Function at 0x14005ea70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x388
test rcx, rcx
mov rsi, rdx
mov rbp, rcx
jne 0x14005ea91
xor eax, eax
add rsp, 0x388
pop rsi
pop rbp
ret
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x378], rdi
xor edi, edi
lea rcx, [0x1400e3c50]
lea r9d, [rdi + 2]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14005eaeb
lea rdx, [rsp + 0x170]
mov rcx, rax
mov dword [rsp + 0x170], 0x128
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
jne 0x14005eaf2
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
jmp 0x14005ed1e
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x370], r12
mov dword [rsp + 0x50], 0x20
mov r12d, edi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14005ed0b
nop
mov ecx, dword [rsp + 0x64]
lea rdx, [rsp + 0x2a0]
xor r9d, r9d
mov r8d, 0xc8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ExA]
test eax, eax
jne 0x14005ec17
lea rax, [rsp + 0x3a0]
lea r9, [rsp + 0x3b0]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r8d, 0x15
mov rcx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3a0], 8
mov dword [rsp + 0x3b0], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov r11d, dword [rbp]
cmp qword [rsp + 0x40], r11
jne 0x14005ec17
lea rax, [rsp + 0x3a0]
lea r9, [rsp + 0x3b0]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r8d, 0x1c
mov rcx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3a0], 8
mov dword [rsp + 0x3b0], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov rdx, qword [rsp + 0x40]
mov r11d, dword [rbp + 4]
mov rax, rdx
shr rax, 0x10
cmp rax, r11
jne 0x14005ec17
mov ecx, dword [rbp + 8]
movzx eax, dx
cmp rax, rcx
je 0x14005ec39
add r12d, 1
lea r8, [rsp + 0x50]
mov rcx, rbx
mov edx, r12d
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14005eb20
jmp 0x14005ed0b
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 1
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14005ecfa
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0xff
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x3b8], 0x100
mov byte [rsp + 0x70], 0
call fcn.14007cd30
lea r11, [rsp + 0x3b8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x48]
lea rdx, [0x1400b7bf8]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005ecef
test rsi, rsi
je 0x14005ecef
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x70]
sub rsi, rax
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rsi + rcx - 1], al
jne 0x14005ece0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005ed06
lea rcx, str.GetDriverKeyfromBDF:_SetupDiOpenDevRegKey_function_fails_n
call fcn.14000cbb0
mov edi, 1
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov r12, qword [rsp + 0x370]
mov eax, edi
mov rbx, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x378]
add rsp, 0x388
pop rsi
pop rbp
ret