Function at 0x140036f00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor edi, edi
cmp dword [0x140079a30], 2
jne 0x1400371f6
xor edx, edx
mov dword [0x140079a30], edi
mov r8d, 0x208
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x60]
call fcn.1400423d0
lea r9, str.SYSTEMCurrentControlSetServicesEllipticVPS
mov edx, 0x104
lea r8, str._sServiceStatus
lea rcx, [rsp + 0x60]
call fcn.14000a160
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400371f6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EnabledInBios
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400371eb
cmp dword [rsp + 0x40], 1
jne 0x1400371eb
mov qword [rsp + 0x2a0], rbx
lea r8, [rsp + 0x44]
mov ebx, 2
mov qword [rsp + 0x2b0], r12
xor r9d, r9d
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x44], ebx
call fcn.140037220
mov r12d, dword [rsp + 0x40]
cmp r12d, ebx
je 0x1400371db
cmp dword [rsp + 0x44], ebx
je 0x1400371db
mov qword [rsp + 0x2a8], rsi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x2b8], r14
mov esi, 1
xor edx, edx
mov dword [0x140079a30], esi
mov qword [rsp + 0x280], r15
mov r14d, ebx
mov qword [rsp + 0x30], rdi
call fcn.140031c50
test eax, eax
je 0x1400370cc
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x4c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastAdaptiveLock
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400370a8
mov r15d, dword [rsp + 0x48]
mov r12d, esi
jmp 0x1400370b0
mov r15d, dword [rsp + 0x50]
mov r12d, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r12d, r12d
mov r12d, dword [rsp + 0x40]
je 0x1400370cc
cmp r15d, ebx
cmovbe r14d, r15d
xor edx, edx
mov dword [0x140079a2c], r14d
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
call fcn.140031c50
test eax, eax
je 0x14003714b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastAdaptiveWake
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14003712c
mov r14d, dword [rsp + 0x4c]
mov r15d, esi
jmp 0x140037134
mov r14d, dword [rsp + 0x50]
mov r15d, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r15d, r15d
je 0x14003714b
cmp r14d, ebx
cmovbe ebx, r14d
mov ecx, dword [0x140079a2c]
cmp ecx, 2
mov r8d, dword [0x140079b5c]
mov edx, dword [0x140079b58]
cmove ecx, r12d
mov r15, qword [rsp + 0x280]
cmp ebx, 2
mov r14, qword [rsp + 0x2b8]
cmove ebx, dword [rsp + 0x44]
mov dword [0x140079a28], ebx
mov dword [0x140079a2c], ecx
cmp r8d, esi
jne 0x140037194
mov eax, esi
test edx, edx
je 0x140037196
mov eax, edi
test eax, eax
cmovne ecx, edi
cmp r8d, esi
jne 0x1400371a4
test edx, edx
je 0x1400371a6
mov esi, edi
test esi, esi
mov rsi, qword [rsp + 0x2a8]
cmovne ebx, edi
cmp ecx, r12d
je 0x1400371c5
mov edx, 0xffffffff
mov r8d, edx
call fcn.1400373d0
cmp ebx, dword [rsp + 0x44]
je 0x1400371db
mov r8d, 0xffffffff
mov edx, ebx
mov ecx, r8d
call fcn.1400373d0
mov rbx, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [0x140079a30], 1
sete dil
mov eax, edi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x288
pop rdi
pop rbp
ret