Function at 0x14000f210
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x10], 0
and dword [rbp + 0x58], 0
mov eax, 0x2001f
xor edi, edi
lea r12d, [rax - 4]
mov esi, edx
and dword [rbp - 0x18], edi
and dword [rbp + 0x48], edi
cmp edx, 3
cmove r12d, eax
lea rax, [rbp - 0x10]
mov ebx, ecx
lea r15, str.SOFTWAREIntelDisplayigfxcuiigfxtray
mov r14d, 4
mov r9d, r12d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, r15
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x1c], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f288
mov rcx, qword [rbp - 0x10]
test rcx, rcx
jne 0x14000f2d3
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x10]
mov rdx, r15
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], r12d
and dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000f554
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000f554
dec ebx
je 0x14000f498
dec ebx
je 0x14000f2ef
dec ebx
jne 0x14000f554
lea edi, [rbx + 1]
jmp 0x14000f54e
cmp esi, 2
jne 0x14000f442
lea rax, [rbp + 0x58]
lea rbx, str.ShowOptimalBalloon
lea r9, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov dword [rbp + 0x58], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000f52b
mov rcx, qword [rbp - 0x10]
cmp eax, esi
jne 0x14000f40a
mov dword [rbp - 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x10]
lea r9d, [rsi - 1]
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f39f
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
lea r9, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r8d, dword [rbp - 0x20]
test eax, eax
cmove r8d, dword [rbp + 0x48]
mov dword [rbp - 0x20], r8d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x10]
mov r9d, r12d
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov r9d, r14d
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [rbp - 0x20]
lea rdx, str.Intel_R__Graphics
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000f54a
movsxd r9, dword [rbp - 0x20]
jmp 0x14000f47f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x10]
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f54a
mov rdx, rbx
jmp 0x14000f504
lea rax, [rbp + 0x50]
lea rdx, str.ShowOptimalBalloon
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.Intel_R__Graphics
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000f54a
movsxd r9, dword [rbp + 0x50]
mov r8d, 1
mov edx, 0x1729
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000f54a
lea rdx, str.ShowGraphicsBalloon
cmp esi, 2
jne 0x14000f530
lea rax, [rbp + 0x58]
lea r9, [rbp - 0x1c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov dword [rbp + 0x58], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000f52b
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x10]
lea r9d, [rsi - 1]
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f54a
lea rdx, str.ShowGraphicsBalloon
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
lea r9, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000f54a
mov edi, dword [rbp + 0x48]
jmp 0x14000f54a
lea rax, [rbp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret