Function at 0x100066f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x518
mov qword [rsp + 0x4c8], 0xfffffffffffffffe
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x2a8], 0
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x2b8]
call fcn.100069bc0
nop
lea rcx, [rsp + 0x88]
call fcn.100014450
nop
mov rax, qword [rsp + 0x520]
mov r8, qword [rax]
lea rdx, [0x10000d500]
mov ecx, 1
call fcn.100053cc0
lea rcx, [0x10000c938]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x2a8], rax
cmp qword [rsp + 0x2a8], 0
jne 0x100067014
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
jmp 0x10006771a
lea rdx, [0x10000c920]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x100067048
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
jmp 0x10006771a
mov rcx, qword [rsp + 0x520]
call fcn.100013bb0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 8
mov r8d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x1000670a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x1000670cf
mov rax, qword [rsp + 0x520]
mov r8, qword [rax]
lea rdx, [0x10000d490]
mov ecx, 3
call fcn.100053cc0
mov dword [rsp + 0x2b0], 0x65b
jmp 0x10006771a
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x88]
call fcn.100016d00
lea rcx, [rsp + 0x2b8]
call fcn.100069be0
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.10006d190
test eax, eax
jne 0x100067127
mov dword [rsp + 0x2b0], 0x65b
jmp 0x10006771a
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x2a0], 0
mov dword [rsp + 0x50], 0x20
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4d0], eax
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov rcx, rax
call fcn.100064e40
lea r8, [rsp + 0x50]
mov edx, dword [rsp + 0x4d0]
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov ecx, dword [rsp + 0x40]
inc ecx
mov dword [rsp + 0x40], ecx
test eax, eax
je 0x1000676f3
mov qword [rsp + 0x480], 0
mov qword [rsp + 0x478], 0xffffffffffffffff
lea rcx, [rsp + 0x460]
call fcn.100014450
nop
mov dword [rsp + 0x470], 0
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov rcx, rax
call fcn.100064e40
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x100067215
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
jmp 0x10006765f
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov rcx, rax
call fcn.100064e40
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rsp + 0x480], rax
cmp qword [rsp + 0x480], 0xffffffffffffffff
jne 0x10006732b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
mov eax, dword [rsp + 0x2c0]
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x1000672a7
mov eax, dword [rsp + 0x2c0]
and eax, 0xffff
or eax, 0xf0000
or eax, 0x80000000
mov dword [rsp + 0x4d4], eax
jmp 0x1000672ec
cmp dword [rsp + 0x2c0], 0
jg 0x1000672c1
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0x4d8], eax
jmp 0x1000672de
mov eax, dword [rsp + 0x2c0]
and eax, 0xffff
or eax, 0x70000
or eax, 0x80000000
mov dword [rsp + 0x4d8], eax
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x4d4], eax
cmp dword [rsp + 0x4d4], 0x800f0204
je 0x100067319
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d430]
mov ecx, 2
call fcn.100053cc0
jmp 0x10006765f
lea rcx, [rsp + 0x460]
call fcn.1000144b0
jmp 0x10006714d
mov edx, 0x104
lea rcx, [rsp + 0x460]
call fcn.100015c10
mov qword [rsp + 0x468], rax
mov dword [rsp + 0x488], 0x208
lea rax, [rsp + 0x488]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x468]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000caa8]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000673c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
mov edx, 0xffffffff
lea rcx, [rsp + 0x460]
call fcn.100013fd0
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d3d0]
mov ecx, 2
call fcn.100053cc0
jmp 0x10006765f
mov edx, 0xffffffff
lea rcx, [rsp + 0x460]
call fcn.100013fd0
lea rcx, [rsp + 0x460]
call fcn.100013bb0
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.100013e90
test eax, eax
jne 0x100067654
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d350]
mov ecx, 1
call fcn.100053cc0
mov dword [rsp + 0x470], 1
xor r9d, r9d
mov r8d, dword [rsp + 0x64]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x494]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov dword [rsp + 0x48c], eax
cmp dword [rsp + 0x48c], 0xd
je 0x100067576
cmp dword [rsp + 0x48c], 0x25
je 0x100067576
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d2a0]
mov ecx, 1
call fcn.100053cc0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov qword [rsp + 0x478], rax
cmp qword [rsp + 0x478], 0xffffffffffffffff
jne 0x1000674aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
jmp 0x10006765f
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x4b8], rax
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x4a8]
call fcn.100018c00
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x4e8], rax
lea rcx, [rsp + 0x88]
call fcn.100013ee0
mov rdx, rax
mov rcx, qword [rsp + 0x4b8]
call fcn.100018c00
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x4e8]
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rsp + 0x478]
call fcn.100068fb0
mov dword [rsp + 0x2c0], eax
cmp dword [rsp + 0x2c0], 0
je 0x100067571
jmp 0x10006765f
jmp 0x100067654
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d210]
mov ecx, 1
call fcn.100053cc0
mov dword [rsp + 0x498], 0
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov rcx, rax
call fcn.100064e40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0x498]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0xa
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
jne 0x1000675f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
jmp 0x10006765f
mov eax, dword [rsp + 0x498]
or eax, 0x20
mov dword [rsp + 0x498], eax
lea rcx, [rsp + 0x2b8]
call fcn.100053100
mov rcx, rax
call fcn.100064e40
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x498]
mov r8d, 0xa
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
jne 0x100067654
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c0], eax
jmp 0x10006765f
mov dword [rsp + 0x2c0], 0
cmp qword [rsp + 0x478], 0xffffffffffffffff
je 0x100067678
mov rcx, qword [rsp + 0x478]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp qword [rsp + 0x480], 0xffffffffffffffff
je 0x10006769c
cmp qword [rsp + 0x480], 0
je 0x10006769c
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x2c0], 0
je 0x1000676e1
cmp dword [rsp + 0x470], 0
je 0x1000676d6
lea r8, [rsp + 0x2d0]
lea rdx, [0x10000d1b0]
mov ecx, 3
call fcn.100053cc0
mov dword [rsp + 0x80], 1
jmp 0x1000676e1
mov dword [rsp + 0x2a0], 1
lea rcx, [rsp + 0x460]
call fcn.1000144b0
jmp 0x10006714d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x10006770f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
jmp 0x10006771a
mov dword [rsp + 0x2b0], 0
cmp qword [rsp + 0x2a8], 0
je 0x10006773f
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x2a8], 0
cmp dword [rsp + 0x2b0], 0
jne 0x10006778c
cmp dword [rsp + 0x80], 0
je 0x100067771
lea rdx, [0x10000d100]
mov ecx, 3
call fcn.100053cc0
mov dword [rsp + 0x2b0], 0x643
jmp 0x10006778c
cmp dword [rsp + 0x2a0], 0
je 0x10006778c
lea rdx, [0x10000d070]
mov ecx, 2
call fcn.100053cc0
mov eax, dword [rsp + 0x2b0]
mov dword [rsp + 0x4c0], eax
lea rcx, [rsp + 0x88]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x2b8]
call fcn.10007f260
nop
mov rcx, qword [rsp + 0x520]
call fcn.1000144b0
mov eax, dword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x500]
call fcn.100087ed0
add rsp, 0x518
ret