Function at 0x140001750
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140043468]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rsi, rcx
lea rdx, str.systemCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rcx, [rbp + 0x170]
xor ebx, ebx
mov r8d, 0x9c
mov dword [rsp + 0x58], 0x64
mov dword [rsp + 0x40], ebx
call fcn.14001ba60
lea r8d, [rbx + 0x2c]
lea rcx, [rbp + 0x20c]
xor edx, edx
call fcn.14001dd20
lea rcx, [rbp + 0x42]
xor edx, edx
mov r8d, 0x12a
mov word [rbp + 0x40], bx
call fcn.14001dd20
xor eax, eax
lea r8d, [rbx + 0x62]
lea rcx, [rbp - 0x2e]
xor edx, edx
mov word [rsp + 0x60], bx
mov qword [rsp + 0x62], rax
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rbp - 0x7e], rax
mov qword [rbp - 0x76], rax
mov qword [rbp - 0x6e], rax
mov word [rbp - 0x66], ax
mov word [rbp - 0x30], bx
call fcn.14001dd20
mov rax, qword [str.BTHMS_BTHPAN]
lea rcx, str.GetRegPanID_Enter___n
mov qword [rbp - 0x60], rax
mov rax, qword [0x140031928]
mov qword [rbp - 0x58], rax
mov rax, qword [0x140031930]
mov qword [rbp - 0x50], rax
mov eax, dword [0x140031938]
mov dword [rbp - 0x48], eax
xor eax, eax
mov qword [rbp - 0x44], rax
mov dword [rbp - 0x3c], eax
call fcn.14000f070
test rsi, rsi
jne 0x140001861
lea rcx, str.GetRegPanID__invalid_parameter_n
call fcn.14000f070
xor eax, eax
jmp 0x140001b08
lea rax, [rsp + 0x48]
lea rdx, [rbp + 0x170]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000189d
lea rcx, str.GetRegPanID__cant_find_net_class_key_n
call fcn.14000f070
jmp 0x140001ac0
lea rcx, str.GetRegPanID__find_net_class_key_n
mov qword [rsp + 0x368], rdi
call fcn.14000f070
lea rcx, [rbp + 0x40]
xor edx, edx
mov r8d, 0x12c
mov edi, ebx
mov dword [rsp + 0x40], 0x3c
call fcn.14001dd20
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x64]
call fcn.14001dd20
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
xor r11d, r11d
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsi], r11
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001aaa
nop word [rax + rax]
lea r8, [rsp + 0x60]
lea rcx, str.GetRegPanID__find_net_class_sub_key__index__d__name__s_n
mov edx, edi
call fcn.14000f070
lea r8, [rbp + 0x170]
lea rcx, [rbp + 0x40]
mov edx, 0x96
call fcn.14001aecc
lea r8, [0x140031b30]
lea rcx, [rbp + 0x40]
mov edx, 0x96
call fcn.14001aecc
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x40]
mov edx, 0x96
call fcn.14001aecc
lea r11, [rsp + 0x50]
lea rdx, [rbp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001b45
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.DeviceInstanceID
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x64
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400019dc
lea rcx, str.GetRegPanID__cant_get_DeviceInstanceID_n
jmp 0x140001a42
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
mov r8d, 0xd
call fcn.14001aae0
test eax, eax
je 0x1400019fc
lea rcx, str.GetRegPanID__DeviceInstanceID_doesnt_match_n
jmp 0x140001a42
lea rdx, [rbp - 0x30]
lea rcx, str.GetRegPanID__DeviceInstanceID_is__s_n
call fcn.14000f070
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x28], r11
lea rdx, str.NetCfgInstanceId
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140001b2c
lea rcx, str.GetRegPanID__cant_get_NetCfgInstanceId_n
call fcn.14000f070
lea rcx, [rbp + 0x40]
xor edx, edx
mov r8d, 0x12c
inc edi
mov dword [rsp + 0x40], 0x3c
call fcn.14001dd20
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x64]
call fcn.14001dd20
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
xor r11d, r11d
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsi], r11
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001920
lea rcx, str.GetRegPanID__eum_net_class_sub_key_end__index__d_n
mov edx, edi
call fcn.14000f070
mov rdi, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x140001add
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.GetRegPanID__close_hKey_n
call fcn.14000f070
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x140001afa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.GetRegPanID__close_hKey_n
call fcn.14000f070
lea rcx, str.GetRegPanID_Leave___n
call fcn.14000f070
mov eax, ebx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14001a650
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, str.GetRegPanID__NetCfgInstanceId_is__s_n
mov rdx, rsi
call fcn.14000f070
mov ebx, 1
jmp 0x140001ab8
lea r8, [rsp + 0x60]
lea rcx, str.GetRegPanID__cant_open_net_class_sub_key__index__d__name__s_n
mov edx, edi
call fcn.14000f070
jmp 0x140001ab8