Function at 0x14000da40
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x528]
sub rsp, 0x600
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor r13d, r13d
mov r15d, r13d
mov dword [rbp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
mov r8d, 0x25
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rcx, [rbp + 0xb8]
call fcn.1400078b0
nop
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 7
cmova rdx, qword [rbp + 0xb8]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000db1b
lea rdx, str.Failed_to_open_DISPLAY_reg_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x14000e3bb
mov dword [rbp + 0x2c], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000db95
lea rdx, str.Failed_to_query_DISPLAY_key_info.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x14000e3bb
mov r12d, r13d
cmp dword [rbp + 0x2c], r13d
jbe 0x14000e3af
movabs rbx, 0x7ffffffffffffffe
lea rdi, [0x14001c13c]
lea rsi, str.Device_Parameters
nop word [rax + rax]
mov dword [rbp + 0x70], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x70]
lea r8, [rbp + 0xe0]
mov edx, r12d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000e3a2
mov rax, rbx
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
cmp rax, 1
jb 0x14000e474
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 7
cmova r9, qword [rbp + 0xb8]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x80]
call fcn.140009c50
or r15d, 2
lea rax, [rbp + 0xe0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000dc60
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call fcn.140006920
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
or r15d, 4
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000dcfc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e3ff
call fcn.1400176d4
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova rdx, qword [rbp + 0x98]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e35c
mov dword [rbp + 0x28], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000e351
mov r14d, r13d
cmp dword [rbp + 0x28], r13d
jbe 0x14000e351
mov dword [rbp + 0x30], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x2e0]
mov edx, r14d
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000e344
mov rax, rbx
mov rcx, qword [rbp + 0xa8]
sub rax, rcx
cmp rax, 1
jb 0x14000e492
lea r9, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova r9, qword [rbp + 0x98]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x38]
call fcn.140009c50
nop
lea rax, [rbp + 0x2e0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000de40
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x38]
call fcn.140006920
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm6
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000debd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000deb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e406
call fcn.1400176d4
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rax
mov rax, rbx
movq rcx, xmm6
sub rax, rcx
cmp rax, 0x12
jb 0x14000e48c
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.140009c50
nop
mov rax, rbx
mov rcx, qword [rbp + 0x88]
sub rax, rcx
cmp rax, 0x1a
jb 0x14000e486
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x1a
lea rax, str.ControlDevice_Parameters
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.140009c50
nop
mov rax, rbx
mov rcx, qword [rbp + 0x88]
sub rax, rcx
cmp rax, 0x1a
jb 0x14000e480
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0x1a
lea rax, str.MonitorDevice_Parameters
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.140009c50
or r15d, 0xf8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r13
mov ecx, 0x60
call fcn.140017380
mov rbx, rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
lea rcx, [rax + 0x60]
mov qword [rbp + 0x68], rcx
lea rax, [rbp + 0x58]
mov qword [rbp - 0x60], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
lea rax, [rbp + 0x58]
mov qword [rbp + 0x48], rax
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.1400069a0
add rbx, 0x20
mov qword [rbp + 0x40], rbx
add rdi, 0x20
lea rax, [rbp + 0x10]
cmp rdi, rax
jne 0x14000e010
mov rdx, rbx
mov rcx, rbx
call fcn.140010910
mov qword [rbp + 0x60], rbx
lea r9, [fcn.140003560]
mov edx, 0x20
mov r8d, 3
lea rcx, [rbp - 0x50]
call fcn.1400173bc
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
cmp rbx, rsi
je 0x14000e2df
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 5
jb 0x14000e47a
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000e098
mov r9, qword [rbx]
mov qword [rsp + 0x30], 5
lea rax, [0x14001c5b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.140009c50
or r15d, 1
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000e134
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e12f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e40d
call fcn.1400176d4
test edi, edi
jne 0x14000e2d2
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8d, 4
lea rdx, str.EDID
lea rcx, [rsp + 0x60]
call fcn.1400078b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r13
mov r8d, 4
lea rdx, str.EDID
lea rcx, [rbp + 0x38]
call fcn.1400078b0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
call fcn.14000d330
movzx edi, al
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000e1e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e1dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e414
call fcn.1400176d4
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000e234
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e22f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e41b
call fcn.1400176d4
test dil, dil
je 0x14000e2c8
lea rdx, str.Spoofed_EDID_for:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071d0
mov rdi, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140009900
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000e26f
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.1400085a0
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000e2c8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e2c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e422
call fcn.1400176d4
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x20
cmp rbx, rsi
jne 0x14000e070
lea rcx, [rbp + 0x58]
call fcn.140010610
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000e32c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e429
call fcn.1400176d4
lea rsi, str.Device_Parameters
lea rdi, [0x14001c13c]
movabs rbx, 0x7ffffffffffffffe
inc r14d
cmp r14d, dword [rbp + 0x28]
jb 0x14000dda2
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14000e3a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e39d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e430
call fcn.1400176d4
inc r12d
cmp r12d, dword [rbp + 0x2c]
jb 0x14000dbc0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x14000e43c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e437
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e437
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400176d4
movzx eax, bl
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140017360
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002970
nop
call fcn.140002970
nop
call fcn.140002970
nop
call fcn.140002970
nop
call fcn.140002970
nop
call fcn.140002970
int3