Function at 0x14000b7a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
lea rbp, [r11 - 0x9e8]
sub rsp, 0xac8
mov rax, qword [0x140214eb8]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov qword [r11 + 0x10], r12
mov qword [r11 - 0x28], r13
xor r13d, r13d
mov r12d, r8d
mov esi, edx
mov rbx, rcx
cmp qword [rcx], r13
je 0x14000b856
lea rcx, [rbp + 0x1b2]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0x1b0], r13w
call fcn.140152380
lea rdx, str.EPOWER_SERVICE_SET_EPOWER_TRAY_COUNT
lea rcx, [rbp + 0x1b0]
call fcn.140008860
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rsp + 0x78], 7
repne scasw ax, word [rdi]
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.140008390
mov rcx, qword [rbx]
lea rdx, [rsp + 0x60]
call fcn.140012c90
cmp esi, 1
jne 0x14000b89b
lea rcx, [rbp - 0x5e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x60], r13w
call fcn.140152380
lea r8, [rbx + 0x50]
lea r9, str.ePowerEvent.exe
lea rdx, str.__s_s_
lea rcx, [rbp - 0x60]
call fcn.140008830
mov r8, qword [rbx]
lea rcx, [rbp - 0x60]
mov edx, r12d
call fcn.14000ed80
cmp dword [rbx + 0x26c], 0
mov r13, qword [rsp + 0xac0]
mov r12, qword [rsp + 0xaf8]
jne 0x14000bafc
lea rdx, [0x1401ccb68]
lea rcx, [rsp + 0x50]
mov r8d, 1
call fcn.140001060
cmp dword [rsp + 0x58], 1
jne 0x14000b9cf
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, str.EnhanceFlag
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b9cf
cmp dword [rsp + 0x30], 1
jne 0x14000b9cf
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerGetActiveScheme]
mov edx, dword [rbx + 0x25c]
lea r9, [0x1401ccdb0]
mov dword [rsp + 0x20], edx
mov rdx, qword [rsp + 0x30]
lea r8, str.Q2ST
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerWriteACValueIndex]
mov edx, dword [rbx + 0x260]
lea r9, [0x1401ccda0]
mov dword [rsp + 0x20], edx
mov rdx, qword [rsp + 0x30]
lea r8, str.Q2ST
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerWriteACValueIndex]
mov edx, dword [rbx + 0x264]
lea r9, [0x1401ccdb0]
mov dword [rsp + 0x20], edx
mov rdx, qword [rsp + 0x30]
lea r8, str.Q2ST
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerWriteDCValueIndex]
mov edx, dword [rbx + 0x268]
lea r9, [0x1401ccda0]
mov dword [rsp + 0x20], edx
mov rdx, qword [rsp + 0x30]
lea r8, str.Q2ST
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerWriteDCValueIndex]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_PowerSetActiveScheme]
cmp dword [rbx + 0x258], 0
jne 0x14000bae6
cmp esi, 1
jne 0x14000bae6
lea rdx, [0x1401ccb68]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.140001060
mov dword [rsp + 0x30], 0x10
lea rdi, str._Be8
cmp dword [rsp + 0x40], esi
jne 0x14000ba69
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.DefaultPowerSchemeAC
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000ba69
cmp dword [rsp + 0x40], esi
jne 0x14000ba69
mov rcx, qword [rsp + 0x38]
lea r9d, [rsi + 2]
lea rdx, str.DefaultPowerSchemeAC
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rsp + 0x40], 1
mov dword [rsp + 0x30], 0x10
jne 0x14000bad6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.DefaultPowerSchemeDC
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000bad6
cmp dword [rsp + 0x40], 1
jne 0x14000bad6
mov rcx, qword [rsp + 0x38]
lea rdx, str.DefaultPowerSchemeDC
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000bae6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
add dword [rbx + 0x258], esi
test rcx, rcx
je 0x14000bafc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.14014e4d0
add rsp, 0xac8
pop rdi
pop rsi
pop rbx
pop rbp
ret