Function at 0x14000c840
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14004e060]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, r9
mov rsi, r8
mov rax, rdx
mov qword [rbp - 0x19], r8
mov qword [rbp - 0x11], r9
xor r15d, r15d
mov dword [rbp - 5], r15d
mov dword [rbp - 9], r15d
mov dword [rbp - 0x29], r15d
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14000c893
mov rdx, qword [r8]
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14, str.Key_not_found.
mov edx, 0x5c
lea rbx, str.D:WorkMyASUSAbout_AsusOLEDShifterReleaseAsusOLEDShifterAsusOLEDShifterAsusOLEDShifterOLEDShifterManager.cpp
mov rcx, rbx
test eax, eax
je 0x14000c987
cmp eax, 2
jne 0x14000c902
call fcn.14001275c
test rax, rax
je 0x14000c8f5
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
mov edx, 0x25c
mov rcx, r14
jmp 0x14000c96b
mov rax, rbx
mov edx, 0x25c
mov rcx, r14
jmp 0x14000c96b
cmp eax, 5
jne 0x14000c940
call fcn.14001275c
test rax, rax
je 0x14000c92f
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
mov edx, 0x25e
lea rcx, str.Access_is_denied.
jmp 0x14000c96b
mov rax, rbx
mov edx, 0x25e
lea rcx, str.Access_is_denied.
jmp 0x14000c96b
call fcn.14001275c
test rax, rax
je 0x14000c95c
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
jmp 0x14000c95f
mov rax, rbx
mov edx, 0x260
lea rcx, str.Error_opening_key.
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.GetRegistry
mov rcx, rax
call fcn.140005160
jmp 0x14000c9c1
call fcn.14001275c
test rax, rax
je 0x14000c9a3
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
jmp 0x14000c9a6
mov rax, rbx
lea r9, str.Open_Success.
lea r8, str.GetRegistry
mov edx, 0x263
mov rcx, rax
call fcn.1400050b0
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000c9ce
mov r8, qword [rdi]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 5]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000ca02
mov r8, qword [rdi]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 5]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 0x10]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, 0x5c
mov rcx, rbx
test eax, eax
je 0x14000cab3
cmp eax, 2
jne 0x14000ca69
call fcn.14001275c
test rax, rax
je 0x14000ca5f
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
mov edx, 0x26e
jmp 0x14000ca94
mov rax, rbx
mov edx, 0x26e
jmp 0x14000ca94
call fcn.14001275c
test rax, rax
je 0x14000ca85
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
jmp 0x14000ca88
mov rax, rbx
mov edx, 0x271
lea r14, str.Error_read_key.
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.GetRegistry
mov rcx, rax
call fcn.140005160
jmp 0x14000cbeb
call fcn.14001275c
test rax, rax
je 0x14000cacf
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
inc rax
jmp 0x14000cad2
mov rax, rbx
lea r9, str.Read_Success
lea r8, str.GetRegistry
mov edx, 0x275
mov rcx, rax
call fcn.1400050b0
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
test rax, rax
je 0x14000cb12
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
lea r14, [rax + 1]
jmp 0x14000cb15
mov r14, rbx
lea r9, [rbp + 0x29]
mov r8d, dword [rbp - 0x29]
nop dword [rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14000cb20
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x39], r15
mov eax, 7
mov qword [rbp - 0x31], rax
mov word [rbp - 0x49], r15w
lea rcx, [rbp + 0x29]
cmp r9, rcx
je 0x14000cb89
lea r8, [rbp + 0x29]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x49]
call fcn.1400036a0
mov rax, qword [rbp - 0x31]
lea r9, [rbp - 0x49]
cmp rax, 8
cmovae r9, qword [rbp - 0x49]
lea r8, str.GetRegistry
mov edx, 0x276
mov rcx, r14
call fcn.1400050b0
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x14000cbeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cbe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cdab
call fcn.140010990
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14000cc42
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
test rax, rax
je 0x14000cc1c
mov edx, 0x5c
mov rcx, rbx
call fcn.14001275c
lea rbx, [rax + 1]
lea rax, str.Error_close.
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.GetRegistry
mov edx, 0x27e
mov rcx, rbx
call fcn.140005160
mov rax, qword [rsi + 0x18]
cmp dword [rbp - 0x29], 0
je 0x14000cce4
cmp rax, 8
jb 0x14000cc8b
mov rcx, qword [rsi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000cc86
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cd9f
mov rcx, r8
call fcn.140010990
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000ccda
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000ccd5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cda5
mov rcx, r8
call fcn.140010990
mov eax, 1
jmp 0x14000cd6c
cmp rax, 8
jb 0x14000cd1f
mov rcx, qword [rsi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000cd1a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cd9f
mov rcx, r8
call fcn.140010990
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000cd6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000cd65
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cda5
mov rcx, r8
call fcn.140010990
xor eax, eax
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140010720
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14001750c
nop
call fcn.14001750c
nop
call fcn.14001750c
int3