Function at 0x10000354c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x10e0
call fcn.100007b90
sub rsp, rax
mov rax, qword [0x10000a100]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov r12, rcx
mov r14, r8
mov r13, rdx
mov ebx, 0x248
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rbx
xor edi, edi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x50], ebx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
cmp eax, edi
je 0x100003937
or dword [rsp + 0x58], 0x4000800
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
lea esi, [rdi + 1]
mov rdx, r13
mov rcx, r12
mov r8d, esi
cmp eax, edi
je 0x10000360d
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
cmp eax, edi
je 0x100003937
xor r9d, r9d
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
setne dil
mov eax, edi
jmp 0x100003939
and dword [rsp + 0x58], 0xfbfff7ff
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
or rcx, 0xffffffffffffffff
mov rbp, rax
cmp rax, rcx
je 0x100003931
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x100001678]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8c]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000392e
cmp dword [rsp + 0x40], esi
jne 0x10000392e
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x100001688]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000392e
cmp dword [rsp + 0x40], esi
jne 0x10000392e
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000016a8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xed0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000392e
cmp dword [rsp + 0x40], esi
jne 0x10000392e
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [0x1000016c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcd0]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x100003937
cmp dword [rsp + 0x40], esi
jne 0x100003937
xor r9d, r9d
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 0xb]
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, edi
je 0x100003937
bts dword [rsp + 0x54], 0x10
bts dword [rsp + 0x58], 0xb
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
cmp eax, edi
je 0x100003937
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
cmp eax, edi
je 0x100003937
xor r9d, r9d
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov ebx, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
je 0x100003913
lea rbp, [r14 + 0x210]
lea r8, [rsp + 0xad0]
mov rax, rbp
sub r8, rbp
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x100003828
add rax, 2
test edx, edx
jne 0x100003814
cmp ecx, edi
jne 0x1000038f2
lea rax, [r14 + 0x410]
lea r8, [rsp + 0x8d0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x100003856
add rax, 2
test edx, edx
jne 0x100003842
cmp ecx, edi
jne 0x1000038f2
lea r9, [rsp + 0x2a0]
mov r8, r14
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x2a0], 0x630
mov dword [rsp + 0x20], 0x630
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailW]
cmp eax, edi
jne 0x10000389c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000038f2
lea rax, [rsp + 0x2c0]
lea r8, [rsp + 0xed0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000038c3
add rax, 2
test edx, edx
jne 0x1000038af
cmp ecx, edi
jne 0x1000038f2
lea rax, [rsp + 0x6c8]
lea r8, [rsp + 0xcd0]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1000038ee
add rax, 2
test edx, edx
jne 0x1000038da
cmp ecx, edi
je 0x100003927
add ebx, esi
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov r9d, ebx
mov qword [rsp + 0x20], r14
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
cmp eax, edi
jne 0x100003806
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
jmp 0x100003606
mov edi, esi
jmp 0x100003606
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.100007680
add rsp, 0x10e0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret