Function at 0x100003a40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1108
call fcn.100007a20
sub rsp, rax
mov rax, qword [0x10000a348]
mov qword [rsp + 0x10d0], rax
mov qword [rsp + 0x1100], rbp
mov qword [rsp + 0x10f8], rsi
mov rsi, rcx
mov qword [rsp + 0x10e8], r12
mov rbp, rdx
mov r12, r8
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x248
mov qword [rsp + 0x10e0], r13
xor r13d, r13d
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], 0x248
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x100003ae8
or dword [rsp + 0x58], 0x4000800
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
je 0x100003b15
lea r8d, [r13 + 1]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
jne 0x100003aef
xor eax, eax
jmp 0x100003cd7
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
test eax, eax
setne r13b
mov eax, r13d
jmp 0x100003cd7
and dword [rsp + 0x58], 0xfbfff7ff
xor r9d, r9d
mov rdx, rbp
lea r8d, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0x10f0], rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x100003b61
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100003ccf
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000015d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8c]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100003eb4
cmp dword [rsp + 0x40], 1
jne 0x100003eb4
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000015b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d0]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100003eb4
cmp dword [rsp + 0x40], 1
jne 0x100003eb4
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x100001598]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xed0]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100003eb4
cmp dword [rsp + 0x40], 1
jne 0x100003eb4
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x100001580]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcd0]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x1128], rbx
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100003cc5
cmp dword [rsp + 0x40], 1
jne 0x100003cc5
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x30], r13
lea r8d, [rbx + 0xb]
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
jne 0x100003d0c
xor eax, eax
mov rbx, qword [rsp + 0x1128]
mov rdi, qword [rsp + 0x10f0]
mov r13, qword [rsp + 0x10e0]
mov r12, qword [rsp + 0x10e8]
mov rsi, qword [rsp + 0x10f8]
mov rbp, qword [rsp + 0x1100]
mov rcx, qword [rsp + 0x10d0]
call fcn.1000079f0
add rsp, 0x1108
ret
bts dword [rsp + 0x54], 0x10
bts dword [rsp + 0x58], 0xb
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
je 0x100003cc5
mov r8d, 1
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
je 0x100003cc5
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
lea r8d, [r9 + 1]
mov ebx, r13d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
test eax, eax
je 0x100003e8c
lea rdi, [r12 + 0x210]
nop
lea r8, [rsp + 0xad0]
mov rax, rdi
sub r8, rdi
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x100003d94
add rax, 2
test ecx, ecx
jne 0x100003d80
test edx, edx
jne 0x100003e68
lea rax, [r12 + 0x410]
lea r8, [rsp + 0x8d0]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x100003dc4
add rax, 2
test ecx, ecx
jne 0x100003db0
test edx, edx
jne 0x100003e68
lea r9, [rsp + 0x2a0]
mov r8, r12
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x2a0], 0x630
mov dword [rsp + 0x20], 0x630
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailW]
test eax, eax
jne 0x100003e0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100003e68
lea rax, [rsp + 0x2c0]
lea r8, [rsp + 0xed0]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x100003e34
add rax, 2
test ecx, ecx
jne 0x100003e20
test edx, edx
jne 0x100003e68
lea rax, [rsp + 0x6c8]
lea r8, [rsp + 0xcd0]
sub r8, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x100003e64
add rax, 2
test ecx, ecx
jne 0x100003e50
test edx, edx
je 0x100003ea6
inc ebx
mov r8d, 1
mov rdx, rbp
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x20], r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
test eax, eax
jne 0x100003d70
mov r8d, 1
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
mov eax, r13d
jmp 0x100003cc7
mov r13d, 1
mov eax, r13d
jmp 0x100003cc7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100003ccf