Function at 0x1800157b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rcx
mov ebp, 1
xor esi, esi
lea r13d, [rbp + 6]
cmp rcx, rsi
je 0x1800159ff
mov rdx, rcx
lea rcx, str.reject
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x1800159ff
and dword [rsp + 0xe8], 0xfffffe00
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rsi
lea rax, [rsp + 0x110]
mov qword [rsp + 0x188], rax
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xd0], rsi
mov word [rsp + 0xc0], si
lea r8d, [rbp + 4]
lea rdx, [0x180069288]
lea rcx, [rsp + 0xb8]
call fcn.18000297c
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.18002b148
mov rbx, rax
lea rdx, str.di_type
lea rcx, [rsp + 0xe0]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rbx
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x1800158cd
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov r12d, 0xf
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], sil
cmp qword [rsp + 0xd8], 8
jb 0x180015903
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
lea rax, [rsp + 0x110]
mov qword [rsp + 0x188], rax
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xd0], rsi
mov word [rsp + 0xc0], si
mov r8d, 0x18
lea rdx, [0x180069298]
lea rcx, [rsp + 0xb8]
call fcn.18000297c
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call fcn.180003fdc
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.18002b148
mov rbx, rax
lea rdx, str.di_overview
lea rcx, [rsp + 0xe0]
call fcn.18002c6ac
mov rcx, rax
mov rdx, rbx
call fcn.18002b3d4
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x1800159a7
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], sil
cmp qword [rsp + 0xd8], 8
jb 0x1800159d7
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
mov r9d, ebp
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, str.t_illegal_device_log
call fcn.18003c260
nop
lea rcx, [rsp + 0xe0]
call fcn.18002b33c
mov r12, rsi
mov rbx, rsi
mov r13, rsi
lea r14, [0x180067fe0]
mov r15, rsi
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0x188], 4
lea rax, [rsp + 0x188]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x190]
lea r8, [0x1800692d0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor edx, edx
cmp eax, edx
jne 0x180015a7b
cmp dword [rsp + 0x190], 4
jne 0x180015a7b
mov eax, dword [rsp + 0x198]
jmp 0x180015a7d
mov eax, edx
cmp eax, edx
je 0x180015aa2
lea r14, [0x1800692f8]
mov esi, ebp
mov ebp, edx
lea r15, str.wfchost.exe
lea rax, str._usbStoreUseRequest
mov qword [rsp + 0xb0], rax
cmp rdi, rdx
je 0x180015b7b
lea rdx, str.reject
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
cmp eax, edx
jne 0x180015aeb
lea r12, [0x180069330]
lea rax, [0x180069340]
lea rbx, [0x1800693b0]
cmp esi, edx
cmovne rbx, rax
lea r13, str.banusb.png
mov rax, rdx
jmp 0x180015b88
lea rdx, str.readonly
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
cmp eax, edx
jne 0x180015b28
lea r12, [0x180069428]
lea rax, [0x180069440]
lea rbx, [0x1800694c0]
cmp esi, edx
cmovne rbx, rax
lea r13, str.readonly.png
mov rax, rdx
jmp 0x180015b88
lea rdx, str.writeonly
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
cmp eax, edx
jne 0x180015b80
lea r12, [0x180069560]
lea rax, [0x180069570]
lea rbx, [0x1800695e0]
cmp esi, edx
cmovne rbx, rax
lea r13, str.usbwo.png
cmp esi, edx
jne 0x180015b85
lea r14, [0x180069660]
lea r15, str.woumgr.exe
lea rax, str.D6C41B57_D9D0_4c55_A8F7_C40B06CAC2BD
jmp 0x180015b88
mov rax, rdx
jmp 0x180015b88
mov rax, rdx
jmp 0x180015b88
mov rax, rdx
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], rdx
mov word [rsp + 0x90], dx
or dword [rsp + 0x78], 0xffffffff
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, r13
mov rdx, rbx
mov rcx, r12
call fcn.18000466c
nop
cmp qword [rsp + 0xa8], 8
jb 0x180015c15
mov rcx, qword [rsp + 0x90]
call fcn.180043070
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret