Function at 0x14000b7c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [0x14004f298]
mov rdi, 0xffffffffffffffff
mov ebx, edi
test rax, rax
je 0x14000baee
cmp qword [0x14004f290], 0
je 0x14000baee
mov qword [rsp + 0x198], r15
lea r8, [rsp + 0x44]
xor r15d, r15d
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 3]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
call qword [0x1400335f0]
mov edx, eax
test eax, eax
je 0x14000b877
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x14000bae6
test byte [rcx + 0x1c], 8
je 0x14000bae6
mov rcx, qword [rcx + 0x10]
lea rax, str.GetDisplayTopologyCPanel_GetDisplayConfigBufferSizes_fail
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
call fcn.140019ef0
jmp 0x14000bae6
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000bab8
cmp dword [rsp + 0x44], r15d
je 0x14000bab8
mov ecx, eax
mov qword [rsp + 0x190], rsi
mov eax, 0x48
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14001a9b4
mov ecx, dword [rsp + 0x44]
mov rsi, rax
mov eax, 0x40
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14001a9b4
mov r14, rax
test rsi, rsi
je 0x14000baa1
test rax, rax
je 0x14000ba99
mov eax, dword [rsp + 0x40]
xor edx, edx
mov rcx, rsi
lea r8, [rax + rax*8]
shl r8, 3
call fcn.14001c070
mov r8d, dword [rsp + 0x44]
xor edx, edx
shl r8, 6
mov rcx, r14
call fcn.14001c070
mov rax, qword [0x14004f290]
lea r9, [rsp + 0x44]
mov r8, rsi
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov ecx, 2
call qword [0x1400335f0]
mov edx, eax
test eax, eax
je 0x14000b973
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x14000ba99
test byte [rcx + 0x1c], 8
je 0x14000ba99
mov rcx, qword [rcx + 0x10]
lea rax, str.GetDisplayTopologyCPanel_QueryDisplayConfig_fail
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
call fcn.140019ef0
jmp 0x14000ba99
cmp dword [0x14004798c], 2
mov ebx, 3
jne 0x14000ba65
lea rax, [rsp + 0x48]
mov dword [0x14004798c], r15d
lea r9d, [rbx - 2]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], r15
lea rdx, str.SOFTWAREASUSFactoryConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ba65
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.14001c070
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CPanelDevicePath
mov dword [rsp + 0x54], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ba5a
lea rax, [rsp + 0x60]
nop word [rax + rax]
cmp word [rax + rdi*2 + 2], r15w
lea rdi, [rdi + 1]
jne 0x14000ba20
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x60]
call fcn.14001f88c
lea r8, [rsp + 0x60]
mov edx, 0x80
lea rcx, [0x14004dcb0]
call fcn.14001f62c
mov dword [0x14004798c], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, r15d
cmp dword [rsp + 0x40], r15d
jbe 0x14000ba99
nop
cmp ebx, 3
jne 0x14000ba99
mov eax, edi
lea rcx, [rax + rax*8]
lea rcx, [rcx*8 + 0x14]
add rcx, rsi
call fcn.14000b030
test eax, eax
cmovne ebx, r15d
inc edi
cmp edi, dword [rsp + 0x40]
jb 0x14000ba70
mov rcx, rsi
call fcn.14001a9bc
mov rsi, qword [rsp + 0x190]
test r14, r14
je 0x14000bae6
mov rcx, r14
call fcn.14001a9bc
jmp 0x14000bae6
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x14000bae6
test byte [rcx + 0x1c], 8
je 0x14000bae6
mov rcx, qword [rcx + 0x10]
lea rax, str.GetDisplayTopologyCPanel_uiNumPath__0_uiNumMode__0
mov qword [rsp + 0x20], rax
call fcn.140019c20
mov r15, qword [rsp + 0x198]
mov eax, ebx
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14001a990
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop r14
pop rdi
pop rbp
ret