Function at 0x14003aed0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov r12, rdx
mov r13, rcx
xor r14d, r14d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 9]
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b1fc
mov dword [rbp + 0x410], 0x100
mov ebx, 1
mov dword [rbp + 0x418], ebx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x410]
lea r8, [rbp - 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14003b1f1
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b1ab
mov dword [rsp + 0x68], 0x200
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b1a0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x60]
call fcn.140041320
mov rdi, rax
cmp qword [r12 + 0x18], 0xf
jbe 0x14003b001
mov r9, qword [r12]
mov r8, r9
add r9, qword [r12 + 0x10]
jmp 0x14003b00c
mov r9, qword [r12 + 0x10]
add r9, r12
mov r8, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov r11, r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
cmp r8, r9
jne 0x14003b040
mov r15d, 7
mov qword [rbp - 0x70], r15
mov word [rsp + 0x78], r14w
lea r10, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
jmp 0x14003b06a
sub r9, r8
mov rdx, r8
lea rcx, [rsp + 0x78]
call fcn.140041c50
lea r10, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rbp - 0x70]
cmp r15, 7
cmova r10, rsi
mov r11, qword [rbp - 0x78]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14003b078
mov rdi, qword [rdi]
cmp r11, rax
ja 0x14003b10d
sub rax, r11
test r11, r11
jne 0x14003b091
mov rbx, r14
jmp 0x14003b114
lea r14, [rax + 1]
lea r14, [rdi + r14*2]
mov rbx, rdi
movzx r9d, word [r10]
mov rax, r14
sub rax, rbx
sar rax, 1
mov ecx, 0
je 0x14003b0cc
cmp word [rbx], r9w
je 0x14003b0c9
cmp rax, 1
je 0x14003b0cc
dec rax
add rbx, 2
cmp word [rbx], r9w
jne 0x14003b0b6
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x14003b10a
mov rdx, r11
mov rcx, r10
test r11, r11
je 0x14003b0f9
mov r8, rbx
sub r8, r10
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14003b104
add rcx, 2
sub rdx, 1
jne 0x14003b0e5
sub rbx, rdi
sar rbx, 1
xor r14d, r14d
jmp 0x14003b114
add rbx, 2
jmp 0x14003b0a0
xor r14d, r14d
mov rbx, 0xffffffffffffffff
cmp r15, 7
jbe 0x14003b150
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b147
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b233
mov rcx, rsi
call fcn.1400ac290
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14003b190
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b18b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b23a
call fcn.1400ac290
cmp rbx, 0xffffffffffffffff
jne 0x14003b241
mov ebx, dword [rbp + 0x418]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x410], 0x100
mov edx, ebx
inc ebx
mov dword [rbp + 0x418], ebx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x410]
lea r8, [rbp - 0x40]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14003af70
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rax, r13
mov rbx, qword [rsp + 0x500]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [rbp + 0x410]
lea rax, [rbp - 0x40]
lea rax, [rax + rdi*2]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x58], r14
cmp rcx, rax
jne 0x14003b292
mov r8, r14
mov ecx, 0xf
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x48], 0
jmp 0x14003b36a
mov qword [rsp + 0x60], 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14003b494
mov ebx, 0xf
cmp rdi, rbx
jbe 0x14003b322
mov rbx, rdi
or rbx, 0xf
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003b311
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b48e
mov rcx, rax
call fcn.1400abf3c
mov rcx, rax
test rax, rax
je 0x14003b47d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rbx
jmp 0x14003b327
call fcn.1400abf3c
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rbx
jmp 0x14003b327
mov rax, qword [rsp + 0x48]
lea r9, [rsp + 0x48]
cmp rbx, 0xf
cmova r9, rax
mov rcx, r9
mov r8, rdi
lea rdx, [rbp - 0x40]
test rdi, rdi
je 0x14003b356
movzx eax, byte [rdx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14003b343
mov qword [rsp + 0x58], rdi
mov byte [r9 + rdi], 0
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov rax, rcx
sub rax, r8
mov esi, 0x4e
cmp rax, rsi
jb 0x14003b403
lea rax, [r8 + 0x4e]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x48]
lea rax, [0x1400d7d8e]
lea r14, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
cmp rax, rbx
jbe 0x14003b3c3
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14003b3c3
cmp rbx, r14
ja 0x14003b3bb
xor edi, edi
jmp 0x14003b3c6
mov rdi, rbx
sub rdi, r14
jmp 0x14003b3c6
mov rdi, rsi
inc r8
lea rcx, [rbx + 0x4e]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub rsi, rdi
lea rdx, [r14 + 0x4e]
add rdx, rdi
lea rcx, [rbx + rdi]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x48]
xor r14d, r14d
jmp 0x14003b415
mov qword [rsp + 0x28], rsi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140042250
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r13 + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14003b215
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac290
jmp 0x14003b215
call fcn.140002480
int3
call fcn.140039e20
int3