Function at 0x1400a46a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xb60
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rsp + 0xb50], rax
xor ebx, ebx
mov r15d, ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0xb0], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x120]
call fcn.1401cff00
mov dword [rsp + 0xd8], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x540]
call fcn.1401cff00
mov dword [rsp + 0xdc], 0x208
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc8], rbx
mov r14d, 7
mov qword [rsp + 0xd0], r14
mov word [rsp + 0xb8], bx
lea r9d, [rbx + 2]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14023d408]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400a4894
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a4810
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a480b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52de
call fcn.1401a9460
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a4871
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a486c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52e4
call fcn.1401a9460
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a52ac
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
mov dword [rsp + 0x100], 0x20
mov r12d, ebx
mov dword [rsp + 0x44], ebx
lea rax, str.Display
mov qword [rsp + 0x50], rax
lea rax, [0x14023c288]
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xb8]
nop dword [rax]
lea r8, [rsp + 0x100]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400a51a9
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x100]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, 1
jne 0x1400a519c
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x750]
call fcn.1401cff00
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x950]
call fcn.1401cff00
lea rax, [rsp + 0x330]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a4970
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x70]
call fcn.140018360
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
setae r11b
mov r10, qword [rsp + 0x70]
cmovae rdx, r10
mov r9, qword [rsp + 0x80]
test r9, r9
je 0x1400a49ea
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdx + rax*2]
cmp word [r8], 0x5c
je 0x1400a49e2
cmp r8, rdx
je 0x1400a49ea
sub r8, 2
cmp word [r8], 0x5c
jne 0x1400a49d2
sub r8, rdx
sar r8, 1
jmp 0x1400a49f1
mov r8, 0xffffffffffffffff
cmp r8, 0xffffffffffffffff
je 0x1400a4a69
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 7
cmp r9, r8
cmovb r8, r9
lea rdx, [rsp + 0x70]
test r11b, r11b
cmovne rdx, r10
lea rcx, [rsp + 0xe0]
call fcn.140018360
or r15d, 1
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x90]
call fcn.1400272a0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xa0], xmm1
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0x750]
call fcn.1400a3d70
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x750]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a4bdf
cmp r14, 8
jb 0x1400a4b02
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a4afa
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52ea
mov rcx, rdi
call fcn.1401a9460
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a4b5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4b56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f0
call fcn.1401a9460
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a4bbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f6
call fcn.1401a9460
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a52ac
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.Class
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a519c
lea rax, [rsp + 0x120]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a4c30
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xb8]
call fcn.140018360
lea r11, [rsp + 0xb8]
mov r14, qword [rsp + 0xd0]
cmp r14, 8
setae r13b
mov rdi, qword [rsp + 0xb8]
cmovae r11, rdi
mov rax, qword [rsp + 0xc8]
cmp rax, 7
jb 0x1400a519c
add rax, 0xfffffffffffffffa
lea rsi, [r11 + rax*2]
mov rax, r11
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, rbx
je 0x1400a4cbb
cmp word [rax], 0x44
je 0x1400a4cb8
cmp rcx, 1
je 0x1400a4cbb
dec rcx
add rax, 2
cmp word [rax], 0x44
jne 0x1400a4ca5
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400a5197
mov r9d, 7
lea rdx, str.Display
movzx ecx, word [rax]
mov r8d, MsiGetPropertyW
cmp cx, r8w
jb 0x1400a4d0d
mov r10, rax
sub r10, qword [rsp + 0x50]
cmp cx, r8w
ja 0x1400a4d0d
cmp r9, 1
je 0x1400a4d16
dec r9
add rdx, 2
movzx ecx, word [r10 + rdx]
movzx r8d, word [rdx]
cmp cx, r8w
jae 0x1400a4cef
add rax, 2
jmp 0x1400a4c91
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400a5197
lea r8, [rsp + 0x330]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0x950]
call fcn.1400a3d70
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x950]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a4e89
test r13b, r13b
je 0x1400a4dac
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a4da4
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52ea
mov rcx, rdi
call fcn.1401a9460
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a4e05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4e00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f0
call fcn.1401a9460
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a4e66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4e61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f6
call fcn.1401a9460
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a52ac
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x540]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.ProviderName
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a5197
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 7
lea rax, [rsp + 0x540]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a4ef3
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0xe0]
call fcn.140018360
lea rsi, [rsp + 0xe0]
mov r14, qword [rsp + 0xf8]
cmp r14, 8
setae r15b
mov r8, qword [rsp + 0xe0]
cmovae rsi, r8
mov rax, qword [rsp + 0xf0]
cmp rax, 0x1c
jb 0x1400a5150
add rax, 0xffffffffffffffe5
lea r12, [rsi + rax*2]
mov rax, rsi
nop dword [rax]
nop dword [rax + rax]
mov rcx, r12
sub rcx, rax
sar rcx, 1
mov rdx, rbx
je 0x1400a4f8a
cmp word [rax], 0x41
je 0x1400a4f87
cmp rcx, 1
je 0x1400a4f8a
dec rcx
add rax, 2
cmp word [rax], 0x41
jne 0x1400a4f74
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400a514b
mov r10d, 0x1c
lea r9, [0x14023c288]
movzx ecx, word [rdx]
mov edx, 0x41
cmp cx, dx
jb 0x1400a4fd8
mov r11, rax
sub r11, qword [rsp + 0x58]
cmp cx, dx
ja 0x1400a4fd8
cmp r10, 1
je 0x1400a4fde
dec r10
add r9, 2
movzx ecx, word [r9 + r11]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400a4fbb
add rax, 2
jmp 0x1400a4f60
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400a514b
test r15b, r15b
je 0x1400a5029
lea rdx, [r14*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400a5020
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52fc
mov rcx, r8
call fcn.1401a9460
nop
test r13b, r13b
je 0x1400a506b
mov rdx, qword [rsp + 0xd0]
lea rdx, [rdx*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a5063
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52ea
mov rcx, rdi
call fcn.1401a9460
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a50c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a50bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f0
call fcn.1401a9460
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a5125
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52f6
call fcn.1401a9460
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
mov eax, 1
jmp 0x1400a52ac
mov r12d, dword [rsp + 0x44]
test r15b, r15b
je 0x1400a518a
lea rdx, [r14*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400a5182
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a52fc
mov rcx, r8
call fcn.1401a9460
mov r15d, dword [rsp + 0x40]
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0x48]
inc r12d
mov dword [rsp + 0x44], r12d
jmp 0x1400a48e0
jmp 0x1400a51c2
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
cmp r14, 8
jb 0x1400a5208
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a51ff
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5302
mov rcx, rdi
call fcn.1401a9460
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a524d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5248
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5308
call fcn.1401a9460
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a52aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a52a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a530e
call fcn.1401a9460
xor eax, eax
mov rcx, qword [rsp + 0xb50]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0xb60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3