Function at 0x140017570
Capabilities:
Query or enumerate registry value
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov qword [rsp + 0x40], rcx
xor r12d, r12d
lea rcx, [rbp + 0x1e2]
xor edx, edx
mov r8d, 0x7fe
mov r13d, r12d
mov word [rbp + 0x1e0], r12w
call fcn.140018fb0
lea rcx, [rsp + 0x60]
mov ebx, r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x68], rbx
call fcn.14000e330
lea r8, str.SOFTWAREIntelIGFXDPP_
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], r12d
mov qword [rbp - 0x80], r12
call fcn.140006000
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x1400177b3
lea rax, [rsp + 0x58]
lea r9, [rbp - 0x70]
lea rdx, str.NumApps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, r12d
cmp dword [rsp + 0x34], ebx
jbe 0x14001779d
movabs r15, 0x555555555555554
nop word [rax + rax]
lea rcx, [rbp - 0x2e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x30], r12w
call fcn.140018fb0
inc r14d
lea r8, str.ApplicationName_d
lea rcx, [rbp + 0x1e0]
mov r9d, r14d
mov edx, 0x400
call fcn.14001ab04
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x1e0]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017707
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x140017707
cmp dword [rsp + 0x38], r12d
jne 0x140017707
movzx eax, r12w
mov word [rbp - 0x30], ax
jmp 0x14001770b
movzx eax, word [rbp - 0x30]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
test ax, ax
jne 0x140017726
mov r8, r12
jmp 0x14001773a
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x140017730
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000e960
mov r8, qword [rdi + 8]
lea r9, [rbp - 0x50]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.14000aca0
mov rcx, rax
mov rax, r15
sub rax, rbx
cmp rax, 1
jb 0x140017e80
mov qword [rdi + 8], rcx
mov rax, qword [rcx + 8]
inc rbx
mov qword [rax], rcx
cmp qword [rbp - 0x38], 8
mov qword [rsp + 0x68], rbx
jb 0x140017792
mov rcx, qword [rbp - 0x50]
call fcn.1400184e0
cmp r14d, dword [rsp + 0x34]
jb 0x140017680
test rsi, rsi
je 0x1400177b3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x70], r12
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140017de9
nop
mov ecx, 0x18
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x1400177f7
lea rcx, str.SELECT__FROM_Win32_ProcessStartTrace_where_ProcessName
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400177fa
jmp 0x140017e75
mov rdi, r12
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x140017f53
cmp qword [rbx + 0x28], 8
lea r15, [rbx + 0x10]
jb 0x140017818
mov r14, qword [r15]
jmp 0x14001781b
mov r14, r15
mov ecx, 0x18
call fcn.140019350
mov rsi, rax
test rax, rax
je 0x140017853
mov rcx, r14
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140017856
test r14, r14
je 0x140017856
jmp 0x140017e8d
mov rsi, r12
mov qword [rbp - 0x60], rsi
test rsi, rsi
je 0x140017f48
mov ecx, 0x18
call fcn.140019350
test rax, rax
je 0x140017f3d
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000b4c0
mov r14, rax
test rax, rax
je 0x140017f3d
lock dec dword [rdi + 0x10]
jne 0x1400178c4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400178aa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400178bc
call fcn.1400185e8
mov qword [rdi + 8], r12
mov rcx, rdi
call fcn.1400184e0
mov qword [rsp + 0x48], r14
lock dec dword [rsi + 0x10]
jne 0x1400178fa
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400178e0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400178f2
call fcn.1400185e8
mov qword [rsi + 8], r12
mov rcx, rsi
call fcn.1400184e0
mov ecx, 0x18
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x140017931
lea rcx, [0x140035bd4]
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017934
jmp 0x140017e98
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x140017f32
mov ecx, 0x18
call fcn.140019350
test rax, rax
je 0x140017f27
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000b4c0
mov r12, rax
test rax, rax
je 0x140017f27
lock dec dword [r14 + 0x10]
jne 0x1400179ab
mov rcx, qword [r14]
test rcx, rcx
je 0x14001798d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400179a3
call fcn.1400185e8
mov qword [r14 + 8], 0
mov rcx, r14
call fcn.1400184e0
lock dec dword [rdi + 0x10]
jne 0x1400179e4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400179c6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400179dc
call fcn.1400185e8
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184e0
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + 0x18]
test rsi, rsi
je 0x140017d91
mov r14, qword [r12]
mov ecx, 0x18
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x140017f1c
lea rcx, [0x140035bd8]
xor r13d, r13d
mov dword [rax + 0x10], 1
mov qword [rax + 8], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov qword [rdi], rax
test rax, rax
je 0x140017f11
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov r8, r14
mov qword [rsp + 0x20], r13
call qword [rax + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x140017a97
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017a79
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017a8f
call fcn.1400185e8
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184e0
test r13d, r13d
js 0x140017d91
mov ecx, 0x18
call fcn.140019350
xor r13d, r13d
mov rsi, rax
test rax, rax
je 0x140017ada
lea rcx, [0x140035be0]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140017add
jmp 0x140017ea3
mov rsi, r13
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x140017f06
cmp qword [r15 + 0x18], 8
jb 0x140017af5
mov r15, qword [r15]
mov ecx, 0x18
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x140017b2d
mov rcx, r15
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017b30
test r15, r15
je 0x140017b30
jmp 0x140017eae
mov rdi, r13
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x140017efb
mov ecx, 0x18
call fcn.140019350
test rax, rax
je 0x140017ef0
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000b4c0
mov r14, rax
test rax, rax
je 0x140017ef0
lock dec dword [rsi + 0x10]
jne 0x140017b9e
mov rcx, qword [rsi]
test rcx, rcx
je 0x140017b84
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140017b96
call fcn.1400185e8
mov qword [rsi + 8], r13
mov rcx, rsi
call fcn.1400184e0
mov qword [rsp + 0x50], r14
lock dec dword [rdi + 0x10]
jne 0x140017bd4
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017bba
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017bcc
call fcn.1400185e8
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.1400184e0
mov ecx, 0x18
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x140017c0b
lea rcx, [0x140035bd4]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017c0e
jmp 0x140017eb9
mov rdi, r13
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140017ee5
mov ecx, 0x18
call fcn.140019350
test rax, rax
je 0x140017eda
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000b4c0
mov rsi, rax
test rax, rax
je 0x140017eda
lock dec dword [r14 + 0x10]
jne 0x140017c7d
mov rcx, qword [r14]
test rcx, rcx
je 0x140017c63
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140017c75
call fcn.1400185e8
mov qword [r14 + 8], r13
mov rcx, r14
call fcn.1400184e0
lock dec dword [rdi + 0x10]
jne 0x140017cae
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017c94
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017ca6
call fcn.1400185e8
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.1400184e0
mov r13, qword [rsp + 0x40]
mov r15, qword [rsi]
mov ecx, 0x18
mov r14, qword [r13 + 0x18]
call fcn.140019350
mov rdi, rax
test rax, rax
je 0x140017ecf
lea rcx, [0x140035bd8]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140017ec4
mov r10, qword [r14]
xor r9d, r9d
mov r8, r15
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
call qword [r10 + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x140017d58
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017d3a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017d50
call fcn.1400185e8
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184e0
lock dec dword [rsi + 0x10]
jne 0x140017d91
mov rcx, qword [rsi]
test rcx, rcx
je 0x140017d73
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140017d89
call fcn.1400185e8
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.1400184e0
lock dec dword [r12 + 0x10]
jne 0x140017dd0
mov rcx, qword [r12]
test rcx, rcx
je 0x140017db0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140017dc8
call fcn.1400185e8
mov qword [r12 + 8], 0
mov rcx, r12
call fcn.1400184e0
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x60]
xor r12d, r12d
cmp rbx, rdi
jne 0x1400177c0
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x140017df7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rbx, rdi
je 0x140017e3a
cmp qword [rbx + 0x28], 8
mov rsi, qword [rbx]
jb 0x140017e19
mov rcx, qword [rbx + 0x10]
call fcn.1400184e0
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r12
mov rcx, rbx
mov word [rbx + 0x10], r12w
call fcn.1400184e0
mov rbx, rsi
cmp rsi, rdi
jne 0x140017e06
mov rcx, rdi
call fcn.1400184e0
mov eax, r13d
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.140018f80
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400181f0
int3
lea rcx, str.list_T__too_long
call fcn.14002efe4
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3
mov ecx, 0x8007000e
call fcn.1400181f0
int3