Function at 0x1000509d8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x88], rdx
mov r15, rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0x70], 0
xor esi, esi
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x58]
call fcn.10001fee0
nop
mov r8, qword [r15]
lea rdx, [0x10000ff70]
lea ecx, [rsi + 1]
call fcn.10003c3c0
lea rcx, [0x10000f7d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x100050a71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100051047
lea rdx, [0x10000f7f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x100050a9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10005103e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov rcx, qword [r15]
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x100051025
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x100051025
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x100050afe
xor ecx, ecx
jmp 0x100050b11
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.10001fae8
lea rcx, [rsp + 0x60]
call fcn.1000536ac
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.10004d9cc
test eax, eax
jne 0x100050b53
mov edi, 0x65b
jmp 0x10005103e
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0xc8], 0x20
xor edi, edi
lea r8, [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x10005100a
mov rbp, qword [rsp + 0x58]
add edi, 1
mov dword [rsp + 0x6c], edi
mov r13, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.10001fee0
nop
xor edi, edi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc8
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x100050be7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100050f7b
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x100050c7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x100050c39
movzx eax, r12w
or eax, 0x800f0000
jmp 0x100050c49
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovle eax, r12d
cmp eax, 0x800f0204
je 0x100050c6e
lea r8, [rsp + 0xf0]
lea rdx, [0x100010040]
mov ecx, 2
call fcn.10003c3c0
jmp 0x100050f7b
lea rcx, [rsp + 0x50]
call fcn.10001fba0
jmp 0x100050fb9
mov rbx, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x100050ca9
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.10001fc6c
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jl 0x100050fff
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], 0
mov dword [rsp + 0x68], 0x208
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000f958]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100050d4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x100050fe2
cmp ecx, dword [rbx - 0xc]
jg 0x100050fe2
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
lea r8, [rsp + 0xf0]
lea rdx, [0x1000100a0]
mov ecx, 2
call fcn.10003c3c0
mov edi, dword [rsp + 0x44]
jmp 0x100050f6d
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x100050ff4
cmp ecx, dword [rbx - 0xc]
jg 0x100050ff4
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov rax, rbp
sub rbx, rbp
movzx ecx, word [rax]
cmp cx, word [rax + rbx]
jne 0x100050d96
add rax, 2
test cx, cx
jne 0x100050d80
xor eax, eax
jmp 0x100050d9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100050f51
lea r8, [rsp + 0xf0]
lea rdx, [0x100010100]
lea ebx, [rax + 1]
mov ecx, ebx
call fcn.10003c3c0
mov edi, ebx
mov dword [rsp + 0x44], ebx
xor r9d, r9d
mov r8d, dword [rsp + 0xdc]
lea rdx, [rsp + 0xa4]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
je 0x100050eba
cmp eax, 0x25
je 0x100050eba
lea r8, [rsp + 0xf0]
lea rdx, [0x100010180]
mov ecx, ebx
call fcn.10003c3c0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x100050e2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100050f54
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.10001ff98
mov rdi, rax
cmp dword [rbp - 8], ebx
jle 0x100050e7b
mov edx, dword [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.10001fbd0
mov rbp, qword [rsp + 0x58]
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.10001ff98
nop
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, r12
mov r8, rdi
mov rdx, rax
mov rcx, r13
call fcn.100052608
mov r12d, eax
test eax, eax
jne 0x100050f54
jmp 0x100050f51
lea r8, [rsp + 0xf0]
lea rdx, [0x100010230]
mov ecx, ebx
call fcn.10003c3c0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov ebx, 4
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rbx + 6]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
jne 0x100050f1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100050f6d
or dword [rsp + 0x40], 0x20
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
mov r8d, 0xa
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
jne 0x100050f51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100050f6d
xor r12d, r12d
cmp r13, 0xffffffffffffffff
je 0x100050f69
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edi, dword [rsp + 0x44]
jmp 0x100050f6d
mov edi, dword [rsp + 0x44]
test r14, r14
je 0x100050f7b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
je 0x100050faf
test edi, edi
je 0x100050fa7
lea r8, [rsp + 0xf0]
lea rdx, [0x1000102c0]
mov ecx, 3
call fcn.10003c3c0
mov dword [rsp + 0x4c], 1
jmp 0x100050faf
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
call fcn.10001fba0
lea r8, [rsp + 0xc8]
mov edi, dword [rsp + 0x6c]
mov edx, edi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x100050fed
mov r12, qword [rsp + 0x98]
jmp 0x100050b91
mov ecx, 0x80070057
call fcn.10001fd10
nop
mov rbx, qword [rsp + 0x78]
jmp 0x10005100a
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov ecx, 0x80070057
call fcn.10001fd10
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x100051021
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10005103e
xor edi, edi
jmp 0x10005103e
mov r8, qword [r15]
lea rdx, [0x10000ffd0]
mov ecx, 3
call fcn.10003c3c0
mov edi, 0x65b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x100051080
cmp dword [rsp + 0x4c], edi
je 0x100051067
lea rdx, [0x100010320]
lea ecx, [rdi + 3]
call fcn.10003c3c0
mov edi, 0x643
jmp 0x100051080
cmp dword [rsp + 0x48], 0
je 0x100051080
lea rdx, [0x1000103d0]
mov ecx, 2
call fcn.10003c3c0
nop
lea rcx, [rsp + 0x58]
call fcn.10001fba0
nop
test rsi, rsi
je 0x1000510af
lock add dword [rsi + 8], 0xffffffff
jne 0x1000510a6
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsp + 0x60], 0
mov rcx, r15
call fcn.10001fba0
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret