Function at 0x1400ac410
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x14d0
call fcn.1401aa0b0
sub rsp, rax
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rsp + 0x14c0], rax
mov qword [rsp + 0x50], r8
mov r15, rdx
mov qword [rsp + 0x48], rcx
xor r12b, r12b
mov r9d, 2
xor r8d, r8d
xor edx, edx
lea rcx, [0x14023d408]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x1400ac47f
xor al, al
jmp 0x1400ac873
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x88], 0x20
xor esi, esi
mov r13d, esi
lea r14, [rsi - 1]
nop word [rax + rax]
lea r8, [rsp + 0x88]
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400ac83f
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, 1
jne 0x1400ac869
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x2c0]
call fcn.1401cff00
mov dword [rsp + 0x60], esi
lea r8, [rsp + 0xb0]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0x2c0]
call fcn.1400a3d70
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x2c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400ac56f
xor al, al
jmp 0x1400ac873
mov dword [rsp + 0x60], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MatchingDeviceId
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.1002
lea rcx, [rsp + 0xb0]
call fcn.1401d0090
test rax, rax
jne 0x1400ac5dc
lea rdx, str.1022
lea rcx, [rsp + 0xb0]
call fcn.1401d0090
test rax, rax
je 0x1400ac85e
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov edi, 7
mov qword [rsp + 0x80], rdi
mov word [rsp + 0x68], si
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x4c0]
call fcn.1401cff00
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac66f
mov r12b, 1
lea rax, [rsp + 0x4c0]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ac650
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x68]
call fcn.140018360
jmp 0x1400ac6dd
cmp eax, 0xea
jne 0x1400ac6e5
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac6e5
mov r12b, 1
lea rax, [rsp + 0x4c0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ac6c0
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x68]
call fcn.140018360
mov rdi, qword [rsp + 0x80]
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xcc0]
call fcn.1401cff00
lea rax, [rsp + 0x68]
cmp rdi, 8
setae sil
mov rbx, qword [rsp + 0x68]
cmovae rax, rbx
mov rcx, qword [rsp + 0x48]
mov r8, qword [rcx + 0x10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400ac726
mov r9, qword [rcx]
cmp r8, qword [rsp + 0x78]
jne 0x1400ac760
test r8, r8
je 0x1400ac79f
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400ac760
sub r9, rax
cmp cx, dx
ja 0x1400ac760
cmp r8, 1
je 0x1400ac79f
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400ac744
test sil, sil
je 0x1400ac857
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400ac84f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac8a0
jmp 0x1400ac84f
cmp qword [r15 + 0x18], 8
jb 0x1400ac7a9
mov r15, qword [r15]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac804
mov r12b, 1
lea rax, [rsp + 0xcc0]
inc r14
cmp word [rax + r14*2], 0
jne 0x1400ac7e3
mov r8, r14
lea rdx, [rsp + 0xcc0]
mov rcx, qword [rsp + 0x50]
call fcn.140018360
nop
test sil, sil
je 0x1400ac83a
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400ac832
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac8a0
mov rcx, rbx
call fcn.1401a9460
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
movzx eax, r12b
jmp 0x1400ac873
mov rcx, rbx
call fcn.1401a9460
xor esi, esi
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
jmp 0x1400ac4b0
mov rcx, qword [rsp + 0x14c0]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0x14d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1401e37cc
int3