Function at 0x140002550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x870
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
xor ebx, ebx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002638
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002611
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, str.ApHidServiceSupport
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.ApHidServiceSupport
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002678
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
jmp 0x140002683
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x38]
lea rdx, str.Tobby_:______gdwHidServiceSupport___0x_x
lea rcx, [rsp + 0x60]
mov dword [0x140017990], r8d
call fcn.140003b30
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002760
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002739
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.ApHidServiceLaunchDelayTime
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.ApHidServiceLaunchDelayTime
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400027a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, ebx
jmp 0x1400027ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x140017994], r11d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov edi, 1
je 0x14000287a
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002853
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea r9d, [rdi + 3]
lea rdx, str.ApHidServiceLogonSpec
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.ApHidServiceLogonSpec
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400028ba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, edi
jmp 0x1400028c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
cmp r11d, 2
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
cmova r11d, edi
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
mov dword [0x1400164ac], r11d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002999
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002972
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.ApHidServiceTPDisableMethod
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.ApHidServiceTPDisableMethod
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400029d9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, ebx
jmp 0x1400029e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
mov rcx, qword [0x140017980]
cmp r11d, 2
lea rdx, str.IOCTL_GetPID
cmovae r11d, ebx
mov dword [0x140017964], r11d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x58]
mov qword [0x1400179d0], rax
call rax
mov r8d, dword [rsp + 0x58]
test r8d, r8d
jne 0x140002a3a
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x58]
call qword [0x1400179d0]
mov r8d, dword [rsp + 0x58]
lea rdx, str.Tobby_:______productID___0x_x
lea rcx, [rsp + 0x60]
call fcn.140003b30
mov r11d, dword [rsp + 0x58]
cmp r11d, 0x120c
jne 0x140002ec2
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002b22
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002afb
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.AlpsDeviceType
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.AlpsDeviceType
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002b62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, ebx
jmp 0x140002b6d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x14001799c], r11d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002c39
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c12
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.AlpsHidDeviceVID
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.AlpsHidDeviceVID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002c79
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, ebx
jmp 0x140002c84
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x140017824], r11d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002d50
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002d29
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.AlpsHidDevicePID
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.AlpsHidDevicePID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002d90
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, ebx
jmp 0x140002d9b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x140017820], r11d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002e67
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002e40
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.RestartToPs2Rel
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAlpsPID_120CApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, str.RestartToPs2Rel
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002ead
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1400179a0], ebx
jmp 0x140002f5b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x40]
mov dword [0x1400179a0], ebx
jmp 0x140002f5b
cmp r11d, 0x120d
jne 0x140002f5b
lea r8, str.AlpsDeviceType
lea rdx, str.SoftwareAlpsPID_120DApoint
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.140003b60
lea r8, str.AlpsHidDeviceVID
lea rdx, str.SoftwareAlpsPID_120DApoint
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [0x14001799c], eax
call fcn.140003b60
lea r8, str.AlpsHidDevicePID
lea rdx, str.SoftwareAlpsPID_120DApoint
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [0x140017824], eax
call fcn.140003b60
lea r8, str.RestartToPs2Rel
lea rdx, str.SoftwareAlpsPID_120DApoint
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [0x140017820], eax
call fcn.140003b60
mov dword [0x1400179a0], eax
mov r8d, dword [0x14001799c]
lea rdx, str.Tobby_:______gdwDeviceType___0x_x
lea rcx, [rsp + 0x60]
call fcn.140003b30
mov r8d, dword [0x140017824]
lea rdx, str.Tobby_:______gdwDeviceVid___0x_x
lea rcx, [rsp + 0x60]
call fcn.140003b30
mov r8d, dword [0x140017820]
lea rdx, str.Tobby_:______gdwDevicePid___0x_x
lea rcx, [rsp + 0x60]
call fcn.140003b30
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140003e00
mov rbx, qword [rsp + 0x880]
add rsp, 0x870
pop rdi
ret