Function at 0x1400478f0
Capabilities:
Query or enumerate registry value

Disassembly:
cmp r8d, 0x218
jne 0x1400480a7
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, r9
mov r14, rcx
mov rbx, qword [rbp + 0x7f]
mov qword [rsp + 0x20], r9
mov r9d, r8d
mov r8d, 0x1158
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d___uMsg___d__wParam___d
call fcn.14006dd20
mov rax, r15
sub rax, 6
je 0x140047dd0
sub rax, 1
je 0x140047dd0
sub rax, 0xb
je 0x140047dd0
cmp rax, 0x8001
jne 0x140048085
mov r8d, 0x1192
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d___uMsg__WM_POWERBROADCAST__wParam__PBT_POWERSETTINGCHANGE
call fcn.14006dd20
mov qword [0x140180010], rbx
test rbx, rbx
je 0x140047db2
mov rdx, rbx
lea rcx, [rbp - 0x71]
call fcn.14005ba00
nop
mov rdx, qword [0x140180010]
lea rcx, [rdx + 0x14]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rdx + 0x10]
mov dword [rsp + 0x20], ecx
mov r9, qword [rax]
mov r8d, 0x1199
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID___s__Length___d__Data___d
call fcn.14006dd20
nop
mov rdx, qword [rbp - 0x71]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140047a0f
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
mov rcx, qword [0x140180010]
mov rax, qword [rcx]
cmp rax, qword [0x1400f56a0]
jne 0x140048085
mov rax, qword [rcx + 8]
cmp rax, qword [0x1400f56a8]
jne 0x140048085
mov ebx, dword [rcx + 0x14]
mov r9d, ebx
mov r8d, 0x119e
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__dwConsoleDisplayState___d
call fcn.14006dd20
test ebx, ebx
jne 0x140047b42
cmp dword [0x140180018], ebx
je 0x140047aa9
cmp dword [0x14018025c], 0x9c47
jne 0x140047aa9
mov r8d, 0x11a4
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__disbale_mute_function
call fcn.14006dd20
lea r9d, [rbx + 1]
lea r8, str.DisableKeyboardMute
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.140090400
cmp dword [0x140181f6c], 0
jne 0x140047ae6
call fcn.140004f70
test rax, rax
je 0x140047ad2
cmp dword [rax + 4], 0xa
jne 0x140047ad2
cmp dword [rax + 0xc], 0x5374
jb 0x140047ad2
mov ebx, 1
jmp 0x140047ad4
xor ebx, ebx
mov dword [0x140181f68], ebx
mov dword [0x140181f6c], 1
jmp 0x140047aec
mov ebx, dword [0x140181f68]
test ebx, ebx
je 0x140048085
cmp dword [0x14018025c], 0x9c48
jne 0x140048085
mov r8d, 0x11aa
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__enter_s0i3
call fcn.14006dd20
mov r9d, 1
lea r8, str.s0i3
lea rdx, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rcx, 0xffffffff80000002
call fcn.140090400
jmp 0x140048085
cmp ebx, 1
jne 0x140048085
xor ebx, ebx
cmp dword [0x140180018], ebx
je 0x140047c61
cmp dword [0x14018025c], 0x9c47
jne 0x140047c61
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x31], ebx
mov qword [rbp - 0x29], rbx
mov dword [rbp - 0x69], ebx
lea r9d, [rbx + 1]
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x39]
call fcn.14002b400
test eax, eax
je 0x140047bcd
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140047c61
jmp 0x140047c5b
mov dword [rbp - 0x59], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x55]
xor r8d, r8d
lea rdx, str.DisableKeyboardMute
mov rdi, qword [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140047c53
cmp dword [rbp - 0x55], 4
jne 0x140047c53
mov esi, dword [rbp - 0x69]
test rdi, rdi
je 0x140047c1c
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x140047c61
mov r8d, 0x11b6
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__enable_mute_function
call fcn.14006dd20
call fcn.14000be90
mov rcx, rax
mov edx, 0x430
mov r8d, 0x1f4
call fcn.1400d3e30
jmp 0x140047c61
test rdi, rdi
je 0x140047c61
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [0x140181f6c], 0
jne 0x140047c9c
call fcn.140004f70
test rax, rax
je 0x140047c88
cmp dword [rax + 4], 0xa
jne 0x140047c88
cmp dword [rax + 0xc], 0x5374
mov eax, 1
jae 0x140047c8a
mov eax, ebx
mov dword [0x140181f68], eax
mov dword [0x140181f6c], 1
jmp 0x140047ca2
mov eax, dword [0x140181f68]
test eax, eax
je 0x140048085
cmp dword [0x14018025c], 0x9c48
jne 0x140048085
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], ebx
