Function at 0x100003310
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x10e0
call fcn.100007f50
sub rsp, rax
mov rax, qword [0x10000a100]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov r12, rcx
mov r14, r8
mov r13, rdx
mov ebx, 0x248
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rbx
xor edi, edi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x50], ebx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
cmp eax, edi
je 0x1000036fb
or dword [rsp + 0x58], 0x4000800
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
lea esi, [rdi + 1]
mov rdx, r13
cmp eax, edi
mov rcx, r12
mov r8d, esi
je 0x1000033d1
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
cmp eax, edi
je 0x1000036fb
xor r9d, r9d
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
setne dil
mov eax, edi
jmp 0x1000036fd
and dword [rsp + 0x58], 0xfbfff7ff
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
or rcx, 0xffffffffffffffff
cmp rax, rcx
mov rbp, rax
je 0x1000036f5
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000015c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8c]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000036f2
cmp dword [rsp + 0x40], esi
jne 0x1000036f2
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000015d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000036f2
cmp dword [rsp + 0x40], esi
jne 0x1000036f2
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000015f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xed0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000036f2
cmp dword [rsp + 0x40], esi
jne 0x1000036f2
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x100001608]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcd0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x1000036fb
cmp dword [rsp + 0x40], esi
jne 0x1000036fb
xor r9d, r9d
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 0xb]
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, edi
je 0x1000036fb
bts dword [rsp + 0x54], 0x10
bts dword [rsp + 0x58], 0xb
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
cmp eax, edi
je 0x1000036fb
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
cmp eax, edi
je 0x1000036fb
xor r9d, r9d
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov ebx, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
je 0x1000036d7
lea rbp, [r14 + 0x210]
lea r8, [rsp + 0xad0]
mov rax, rbp
sub r8, rbp
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000035ec
add rax, 2
test edx, edx
jne 0x1000035d8
cmp ecx, edi
jne 0x1000036b6
lea rax, [r14 + 0x410]
lea r8, [rsp + 0x8d0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x10000361a
add rax, 2
test edx, edx
jne 0x100003606
cmp ecx, edi
jne 0x1000036b6
lea r9, [rsp + 0x2a0]
mov r8, r14
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x2a0], 0x630
mov dword [rsp + 0x20], 0x630
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailW]
cmp eax, edi
jne 0x100003660
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000036b6
lea rax, [rsp + 0x2c0]
lea r8, [rsp + 0xed0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x100003687
add rax, 2
test edx, edx
jne 0x100003673
cmp ecx, edi
jne 0x1000036b6
lea rax, [rsp + 0x6c8]
lea r8, [rsp + 0xcd0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000036b2
add rax, 2
test edx, edx
jne 0x10000369e
cmp ecx, edi
je 0x1000036eb
add ebx, esi
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov r9d, ebx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
jne 0x1000035ca
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
jmp 0x1000033ca
mov edi, esi
jmp 0x1000033ca
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.100007a20
add rsp, 0x10e0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret