Function at 0x1400103e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x680
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rbp, r8
mov r12, rdx
mov word [rsp + 0x470], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [r11 - 0x226]
call fcn.140057420
xor ebx, ebx
mov word [rsp + 0x70], bx
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x72]
call fcn.140057420
mov dword [rsp + 0x38], 0x100
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x140010517
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001050d
call fcn.14002790c
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x1400104a0
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x140010510
mov rsi, rbx
mov qword [0x1400ae080], rsi
lea rdx, str.USBdevInstID_to_USBPRINTdevInstID__
mov rcx, rsi
call fcn.14000d860
mov r9, r12
lea r8, str.SYSTEMCurrentControlSetEnum_s
mov edx, 0x100
lea rcx, [rsp + 0x70]
call fcn.140052ea0
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x140010600
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400105f6
call fcn.14002790c
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x140010589
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x1400105f9
mov rsi, rbx
mov qword [0x1400ae080], rsi
lea r9, str.ParentIdPrefix
lea r8, [rsp + 0x70]
lea rdx, str.GetStringFromHKLM__s__s
mov rcx, rsi
call fcn.14000d860
mov qword [rsp + 0x30], rbx
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x1400106e1
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400106d7
call fcn.14002790c
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14001066a
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x1400106da
mov rsi, rbx
mov qword [0x1400ae080], rsi
lea r9, str.ParentIdPrefix
lea r8, [rsp + 0x70]
lea rdx, str.GetValueFromHKLM__s__s
mov rcx, rsi
call fcn.14000d860
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140010768
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.ParentIdPrefix
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001077e
call fcn.14000d730
mov rcx, rax
lea r8, str.GetValueFromHKLM__RegOpenKeyEx_failed
mov edx, edi
call fcn.14000daa0
test edi, edi
je 0x140010789
xor eax, eax
jmp 0x140010892
mov dword [rsp + 0x50], 0x20
mov word [rsp + 0x270], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x272]
call fcn.140057420
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140087aa8]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
mov edi, ebx
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140010887
mov qword [rsp + 0x20], rbx
mov r9d, 0x100
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
je 0x140010820
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x270]
call fcn.14000e8f0
test eax, eax
jne 0x140010839
add edi, 1
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140010887
jmp 0x1400107e2
mov word [rbp], 0
lea r8, [rsp + 0x270]
mov edx, 0x100
mov rcx, rbp
call fcn.140052920
call fcn.14000d730
mov rcx, rax
mov r8, r12
lea rdx, str.____USBdevInstID:___s
call fcn.14000d860
call fcn.14000d730
mov rcx, rax
mov r8, rbp
lea rdx, str.____USBPRINTdevInstID:___s
call fcn.14000d860
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, ebx
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret