Function at 0x1400ec5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, r8
mov qword [rsp + 0x58], r8
mov r13, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x148], r8
mov qword [rsp + 0xc8], r8
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001ControlClass4D36E968_E325_11CE_BFC1_08002BE10318_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400ed0c4
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov r15d, 8
mov dword [rsp + 0x40], r15d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.140076ef0
nop
mov rsi, qword [rsp + 0x190]
mov rcx, rsi
mov qword [rsp + 0xe0], rcx
mov rbx, qword [rsi]
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0xb8], rbx
cmp rbx, rcx
je 0x1400ed00f
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rax
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x1400ec6ee
mov rsi, qword [rax]
mov dword [rsp + 0x170], r12d
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, str.MatchingDeviceId
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r14d, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x178], xmm1
mov qword [rsp + 0x188], r12
mov edx, dword [rsp + 0x170]
shr rdx, 1
je 0x1400ec760
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x178]
call fcn.14003eb20
nop dword [rax + rax]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, str.MatchingDeviceId
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ed0f8
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x160], r12
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], r12w
mov rdx, qword [rsp + 0x178]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400ec7d4
lea rcx, [rsp + 0x150]
call fcn.140018360
or r15d, 0x10
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x40], r15d
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1400ec857
mov rax, qword [rsp + 0x188]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ec83e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed12c
call fcn.1401a9460
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x188], r12
lea r14, [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp qword [rsp + 0x168], 8
jb 0x1400ec883
mov rsi, qword [rsp + 0x150]
lea r15, [rsi + rax*2]
mov r14, rsi
jmp 0x1400ec897
lea r15, [rsp + 0x150]
lea r15, [r15 + rax*2]
lea rsi, [rsp + 0x150]
cmp rsi, r15
je 0x1400ec8b2
movzx ecx, word [rsi]
call fcn.1401e3910
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ec897
cmp qword [r13 + 0x18], 8
jb 0x1400ec8d2
mov rsi, qword [r13]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x10]
lea r15, [rsi + rcx*2]
mov r14, rsi
jmp 0x1400ec8e7
mov rax, qword [r13 + 0x10]
lea r15, [rax*2]
add r15, r13
mov rsi, r13
mov r14, r13
cmp rsi, r15
je 0x1400ec902
movzx ecx, word [rsi]
call fcn.1401e3910
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ec8e7
mov rdx, qword [rsp + 0x58]
cmp qword [rdx + 0x18], 8
jb 0x1400ec926
mov rsi, qword [rdx]
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax + 0x10]
lea r15, [rsi + rcx*2]
mov r14, rsi
jmp 0x1400ec934
mov rax, qword [rdx + 0x10]
lea r15, [rdx + rax*2]
mov rsi, rdx
mov r14, rdx
cmp rsi, r15
je 0x1400ec94f
movzx ecx, word [rsi]
call fcn.1401e3910
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ec934
lea r11, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
setae r14b
cmovae r11, qword [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp rax, 4
jb 0x1400eca19
add rax, 0xfffffffffffffffd
lea rsi, [r11 + rax*2]
mov rax, r11
lea r15, str.1002
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x1400ec9bb
cmp word [rax], 0x31
je 0x1400ec9b8
cmp rcx, 1
je 0x1400ec9bb
dec rcx
add rax, 2
cmp word [rax], 0x31
jne 0x1400ec9a5
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400eca19
mov r9d, 4
mov rcx, r15
movzx edx, word [rdx]
mov r8d, 0x31
cmp dx, r8w
jb 0x1400eca03
mov r10, rax
sub r10, r15
cmp dx, r8w
ja 0x1400eca03
cmp r9, 1
je 0x1400eca09
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400ec9e5
add rax, 2
jmp 0x1400ec991
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x1400ecadd
lea r11, [rsp + 0x150]
test r14b, r14b
cmovne r11, qword [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp rax, 4
jb 0x1400ecd6d
add rax, 0xfffffffffffffffd
lea rsi, [r11 + rax*2]
mov rax, r11
lea r14, str.1022
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x1400eca7b
cmp word [rax], 0x31
je 0x1400eca78
cmp rcx, 1
je 0x1400eca7b
dec rcx
add rax, 2
cmp word [rax], 0x31
jne 0x1400eca65
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400ecd6d
mov r9d, 4
mov rcx, r14
movzx edx, word [rdx]
mov r8d, 0x31
cmp dx, r8w
jb 0x1400ecac7
mov r10, rax
sub r10, r14
cmp dx, r8w
ja 0x1400ecac7
cmp r9, 1
je 0x1400ecacd
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400ecaa9
add rax, 2
jmp 0x1400eca51
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400ecd6d
mov r12, qword [r13 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 4
jb 0x1400ed132
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x18], 8
jb 0x1400ecb0a
mov r13, qword [rax]
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea r15, [r12 + 4]
mov esi, 7
lea r14, [rsp + 0x78]
cmp r15, rsi
jbe 0x1400ecb77
mov rsi, r15
or rsi, 7
cmp rsi, rcx
jbe 0x1400ecb46
mov rsi, rcx
jmp 0x1400ecb53
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140023c30
mov r14, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rsi
movabs rax, 0x5f005600450044
mov qword [r14], rax
lea rcx, [r14 + 8]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.1401cf850
xor r12d, r12d
mov word [r14 + r15*2], r12w
mov r15d, dword [rsp + 0x44]
or r15d, 0x20
or r15d, 1
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x40], r15d
lea r9, [rsp + 0x78]
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x70], r14
cmp qword [rsp + 0x90], 8
cmovae r9, r14
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
call fcn.14002db00
cmp rax, 0xffffffffffffffff
je 0x1400ecd77
mov rcx, qword [rsp + 0x58]
mov r12, qword [rcx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r12
cmp rax, 4
jb 0x1400ed138
mov r13, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400ecc50
mov r13, qword [rcx]
xor eax, eax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
lea r15, [r12 + 4]
mov esi, 7
lea r14, [rsp + 0x98]
cmp r15, rsi
jbe 0x1400eccc9
mov rsi, r15
or rsi, 7
cmp rsi, rdx
jbe 0x1400ecc92
mov rsi, rdx
jmp 0x1400ecc9f
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140023c30
mov r14, rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], rsi
movabs rax, 0x5f005600450052
mov qword [r14], rax
lea rcx, [r14 + 8]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.1401cf850
xor r12d, r12d
mov word [r14 + r15*2], r12w
mov r15d, dword [rsp + 0x44]
or r15d, 0x42
mov dword [rsp + 0x40], r15d
lea r9, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae r9, qword [rsp + 0x98]
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
call fcn.14002db00
mov r14, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
je 0x1400ecd77
mov sil, 1
jmp 0x1400ecd7a
mov r15d, dword [rsp + 0x44]
mov r14, qword [rsp + 0x78]
xor sil, sil
test r15b, 2
je 0x1400ecdd2
and r15d, 0xfffffffd
mov dword [rsp + 0x40], r15d
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x1400ecdd2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ecdcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed13d
call fcn.1401a9460
nop
test r15b, 1
je 0x1400ece24
and r15d, 0xfffffffe
mov dword [rsp + 0x40], r15d
mov rax, qword [rsp + 0x90]
cmp rax, 8
jb 0x1400ece24
lea rdx, [rax*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400ece1c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed143
mov rcx, r14
call fcn.1401a9460
test sil, sil
je 0x1400ecf4d
mov r8, qword [rsp + 0xd0]
cmp qword [r8 + 0x18], 8
jb 0x1400ece3f
mov r8, qword [r8]
mov byte [rsp + 0x20], 1
lea r9, str.DriverDesc
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140076cf0
or r15d, 4
mov dword [rsp + 0x40], r15d
mov rdx, qword [rsp + 0x168]
cmp rdx, 8
jb 0x1400eceae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ecea9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed149
call fcn.1401a9460
mov qword [rsp + 0x160], r12
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], r12w
mov rcx, qword [rsp + 0x190]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rdi, qword [rcx]
test rdi, rdi
je 0x1400ecf08
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400272a0
mov edx, 0x30
mov rcx, rdi
call fcn.1401a9460
mov rdi, rbx
test rbx, rbx
jne 0x1400ecee2
mov rbx, qword [rsp + 0x68]
mov edx, 0x30
mov rcx, qword [rsp + 0x190]
call fcn.1401a9460
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ecf30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r12
mov rcx, qword [rsp + 0x60]
call fcn.1400272a0
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400272a0
mov rax, rbx
jmp 0x1400ed0a1
mov rax, qword [rsp + 0x168]
cmp rax, 8
jb 0x1400ecf99
lea rdx, [rax*2 + 2]
mov rsi, qword [rsp + 0x150]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400ecf90
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed149
mov rcx, rsi
call fcn.1401a9460
nop
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x190]
mov rcx, qword [rsp + 0xe0]
jmp 0x1400ec6c4
mov rax, qword [rsi + 8]
mov qword [rax], r12
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400ed041
nop
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.1400272a0
mov edx, 0x30
mov rcx, rsi
call fcn.1401a9460
mov rsi, rbx
test rbx, rbx
jne 0x1400ed020
mov edx, 0x30
mov rcx, qword [rsp + 0x190]
call fcn.1401a9460
mov rbx, qword [rsp + 0x68]
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x14022de70]
mov rcx, rbx
call fcn.140018360
nop
test rdi, rdi
je 0x1400ed08d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r13
call fcn.1400272a0
nop
mov rcx, r14
call fcn.1400272a0
mov rax, rbx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401a9440
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140015e70
nop
mov r8, rax
lea r9, str.Unable_to_open_registry_key
mov edx, ebx
lea rcx, [rsp + 0xe8]
call fcn.140045e00
lea rdx, [0x1402b97a8]
lea rcx, [rsp + 0xe8]
call fcn.1401cf69c
nop
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_get_registry_value
mov edx, r14d
lea rcx, [rsp + 0x110]
call fcn.140045e00
lea rdx, [0x1402b97a8]
lea rcx, [rsp + 0x110]
call fcn.1401cf69c
nop
call fcn.1401e37cc
nop
call fcn.1400153e0
nop
call fcn.1400153e0
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3