Function at 0x1400aafe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xce0
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rsp + 0xcd0], rax
mov r15, rdx
mov r14, rcx
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x44], ebx
xor al, al
mov byte [rsp + 0x40], al
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor r8d, r8d
lea rdx, [0x14022de70]
lea rcx, [rsp + 0x60]
call fcn.140018360
nop
lea r9d, [rdi + 2]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14023d408]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r12, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400ab0c8
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400ab0b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab0ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abb99
call fcn.1401a9460
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor al, al
jmp 0x1400abb6c
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xa0], 0x20
mov r13d, edi
mov esi, 5
nop
lea r8, [rsp + 0xa0]
mov edx, r13d
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov rcx, r12
test eax, eax
je 0x1400abadc
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, 1
jne 0x1400abad4
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0xad0]
call fcn.1401cff00
mov dword [rsp + 0x58], edi
lea r8, [rsp + 0xc0]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0xad0]
call fcn.1400a3d70
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0xad0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400ab1ff
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400ab1ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab1e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abb9f
call fcn.1401a9460
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor al, al
jmp 0x1400abb6c
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MatchingDeviceId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.1002
lea rcx, [rsp + 0xc0]
call fcn.1401d0090
test rax, rax
jne 0x1400ab26c
lea rdx, str.1022
lea rcx, [rsp + 0xc0]
call fcn.1401d0090
test rax, rax
je 0x1400abac9
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x2d0]
call fcn.1401cff00
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ReleaseVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab2ef
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x2d0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ab2d0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x60]
call fcn.140018360
jmp 0x1400ab35d
cmp eax, 0xea
jne 0x1400ab35d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ReleaseVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab35d
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x2d0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ab340
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x60]
call fcn.140018360
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], di
mov r8, rsi
cmp qword [rsp + 0x70], 5
cmovb r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.140018360
or ebx, 1
mov dword [rsp + 0x44], ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RadeonSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab4a0
lea r9, [rsp + 0x80]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
cmp rsi, 8
cmovae r9, rdi
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab466
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab46c
sub r9, r10
cmp ax, cx
ja 0x1400ab46c
cmp rdx, 1
je 0x1400ab466
dec rdx
add r8, 2
movzx eax, word [r8 + r9]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab447
jmp 0x1400ab46c
cmp rbx, 5
je 0x1400ab486
mov r8d, 9
lea rdx, str.Adrenalin
mov rcx, r14
call fcn.140018360
jmp 0x1400ab587
mov r8d, 9
lea rdx, str.Adrenalin
mov rcx, r15
call fcn.140018360
jmp 0x1400ab587
cmp eax, 0xea
jne 0x1400ab56f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RadeonSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab56f
lea r9, [rsp + 0x80]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
cmp rsi, 8
cmovae r9, rdi
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab466
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab46c
sub r9, r10
cmp ax, cx
ja 0x1400ab46c
cmp rdx, 1
je 0x1400ab466
dec rdx
add r8, 2
movzx eax, word [r8 + r9]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab545
jmp 0x1400ab46c
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x80]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FireproSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab65a
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab620
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab626
sub r9, r10
cmp ax, cx
ja 0x1400ab626
cmp rdx, 1
je 0x1400ab620
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab601
jmp 0x1400ab626
cmp rbx, 5
je 0x1400ab640
mov r8d, 3
lea rdx, [0x140233810]
mov rcx, r14
call fcn.140018360
jmp 0x1400ab730
mov r8d, 3
lea rdx, [0x140233810]
mov rcx, r15
call fcn.140018360
jmp 0x1400ab730
cmp eax, 0xea
jne 0x1400ab730
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FireproSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab730
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab6fe
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab704
sub r9, r10
cmp ax, cx
ja 0x1400ab704
cmp rdx, 1
je 0x1400ab6fe
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab6df
jmp 0x1400ab704
cmp rbx, 5
je 0x1400ab71b
mov r8d, 3
lea rdx, [0x140233810]
mov rcx, r14
call fcn.140018360
jmp 0x1400ab730
mov r8d, 3
lea rdx, [0x140233810]
mov rcx, r15
call fcn.140018360
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CreatorSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab803
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab7c9
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab7cf
sub r9, r10
cmp ax, cx
ja 0x1400ab7cf
cmp rdx, 1
je 0x1400ab7c9
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab7aa
jmp 0x1400ab7cf
cmp rbx, 5
je 0x1400ab7e9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r14
call fcn.140018360
jmp 0x1400ab8d9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r15
call fcn.140018360
jmp 0x1400ab8d9
cmp eax, 0xea
jne 0x1400ab8d9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CreatorSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab8d9
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab8a7
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab8ad
sub r9, r10
cmp ax, cx
ja 0x1400ab8ad
cmp rdx, 1
je 0x1400ab8a7
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab888
jmp 0x1400ab8ad
cmp rbx, 5
je 0x1400ab8c4
mov r8d, 7
lea rdx, str.Creator
mov rcx, r14
call fcn.140018360
jmp 0x1400ab8d9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r15
call fcn.140018360
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CloudSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab9ac
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ab972
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ab978
sub r9, r10
cmp ax, cx
ja 0x1400ab978
cmp rdx, 1
je 0x1400ab972
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ab953
jmp 0x1400ab978
cmp rbx, 5
je 0x1400ab992
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r14
call fcn.140018360
jmp 0x1400aba83
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r15
call fcn.140018360
jmp 0x1400aba83
cmp eax, 0xea
jne 0x1400aba83
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CloudSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400aba83
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400aba50
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400aba56
sub r9, r10
cmp ax, cx
ja 0x1400aba56
cmp rdx, 1
je 0x1400aba50
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400aba31
jmp 0x1400aba56
cmp rbx, 5
je 0x1400aba6d
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r14
call fcn.140018360
jmp 0x1400aba83
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r15
call fcn.140018360
nop
cmp rsi, 8
jb 0x1400ababe
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400abab6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400abba5
mov rcx, rdi
call fcn.1401a9460
mov esi, 5
xor edi, edi
mov ebx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
jmp 0x1400ab0f0
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400abb25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400abb20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400abbab
call fcn.1401a9460
movzx eax, byte [rsp + 0x40]
jmp 0x1400abb6c
mov rcx, qword [rsp + 0xcd0]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0xce0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1401e37cc
int3
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3