
xor edx, edx
lea rcx, [rbp + 0x1a0]
lea r8d, [rdx + 0x10]
call fcn.14000d848
mov edi, eax
mov r14d, 0x411
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rdx, [rbp - 0x70]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r13 + rbx*2 + 2]
jne 0x140003147
add rbx, 2
cmp rbx, 0xb
je 0x1400031d5
movzx eax, word [rdx + rbx*2]
cmp ax, word [r13 + rbx*2]
je 0x140003120
lea r8, [0x14002eae0]
mov ecx, r12d
mov rdx, r8
movzx eax, word [rdx]
cmp edi, eax
je 0x140003231
inc ecx
add rdx, 0xa
cmp ecx, 0x39
jb 0x140003154
jmp 0x140003308
cmp edi, r14d
jne 0x140002f9e
mov eax, r12d
mov rcx, r8
nop
cmp word [rcx], r14w
je 0x140003196
inc eax
add rcx, 0xa
cmp eax, 1
jb 0x140003180
jmp 0x140002fbd
cdqe
lea rcx, [rax + rax*4]
movzx eax, word [r8 + rcx*2 + 2]
mov word [rsp + 0x62], ax
movzx eax, word [r8 + rcx*2 + 4]
mov word [rsp + 0x66], ax
movzx eax, word [r8 + rcx*2 + 6]
mov word [rsp + 0x6a], ax
movzx eax, word [r8 + rcx*2 + 8]
jmp 0x140003267
mov rcx, rsi
call fcn.1400069ec
jmp 0x1400030ff
cmp edi, r14d
jne 0x140003147
lea rdx, [0x14002ed20]
mov eax, r12d
mov rcx, rdx
nop dword [rax + rax]
cmp word [rcx], r14w
je 0x140003206
inc eax
add rcx, 0xa
cmp eax, 1
jb 0x1400031f0
jmp 0x140003308
cdqe
lea rcx, [rax + rax*4]
movzx eax, word [rdx + rcx*2 + 2]
mov word [rsp + 0x62], ax
movzx eax, word [rdx + rcx*2 + 4]
mov word [rsp + 0x66], ax
movzx eax, word [rdx + rcx*2 + 6]
mov word [rsp + 0x6a], ax
movzx eax, word [rdx + rcx*2 + 8]
jmp 0x140003267
movsxd rax, ecx
jmp 0x140003198
movsxd rax, r8d
lea rcx, [rax + rax*4]
movzx eax, word [r10 + rcx*2 + 2]
mov word [rsp + 0x62], ax
movzx eax, word [r10 + rcx*2 + 4]
mov word [rsp + 0x66], ax
movzx eax, word [r10 + rcx*2 + 6]
mov word [rsp + 0x6a], ax
movzx eax, word [r10 + rcx*2 + 8]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x40000000
lea rcx, str..AsusTP
mov edx, 0xc0000000
mov word [rsp + 0x6e], ax
mov dword [rsp + 0x58], r12d
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003308
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov r9d, 0x2c
mov edx, 0x2215c4
mov qword [rsp + 0x20], r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
lea rcx, str.Success
mov edx, 0x2215c4
test eax, eax
lea r8, str.Failed
cmovne r8, rcx
lea rcx, str.AsusPTPService:_tSend_Cmd_:_0x_x__Result___s._n
call fcn.140005650
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r13, qword [rsp + 0x4f8]
mov r15, qword [rsp + 0x500]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140006750
mov rbx, qword [rsp + 0x508]
add rsp, 0x4c0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret