Function at 0x14000c720
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14002c868]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.Keyboard_LayoutPreload
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c9f5
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x100
test r12, r12
je 0x14000c9f5
lea esi, [rax + 1]
or r14, 0xffffffffffffffff
nop word [rax + rax]
mov word [rbp - 0x70], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x6e]
call fcn.1400113b0
mov r8d, esi
lea rdx, [0x140025b84]
lea rcx, [rsp + 0x60]
call fcn.1400024e0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c963
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x14000c852
cmp eax, 2
jne 0x14000c963
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000c873
test al, 1
jne 0x14000c963
shr rax, 1
cmp word [rbp + rax*2 - 0x72], 0
jne 0x14000c963
jmp 0x14000c878
mov word [rbp - 0x70], r13w
xor eax, eax
mov rcx, r14
lea rdi, [rbp - 0x70]
repne scasw ax, word [rdi]
not rcx
lea r9, [rcx - 1]
mov r8, qword [rbx + 0x10]
cmp r8, r8
cmp qword [rbx + 0x18], 8
jb 0x14000c89e
mov rcx, qword [rbx]
jmp 0x14000c8a1
mov rcx, rbx
mov rdi, r9
cmp r8, r9
cmovb rdi, r8
lea rdx, [rbp - 0x70]
test rdi, rdi
je 0x14000c8d9
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14000c8cb
add rcx, 2
add rdx, 2
dec rdi
jne 0x14000c8b4
jmp 0x14000c8d9
mov edi, 1
cmp word [rcx], ax
cmovb edi, r14d
jmp 0x14000c8dc
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x14000c8f6
cmp r8, r9
jae 0x14000c8ed
mov eax, r14d
jmp 0x14000c8f6
mov eax, r13d
cmp r8, r9
setne al
test eax, eax
sete al
test al, al
jne 0x14000c92d
cmp qword [rsp + 0x78], 8
jb 0x14000c911
mov rcx, qword [rsp + 0x60]
call fcn.14000e0cc
inc esi
cmp esi, 0xff
jl 0x14000c7d0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c9f5
cmp qword [rsp + 0x78], 8
jb 0x14000c93f
mov rcx, qword [rsp + 0x60]
call fcn.14000e0cc
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000c9f7
cmp qword [rbx + 0x18], 8
jb 0x14000c96d
mov rbx, qword [rbx]
lea rdi, [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
cmp rcx, 8
cmovae rdi, rdx
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
je 0x14000c9c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
cmp rcx, 8
jb 0x14000c9d4
mov rcx, rdx
call fcn.14000e0cc
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000c9f7
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14000e0f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret