Function at 0x10004744c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x100081138]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x88], rdx
mov r15, rcx
mov qword [r11 - 0x418], rcx
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov rsi, r14
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x58]
call fcn.10001e06c
nop
mov r8, qword [r15]
lea rdx, [0x10000fd50]
lea ecx, [r14 + 1]
call fcn.100037e18
lea rcx, [0x10000f3d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
jne 0x1000474ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100047af5
lea rdx, [0x10000f3f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x98], rax
cmp rax, r14
jne 0x100047517
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100047aec
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov rcx, qword [r15]
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
cmp eax, r14d
jne 0x100047ad3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x100047ad3
mov rdx, qword [rsp + 0x70]
cmp rdx, r14
jne 0x100047575
mov ecx, r14d
jmp 0x100047587
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.10001e7fc
mov rbp, qword [rsp + 0x58]
mov r9, rbp
mov r8, qword [r15]
lea rdx, [0x10000fe20]
mov ecx, 1
call fcn.100037e18
lea rcx, [rsp + 0x60]
call fcn.100049c48
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.100044998
cmp eax, r14d
jne 0x1000475e6
mov edi, 0x65b
jmp 0x100047aec
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0xc8], 0x20
mov edi, r14d
lea r8, [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
cmp eax, r14d
je 0x100047ab7
inc edi
mov dword [rsp + 0x6c], edi
or r13, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.10001e06c
nop
mov edi, r14d
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0xc8
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
cmp eax, r14d
jne 0x100047670
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100047a26
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x10004770c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x1000476c5
movzx eax, r12w
or eax, 0x800f0000
xor r14d, r14d
jmp 0x1000476d8
movzx eax, r12w
or eax, 0x80070000
xor r14d, r14d
cmp r12d, r14d
cmovle eax, r12d
cmp eax, 0x800f0204
je 0x1000476fd
lea r8, [rsp + 0xf0]
lea rdx, [0x10000fe60]
mov ecx, 2
call fcn.100037e18
jmp 0x100047a26
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
jmp 0x100047a65
mov rbx, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x100047738
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.10001edf8
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jl 0x100047aac
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [rbx + 0x208], ax
mov dword [rsp + 0x68], 0x208
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000f560]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
cmp eax, r8d
je 0x1000477dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edx, edx
cmp ecx, edx
jl 0x100047a8f
cmp ecx, dword [rbx - 0xc]
jg 0x100047a8f
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], dx
lea r8, [rsp + 0xf0]
lea rdx, [0x10000fec0]
mov ecx, 2
call fcn.100037e18
mov edi, dword [rsp + 0x44]
jmp 0x100047a0e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r8d
jl 0x100047aa1
cmp ecx, dword [rbx - 0xc]
jg 0x100047aa1
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r8w
mov rax, rbp
mov rdx, rbx
sub rdx, rbp
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x10004782b
add rax, 2
test cx, cx
jne 0x100047814
mov eax, r8d
jmp 0x100047830
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r8d
jne 0x1000479f2
lea r9, [rsp + 0xf0]
mov r8, rbx
lea rdx, [0x10000ff20]
mov ebx, 1
mov ecx, ebx
call fcn.100037e18
mov edi, ebx
mov dword [rsp + 0x44], ebx
xor r9d, r9d
mov r8d, dword [rsp + 0xdc]
lea rdx, [rsp + 0xa4]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
je 0x100047959
cmp eax, 0x25
je 0x100047959
lea r8, [rsp + 0xf0]
lea rdx, [0x10000ffb0]
mov ecx, ebx
call fcn.100037e18
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x1000478c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1000479f5
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.10001e134
mov rdi, rax
cmp dword [rbp - 8], ebx
jle 0x100047916
mov edx, dword [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.10001e9a0
mov rbp, qword [rsp + 0x58]
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.10001e134
nop
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, r12
mov r8, rdi
mov rdx, rax
mov rcx, r13
call fcn.100048cd4
mov r12d, eax
xor r8d, r8d
cmp eax, r8d
jne 0x1000479f5
jmp 0x1000479f2
lea r8, [rsp + 0xf0]
lea rdx, [0x100010060]
mov ecx, ebx
call fcn.100037e18
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x30], r12
lea ebx, [r12 + 4]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r12 + 0xa]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, r12d
jne 0x1000479b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100047a0e
or dword [rsp + 0x40], 0x20
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
mov r8d, 0xa
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
xor r8d, r8d
cmp eax, r8d
jne 0x1000479f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100047a0e
mov r12d, r8d
cmp r13, 0xffffffffffffffff
je 0x100047a0a
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edi, dword [rsp + 0x44]
jmp 0x100047a0e
mov edi, dword [rsp + 0x44]
xor eax, eax
cmp r14, rax
je 0x100047a23
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
jmp 0x100047a26
xor r14d, r14d
cmp r12d, r14d
je 0x100047a5b
cmp edi, r14d
je 0x100047a53
lea r8, [rsp + 0xf0]
lea rdx, [0x1000100f0]
mov ecx, 3
call fcn.100037e18
mov dword [rsp + 0x4c], 1
jmp 0x100047a5b
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
lea r8, [rsp + 0xc8]
mov edi, dword [rsp + 0x6c]
mov edx, edi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
cmp eax, r14d
je 0x100047a9a
mov r12, qword [rsp + 0x98]
jmp 0x10004761b
mov ecx, 0x80070057
call fcn.10001f28c
nop
mov rbx, qword [rsp + 0x78]
jmp 0x100047ab7
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov ecx, 0x80070057
call fcn.10001f28c
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x100047ace
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100047aec
mov edi, r14d
jmp 0x100047aec
mov r8, qword [r15]
lea rdx, [0x10000fdb0]
mov ecx, 3
call fcn.100037e18
mov edi, 0x65b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, r14d
jne 0x100047b32
cmp dword [rsp + 0x4c], r14d
je 0x100047b19
lea rdx, [0x100010150]
mov ecx, 3
call fcn.100037e18
mov edi, 0x643
jmp 0x100047b32
cmp dword [rsp + 0x48], r14d
je 0x100047b32
lea rdx, [0x100010200]
mov ecx, 2
call fcn.100037e18
nop
lea rcx, [rsp + 0x58]
call fcn.10001f3ec
nop
cmp rsi, r14
je 0x100047b5d
lock add dword [rsi + 8], 0xffffffff
jne 0x100047b58
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsp + 0x60], r14
mov rcx, r15
call fcn.10001f3ec
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10005cbe0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret