Function at 0x1400081b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x4c0
mov rax, qword [0x14006c868]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
xor r13d, r13d
mov r12, r8
mov rdi, rcx
mov rbx, r13
mov ebp, 0x80004005
mov qword [rsp + 0x60], rbx
test r8, r8
jne 0x1400081f4
lea eax, [rbp - 2]
jmp 0x140008495
test edx, edx
je 0x140008493
cmp dword [rcx + 0x140], edx
je 0x140008212
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x140008495
cmp byte [rdi + 0x31], 1
mov qword [rsp + 0x508], rsi
jne 0x14000848b
lea rdx, [rsp + 0x3a0]
mov rcx, rdi
call fcn.140007e40
lea rcx, [rsp + 0x290]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x48], r13
call fcn.14001f820
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x104
call fcn.14001f820
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
call fcn.14001f820
mov rax, qword [str.SystemCurrentControlSetEnumDisplay]
lea rcx, [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [0x1400539d0]
or rsi, 0xffffffffffffffff
mov qword [rcx + 8], rax
mov rax, qword [0x1400539d8]
lea rdi, [rsp + 0x70]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400539e0]
lea r8, [rsp + 0x3a0]
mov qword [rcx + 0x18], rax
mov eax, dword [0x1400539e8]
mov edx, 0x104
mov dword [rcx + 0x20], eax
movzx eax, word [0x1400539ec]
mov dword [rsp + 0x58], 0x104
mov word [rcx + 0x24], ax
xor eax, eax
mov rcx, rsi
repne scasb al, byte [rdi]
movzx eax, word [0x1400539c4]
lea rcx, [rsp + 0x70]
mov word [rdi - 1], ax
call fcn.140022380
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000844d
test eax, eax
jne 0x14000844d
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x180]
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140008448
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x180]
mov qword [rsp + 0x50], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140008448
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
lea rdx, str.DeviceDesc
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x44], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x44], 1
jne 0x140008448
test eax, eax
jne 0x140008448
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x180]
call fcn.140007b20
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x60]
call fcn.1400080c0
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14000842c
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008427
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov rcx, qword [rbx]
mov edx, eax
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
test rax, rax
jne 0x14000842f
mov ecx, 0x8007000e
call fcn.14001c7c0
int3
mov rax, r13
jmp 0x14000842f
mov rax, r13
mov rcx, qword [rsp + 0x50]
mov qword [r12], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
mov ebp, r13d
jmp 0x14000844d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000848b
lock xadd dword [rbx + 0x10], esi
add esi, 0xffffffff
jne 0x14000848b
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008475
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008483
call fcn.14001ed10
mov rcx, rdi
call fcn.14001cec0
mov rsi, qword [rsp + 0x508]
mov eax, ebp
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.14001f7f0
add rsp, 0x4c0
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret