Function at 0x140001530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x4c], r15d
lea rcx, str.kernel32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1400015ac
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400015ac
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x4c]
call rbx
mov ebx, dword [rsp + 0x4c]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400087b0
lea r8, str.SYSTEMCurrentControlSetServices_
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400113a8
lea r8, str.AsusNumpadPTPParametersAlgoParameters
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400113a8
mov qword [rsp + 0x58], r15
mov eax, 0x20119
mov r9d, 0x20019
test ebx, ebx
cmovne r9d, eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400016e3
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x140001755
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.NUMPAD_04
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140001755
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000174e
mov ecx, eax
call fcn.140006a44
mov rbx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.NUMPAD_04
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400016de
movzx esi, byte [rbx + 3]
shl esi, 8
movzx eax, byte [rbx + 2]
or esi, eax
shl esi, 8
movzx eax, byte [rbx + 1]
or esi, eax
shl esi, 8
movzx eax, byte [rbx]
or esi, eax
call fcn.1400069ec
jmp 0x140001752
call fcn.1400069ec
mov dword [rdi + 0x44], r15d
mov ecx, 0x10
call fcn.140006a08
lea rdx, [0x1400019e0]
mov qword [rax], rdx
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
mov r8d, 0x10
mov rdx, rax
lea rcx, [0x140003bc0]
call qword [sym.imp.api_ms_win_core_threadpool_legacy_l1_1_0.dll_QueueUserWorkItem]
test eax, eax
je 0x14000198e
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140006750
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov esi, dword [rsp + 0x50]
and esi, 1
mov dword [rdi + 0x44], esi
cmp esi, 1
jne 0x1400016e7
call fcn.1400011a0
xor bl, bl
test eax, eax
jne 0x140001783
cmp bl, 0xa
jae 0x140001795
mov ecx, 0x64
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
inc bl
call fcn.1400011a0
test eax, eax
je 0x140001768
cmp eax, 1
jne 0x140001795
mov dword [rdi + 0x100], r15d
mov dword [rdi + 0xac], eax
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx
test eax, eax
js 0x1400019aa
lea rax, [0x140030608]
mov qword [rsp + 0x30], rax
lock inc qword [0x140030608]
mov rcx, qword [0x140030600]
test rcx, rcx
je 0x1400017ed
mov byte [rsp + 0x48], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + 0x30]
test eax, eax
js 0x1400019b2
movzx eax, byte [rsp + 0x48]
lock dec qword [0x140030608]
jmp 0x14000180b
lock dec qword [0x140030608]
lea rax, [0x140004840]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
call fcn.1400046e0
movzx esi, al
lea rax, str.True
lea rdx, str.False
test esi, esi
cmovne rdx, rax
lea rcx, str.AsusPTPService::Get_OS_isRDX___s_n
call fcn.140005650
mov dword [rsp + 0x50], r15d
lea rcx, str.kernel32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x14000186d
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000186d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call rbx
mov qword [rsp + 0x40], r15
mov eax, 0x2011f
mov r9d, 0x2001f
cmp dword [rsp + 0x50], 0
cmovne r9d, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesAsusNumpadPTPParametersAlgoParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400018be
xor r9d, r9d
mov r8d, esi
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140002750
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call sub.api_ms_win_core_com_l1_1_0.dll_CoUninitialize
cmp dword [rdi + 0x48], 0
jne 0x1400016e7
mov qword [rdi + 0x58], r15
mov dword [rdi + 0xac], 1
mov dword [rdi + 0x50], r15d
mov dword [rdi + 0xb0], 1
mov ecx, 0x10
call fcn.140006a08
lea rcx, [0x140003450]
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
mov r8d, 0x10
mov rdx, rax
lea rcx, [0x140003bc0]
call qword [sym.imp.api_ms_win_core_threadpool_legacy_l1_1_0.dll_QueueUserWorkItem]
test eax, eax
je 0x140001972
mov dword [rdi + 0x54], r15d
mov ecx, 0x10
call fcn.140006a08
lea rcx, [0x1400036f0]
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
mov r8d, 0x10
mov rdx, rax
lea rcx, [0x140003bc0]
call qword [sym.imp.api_ms_win_core_threadpool_legacy_l1_1_0.dll_QueueUserWorkItem]
test eax, eax
je 0x1400019ba
mov dword [rdi + 0x48], 1
jmp 0x1400016e7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x4c], eax
lea rdx, [0x14002bf18]
lea rcx, [rsp + 0x4c]
call fcn.14000848c
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x4c], eax
lea rdx, [0x14002bf18]
lea rcx, [rsp + 0x4c]
call fcn.14000848c
nop
mov ecx, eax
call fcn.140005440
nop
mov ecx, eax
call fcn.140005440
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x4c], eax
lea rdx, [0x14002bf18]
lea rcx, [rsp + 0x4c]
call fcn.14000848c
int3