Function at 0x14001f264
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x426]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rbp + 0x20]
lea rdx, [0x1400981a8]
xor r9d, r9d
mov qword [r11 - 0x20], rcx
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], 0xf8
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x51e]
lea rdx, str.DevClass
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x521]
mov qword [rsp + 0x28], rcx
lea rdx, str.Features
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x540]
lea rdx, str.TimeStamp
mov r14d, 4
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x544]
mov qword [rsp + 0x28], rcx
lea rdx, str.FTPAuthorizationExpires
mov ebx, 0x104
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x648]
lea rdx, str.OPPAuthorizationExpires
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x74c]
mov qword [rsp + 0x28], rcx
lea rdx, str.BIPAuthorizationExpires
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x850]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BPPAuthorizationExpires
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x954]
mov qword [rsp + 0x28], rcx
lea rdx, str.DoNotAutoConfigure
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rbx, [rdi + 0x529]
lea rdx, str.LinkKey
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x20], sendto
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r12d, r12d
test eax, eax
jne 0x14001f47f
mov dword [rdi + 0x53c], 1
jmp 0x14001f4a4
lea rdx, str.LinkKey
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
mov dword [rdi + 0x53c], r12d
call fcn.14005bab0
lea rax, [rbp + 0x20]
lea rbx, [rdi + 0xb5c]
lea rdx, str.AllowWakeup
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbx], r12d
mov r11d, r12d
setne r11b
lea rax, [rbp + 0x20]
lea rdx, str.HidDisabled
mov dword [rbx], r11d
mov qword [rsp + 0x28], rax
lea rbx, [rdi + 0xb60]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbx], r12d
mov r11d, r12d
lea rax, [rbp + 0x20]
setne r11b
mov qword [rsp + 0x28], rax
lea rdx, str.DefaultAudio
mov dword [rbx], r11d
lea rbx, [rdi + 0xb64]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbx], r12d
setne r12b
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xb68]
mov qword [rsp + 0x28], rcx
lea rdx, str.Manufacturer
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbx], r12d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xb6c]
lea rdx, str.LmpVersion
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xb70]
mov qword [rsp + 0x28], rcx
lea rdx, str.LmpSubVersion
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xb74]
lea rdx, str.BRCMStack
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xb78]
lea rdx, str.Code
mov qword [rsp + 0x28], rcx
mov r12d, 0x208
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xd80]
lea rdx, str.RemoteName
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], 0xf8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe7c]
lea rdx, str.HandsfreeCfg
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe80]
mov qword [rsp + 0x28], rcx
lea rdx, str.ConnectHfIfAvConnected
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xe84]
lea rdx, str.HandsFreeVersion
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe88]
lea rdx, str.PopUpGenForAccessPIM
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe8c]
mov qword [rsp + 0x28], rcx
lea rdx, str.ShowUI
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xe90]
lea rdx, str.DisableCallNumber
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe94]
lea rdx, str.ManualDun
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe98]
mov qword [rsp + 0x28], rcx
lea rdx, str.DesktopShortcutRemovedByBTW
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xe9c]
lea rdx, str.ProgramFilesShortcutRemovedByBTW
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rbp + 0x20]
lea rbx, [rdi + 0xeb4]
lea rdx, str.IconPath
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xea0]
mov qword [rsp + 0x28], rcx
lea rdx, str.PIMSyncInit
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0xea4]
lea rdx, str.PIMAcceptBizcard
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xea8]
lea rdx, str.PIMAcceptCalendarItems
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xeac]
mov qword [rsp + 0x28], rcx
lea rdx, str.PIMAcceptEmailMessages
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x20], r14d
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xeb0]
lea rdx, str.PIMAcceptNotes
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rbp + 0x20]
lea rdx, str.IconPath
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x10bc]
mov qword [rsp + 0x28], rcx
lea rdx, str.AllowHFCalls
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x10c0]
lea rdx, str.VoiceRecognitionEnabled
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x10c4]
lea rdx, str.SupportBroadcomFeatures
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x10c8]
mov qword [rsp + 0x28], rcx
lea rdx, str.BroadcomFeatures
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x10cc]
lea rdx, str.ImageFileOption
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x10d0]
lea rdx, str.ImageSaveFolder
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x20], r12d
lea rax, [rdi + 0x12d8]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rdx, str.ImageOpenCommand
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x14e0]
mov qword [rsp + 0x28], rcx
lea rdx, str.AudioFileOption
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x14e4]
lea rdx, str.AudioSaveFolder
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x16ec]
lea rdx, str.AudioOpenCommand
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x18f4]
mov qword [rsp + 0x28], rcx
lea rdx, str.VideoFileOption
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x18f8]
lea rdx, str.VideoSaveFolder
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x1b00]
lea rdx, str.VideoOpenCommand
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0xe78]
mov qword [rsp + 0x28], rcx
lea rdx, str.ConnectMapAtStartup
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov dword [rbp + 0x20], r14d
lea rax, [rdi + 0x1d08]
lea rdx, str.ConnectHeadset
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x1d0c]
mov qword [rsp + 0x28], rcx
lea rdx, str.NeedSCO
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x1d10]
lea rdx, str.PairedAsHID
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x1d14]
lea rdx, str.HidHost
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x1d18]
mov qword [rsp + 0x28], rcx
lea rdx, str.RASEntryUserName
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x1f20]
lea rdx, str.RASEntryPassword
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x2128]
lea rdx, str.RASEntryPhoneNumber
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x2330]
mov qword [rsp + 0x28], rcx
lea rdx, str.RASEntryModemString
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rbp + 0x20], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x20]
lea rax, [rdi + 0x2538]
mov qword [rsp + 0x28], rcx
mov dword [rbp + 0x20], r14d
mov qword [rsp + 0x20], rax
lea rdx, str.RASEntryRequestResult
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret