Function at 0x7ff8c49ae932
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, qword [rsp + 0xc8]
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
test rdx, rdx
je 0x7ff8c49ae9bd
mov rdi, r8
test r8, r8
je 0x7ff8c49ae9bd
mov ebp, r9d
mov rbx, rdx
mov rsi, rcx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
mov ecx, r9d
mov edx, 1
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.CFGMGR32.dll_CM_Open_DevNode_Key]
test eax, eax
je 0x7ff8c49ae9e7
mov dword [rsp + 0x20], ebp
lea r9, str.loaderGetDeviceRegistryEntry:_Failed_to_open_registry_key_for_DeviceID__d_
mov rcx, rsi
mov edx, 2
call fcn.7ff8c49a4e82
mov dword [r12], 0xfffffffd
xor edi, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x48]
lea r13, [rsp + 0x44]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x7ff8c49aea31
cmp eax, 2
jne 0x7ff8c49aea5d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebp
lea r9, str.loaderGetDeviceRegistryEntry:_Device_ID__d__Does_not_contain_a_value_for___s_
jmp 0x7ff8c49aea6d
mov edx, dword [rsp + 0x44]
test rsi, rsi
je 0x7ff8c49aea8c
mov rax, qword [rsi + 0x3fd8]
test rax, rax
je 0x7ff8c49aea8c
mov rcx, qword [rsi + 0x3fd0]
mov r8d, 8
mov r9d, 4
call rax
jmp 0x7ff8c49aea94
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebp
lea r9, str.loaderGetDeviceRegistryEntry:_DeviceID__d__Failed_to_obtain__s_size
mov rcx, rsi
mov edx, 1
call fcn.7ff8c49a4e82
xor edi, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7ff8c49ae9c7
mov rcx, rdx
call fcn.7ff8c49f34e8
mov r15, rax
test rax, rax
je 0x7ff8c49aeae5
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x7ff8c49aeb06
mov qword [rsp + 0x20], r14
lea r9, str.loaderGetDeviceRegistryEntry:_DeviceID__d__Failed_to_obtain__s
mov rcx, rsi
mov edx, 8
call fcn.7ff8c49a4e82
mov dword [r12], 0xfffffffd
xor edi, edi
jmp 0x7ff8c49aeb3d
lea r9, str.loaderGetDeviceRegistryEntry:_Failed_to_allocate_space_for_DriverName.
mov rcx, rsi
mov edx, 8
call fcn.7ff8c49a4e82
mov dword [r12], 0xffffffff
jmp 0x7ff8c49aea7a
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x7ff8c49aeb14
cmp eax, 7
jne 0x7ff8c49aeb6c
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, r14
call fcn.7ff8c49aeb7d
mov edi, eax
test rsi, rsi
je 0x7ff8c49aeb5f
mov rax, qword [rsi + 0x3fe8]
test rax, rax
je 0x7ff8c49aeb5f
mov rcx, qword [rsi + 0x3fd0]
mov rdx, r15
call rax
jmp 0x7ff8c49aea7c
mov rcx, r15
call fcn.7ff8c49f29a0
jmp 0x7ff8c49aea7c
mov qword [rsp + 0x20], r14
lea r9, str.loaderGetDeviceRegistryEntry:_Invalid__s_data_type._Expected_REG_SZ_or_REG_MULTI_SZ.
jmp 0x7ff8c49aeacc