mov qword [rbp - 0x11], rbx
mov dword [rbp - 0x65], ebx
mov r9d, 1
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x21]
call fcn.14002b400
test eax, eax
je 0x140047d20
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140048085
jmp 0x14004807f
mov dword [rbp - 0x51], 4
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x65]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x4d]
xor r8d, r8d
lea rdx, str.s0i3
mov rbx, qword [rbp - 0x21]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140047dad
cmp dword [rbp - 0x4d], 4
jne 0x140047dad
mov edi, dword [rbp - 0x65]
test rbx, rbx
je 0x140047d6f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140048085
mov r8d, 0x11c1
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_GUID_CONSOLE_DISPLAY_STATE__weak_up_from_s0i3
call fcn.14006dd20
call fcn.14000be90
mov rcx, rax
mov edx, 0x43d
mov r8d, 0x1f4
call fcn.1400d3e30
jmp 0x140048085
jmp 0x140048077
mov r8d, 0x11ca
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_lParam_is_NULL
call fcn.14006dd20
jmp 0x140048085
mov dword [r14 + 0xb4], 1
xor ebx, ebx
mov edi, ebx
lea esi, [rbx + 0x20]
lea rcx, [r14 + 0xb8]
add rcx, rdi
xor r8d, r8d
lea rdx, [0x140103060]
call fcn.1400047f0
add rdi, 8
sub rsi, 1
jne 0x140047de2
call fcn.14001f7e0
test dword [rax + 4], 0x200
je 0x140047e2b
call fcn.14000be90
mov rcx, rax
mov edx, 0x42a
mov r8d, 0x1f4
call fcn.1400d3e30
cmp dword [0x140180018], ebx
je 0x140047f44
cmp dword [0x14018025c], 0x9c47
jne 0x140047f44
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp - 9], rbx
mov dword [rbp - 1], ebx
mov qword [rbp + 7], rbx
mov dword [rbp - 0x61], ebx
mov r9d, 1
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.14002b400
test eax, eax
je 0x140047ead
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140047f44
jmp 0x140047f3e
mov dword [rbp - 0x49], 4
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x45]
xor r8d, r8d
lea rdx, str.DisableKeyboardMute
mov rdi, qword [rbp - 9]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140047f36
cmp dword [rbp - 0x45], 4
jne 0x140047f36
mov esi, dword [rbp - 0x61]
test rdi, rdi
je 0x140047efc
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x140047f44
mov r9, r15
mov r8d, 0x1180
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_RESUME__d___enable_mute_function
call fcn.14006dd20
call fcn.14000be90
mov rcx, rax
mov edx, 0x430
mov r8d, 0x1f4
call fcn.1400d3e30
jmp 0x140047f44
test rdi, rdi
je 0x140047f44
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [0x140181f6c], 0
jne 0x140047f7f
call fcn.140004f70
test rax, rax
je 0x140047f6b
cmp dword [rax + 4], 0xa
jne 0x140047f6b
cmp dword [rax + 0xc], 0x5374
mov eax, 1
jae 0x140047f6d
mov eax, ebx
mov dword [0x140181f68], eax
mov dword [0x140181f6c], 1
jmp 0x140047f85
mov eax, dword [0x140181f68]
test eax, eax
je 0x140048085
cmp dword [0x14018025c], 0x9c48
jne 0x140048085
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0xf], rbx
mov dword [rbp + 0x17], ebx
mov qword [rbp + 0x1f], rbx
mov dword [rbp - 0x5d], ebx
mov r9d, 1
lea r8, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xf]
call fcn.14002b400
test eax, eax
je 0x140048003
lea r9, str.SOFTWARERealtekAudioRtkAudUServiceOthers
mov r8d, eax
lea rdx, str.CRegClient::GetRegUI4Property
lea rcx, str._s_nRet_d_szRegKey_s
call fcn.14006dd20
nop
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140048085
jmp 0x14004807f
mov dword [rbp - 0x41], 4
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x3d]
xor r8d, r8d
lea rdx, str.s0i3
mov rbx, qword [rbp + 0xf]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140048077
cmp dword [rbp - 0x3d], 4
jne 0x140048077
mov edi, dword [rbp - 0x5d]
test rbx, rbx
je 0x140048052
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x140048085
mov r9, r15
mov r8d, 0x118b
lea rdx, str.CCustomizeHP::OnWindowsPowerMessage
lea rcx, str._s__d_RESUME__d___weak_up_from_s0i3
call fcn.14006dd20
jmp 0x140047d90
test rbx, rbx
je 0x140048085
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret