Function at 0x435ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x698
mov qword [rsp + 0x690], rbx
mov qword [rsp + 0x688], rbp
mov qword [rsp + 0x680], rsi
mov qword [rsp + 0x678], rdi
mov qword [rsp + 0x670], r12
mov qword [rsp + 0x668], r13
mov qword [rsp + 0x660], r14
mov qword [rsp + 0x658], r15
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x58], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x4360be
xor r8d, r8d
lea rdx, str.CInstallHDAudioBus_::_ValidateService
lea rcx, [rsp + 0x160]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x60], rdx
lea rdi, [rsp + 0x60]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x160]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x436090
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.004548a0
call fcn.004545a0
test eax, eax
je 0x4360f6
mov r9, r14
mov r8, rbx
lea rdx, str.szServiceName___s__szServiceFileName___s_n
lea rcx, [rsp + 0x160]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x160]
call fcn.004548a0
xor r15d, r15d
mov dword [rsp + 0x34], 0x3e8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rbp, rcx
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.0049b290
mov rdi, rax
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x48]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.0049b804
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43627b
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436270
mov r13d, r15d
cmp dword [rsp + 0x34], r15d
jbe 0x436270
lea r12, [rsp + 0x261]
nop
nop
movzx eax, byte [r12 - 1]
mov byte [rsp + 0x31], al
movzx eax, byte [r14]
mov byte [rsp + 0x30], al
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x31]
call fcn.00497690
test eax, eax
jne 0x436257
mov edi, 1
cmp ebp, edi
jbe 0x436253
lea rbx, [r14 + 1]
mov rsi, r12
nop
nop
movzx eax, byte [rsi]
mov byte [rsp + 0x31], al
movzx eax, byte [rbx]
mov byte [rsp + 0x30], al
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x31]
call fcn.00497690
test eax, eax
jne 0x436253
inc edi
inc rsi
inc rbx
cmp edi, ebp
jb 0x436220
cmp edi, ebp
je 0x43626a
inc r13d
inc r12
cmp r13d, dword [rsp + 0x34]
jb 0x4361e0
jmp 0x436270
mov r15d, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004545a0
test eax, eax
je 0x4362f3
mov r8d, r15d
lea rdx, str.CInstallHDAudioBus_::_ValidateService_:_bRetVal___d_n
lea rcx, [rsp + 0x160]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x60], rdx
lea rdi, [rsp + 0x60]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x160]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4362c4
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
mov eax, r15d
mov rbx, qword [rsp + 0x690]
mov rbp, qword [rsp + 0x688]
mov rsi, qword [rsp + 0x680]
mov rdi, qword [rsp + 0x678]
mov r12, qword [rsp + 0x670]
mov r13, qword [rsp + 0x668]
mov r14, qword [rsp + 0x660]
mov r15, qword [rsp + 0x658]
add rsp, 0x698
ret