Function at 0x14000a4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalShadowPlayNVSPCAPS
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a5a3
mov qword [rsp + 0x20], rdi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalGeForceExperienceShadowPlay
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a617
mov qword [rsp + 0x20], rdi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalGFExperienceShadowPlay
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a68b
mov qword [rsp + 0x20], rdi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalHighlights
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a6fb
lea r8, str.GlobalNvStreamUserAgent
xor esi, esi
mov ecx, 0x100000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x14000a76a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
jmp 0x14000a76a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalShadowPlayNVSPCAPS
lea r8, str.EnabledApps
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000a4f5
mov sil, 1
cmp dword [rsp + 0x38], 0
jne 0x14000a76a
jmp 0x14000a4f5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalGeForceExperienceShadowPlay
lea r8, str.EnabledApps
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000a51f
mov sil, 1
cmp dword [rsp + 0x38], 0
jne 0x14000a76a
jmp 0x14000a51f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalGFExperienceShadowPlay
lea r8, str.EnabledApps
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000a549
mov sil, 1
cmp dword [rsp + 0x38], 0
jne 0x14000a76a
jmp 0x14000a549
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalHighlights
lea r8, str.EnabledApps
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000a573
mov sil, 1
cmp dword [rsp + 0x38], 0
je 0x14000a573
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret