Function at 0x14003c3c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x49], r15d
mov dword [rbp - 0x11], r15d
mov qword [rbp - 0x21], r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rcx + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14003c469
mov dword [rbp - 1], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x27]
xor r8d, r8d
lea rdx, str.DeviceState
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rbp - 0x11]
mov dword [rdi + 0x70], eax
mov qword [rbp - 0x41], r15
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14003c48e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14003c49f
call fcn.140015450
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14003c79d
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x49], 1
lea r12, str.FxProperties
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop
inc rax
cmp word [r12 + rax*2], 0
jne 0x14003c4d0
mov rdx, qword [rdi + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x41]
call fcn.1400242f0
mov dword [rbp - 0xd], r15d
mov qword [rbp - 0x19], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp - 0x41]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14003c561
mov dword [rbp + 3], 4
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0xd]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2b]
xor r8d, r8d
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rbp - 0x49], r15d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003c57e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r15d
cmp dword [rbp - 0xd], r15d
sete al
mov dword [rdi + 0x6c], eax
mov dword [rdi + 0x78], r15d
mov qword [rbp - 9], r15
mov edx, dword [rdi + 0x68]
lea rcx, [rbp - 9]
call fcn.14003bd50
nop
mov rax, qword [rbp - 9]
cmp dword [rax - 0x10], 0
je 0x14003c748
xor eax, eax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
mov dword [rbp + 0x1f], r15d
mov qword [rbp - 0x39], r15
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14003c5e3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14003c5f4
call fcn.140015450
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14003c7a8
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x49], 2
mov rax, rsi
inc rax
cmp word [r12 + rax*2], 0
jne 0x14003c615
mov rdx, qword [rdi + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x39]
call fcn.1400242f0
mov r8, qword [rbp - 9]
mov rbx, qword [rbp - 0x39]
mov rdx, rbx
call fcn.140020e50
mov r14d, eax
mov dword [rbp - 0x49], r15d
lea rdx, [rbx - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14003c669
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test r14d, r14d
je 0x14003c722
mov qword [rbp - 0x31], r15
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14003c691
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14003c6a2
call fcn.140015450
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14003c792
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x49], 4
mov rax, rsi
inc rax
cmp word [r12 + rax*2], 0
jne 0x14003c6c3
mov rdx, qword [rdi + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x31]
call fcn.1400242f0
lea r9, [rbp + 7]
mov r8, qword [rbp - 9]
mov rbx, qword [rbp - 0x31]
mov rdx, rbx
call fcn.1400202e0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003c714
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 7]
call fcn.1400254d0
mov dword [rdi + 0x78], eax
jmp 0x14003c729
mov dword [rdi + 0x78], 0xfffffffe
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x14003c74f
mov rdx, qword [rbp + 0xf]
mov rcx, rbx
call fcn.140021b70
mov rcx, rbx
call fcn.14016e4d0
jmp 0x14003c74f
mov dword [rdi + 0x78], 0xfffffffe
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14003c76a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400151f0
nop
mov ecx, 0x80004005
call fcn.1400151f0
nop
mov ecx, 0x80004005
call fcn.1400151f0
int3