Function at 0x1400eccb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, r8
mov qword [rsp + 0x58], r8
mov r13, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x148], r8
mov qword [rsp + 0xc8], r8
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001ControlClass4D36E968_E325_11CE_BFC1_08002BE10318_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400ed794
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov r15d, 8
mov dword [rsp + 0x40], r15d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.1400774f0
nop
mov rsi, qword [rsp + 0x190]
mov rcx, rsi
mov qword [rsp + 0xe0], rcx
mov rbx, qword [rsi]
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0xb8], rbx
cmp rbx, rcx
je 0x1400ed6df
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rax
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x1400ecdbe
mov rsi, qword [rax]
mov dword [rsp + 0x170], r12d
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, str.MatchingDeviceId
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r14d, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x178], xmm1
mov qword [rsp + 0x188], r12
mov edx, dword [rsp + 0x170]
shr rdx, 1
je 0x1400ece30
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x178]
call fcn.14003eb20
nop dword [rax + rax]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, str.MatchingDeviceId
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400ed7c8
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x160], r12
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], r12w
mov rdx, qword [rsp + 0x178]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400ecea4
lea rcx, [rsp + 0x150]
call fcn.140018360
or r15d, 0x10
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x40], r15d
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1400ecf27
mov rax, qword [rsp + 0x188]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ecf0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed7fc
call fcn.1401a9a50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x188], r12
lea r14, [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp qword [rsp + 0x168], 8
jb 0x1400ecf53
mov rsi, qword [rsp + 0x150]
lea r15, [rsi + rax*2]
mov r14, rsi
jmp 0x1400ecf67
lea r15, [rsp + 0x150]
lea r15, [r15 + rax*2]
lea rsi, [rsp + 0x150]
cmp rsi, r15
je 0x1400ecf82
movzx ecx, word [rsi]
call fcn.1401e3f00
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ecf67
cmp qword [r13 + 0x18], 8
jb 0x1400ecfa2
mov rsi, qword [r13]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x10]
lea r15, [rsi + rcx*2]
mov r14, rsi
jmp 0x1400ecfb7
mov rax, qword [r13 + 0x10]
lea r15, [rax*2]
add r15, r13
mov rsi, r13
mov r14, r13
cmp rsi, r15
je 0x1400ecfd2
movzx ecx, word [rsi]
call fcn.1401e3f00
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ecfb7
mov rdx, qword [rsp + 0x58]
cmp qword [rdx + 0x18], 8
jb 0x1400ecff6
mov rsi, qword [rdx]
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax + 0x10]
lea r15, [rsi + rcx*2]
mov r14, rsi
jmp 0x1400ed004
mov rax, qword [rdx + 0x10]
lea r15, [rdx + rax*2]
mov rsi, rdx
mov r14, rdx
cmp rsi, r15
je 0x1400ed01f
movzx ecx, word [rsi]
call fcn.1401e3f00
mov word [r14], ax
add rsi, 2
add r14, 2
jmp 0x1400ed004
lea r11, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
setae r14b
cmovae r11, qword [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp rax, 4
jb 0x1400ed0e9
add rax, 0xfffffffffffffffd
lea rsi, [r11 + rax*2]
mov rax, r11
lea r15, str.1002
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x1400ed08b
cmp word [rax], 0x31
je 0x1400ed088
cmp rcx, 1
je 0x1400ed08b
dec rcx
add rax, 2
cmp word [rax], 0x31
jne 0x1400ed075
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400ed0e9
mov r9d, 4
mov rcx, r15
movzx edx, word [rdx]
mov r8d, 0x31
cmp dx, r8w
jb 0x1400ed0d3
mov r10, rax
sub r10, r15
cmp dx, r8w
ja 0x1400ed0d3
cmp r9, 1
je 0x1400ed0d9
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400ed0b5
add rax, 2
jmp 0x1400ed061
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x1400ed1ad
lea r11, [rsp + 0x150]
test r14b, r14b
cmovne r11, qword [rsp + 0x150]
mov rax, qword [rsp + 0x160]
cmp rax, 4
jb 0x1400ed43d
add rax, 0xfffffffffffffffd
lea rsi, [r11 + rax*2]
mov rax, r11
lea r14, str.1022
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x1400ed14b
cmp word [rax], 0x31
je 0x1400ed148
cmp rcx, 1
je 0x1400ed14b
dec rcx
add rax, 2
cmp word [rax], 0x31
jne 0x1400ed135
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400ed43d
mov r9d, 4
mov rcx, r14
movzx edx, word [rdx]
mov r8d, 0x31
cmp dx, r8w
jb 0x1400ed197
mov r10, rax
sub r10, r14
cmp dx, r8w
ja 0x1400ed197
cmp r9, 1
je 0x1400ed19d
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400ed179
add rax, 2
jmp 0x1400ed121
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400ed43d
mov r12, qword [r13 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 4
jb 0x1400ed802
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x18], 8
jb 0x1400ed1da
mov r13, qword [rax]
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea r15, [r12 + 4]
mov esi, 7
lea r14, [rsp + 0x78]
cmp r15, rsi
jbe 0x1400ed247
mov rsi, r15
or rsi, 7
cmp rsi, rcx
jbe 0x1400ed216
mov rsi, rcx
jmp 0x1400ed223
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140023c30
mov r14, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rsi
movabs rax, 0x5f005600450044
mov qword [r14], rax
lea rcx, [r14 + 8]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.1401cfe40
xor r12d, r12d
mov word [r14 + r15*2], r12w
mov r15d, dword [rsp + 0x44]
or r15d, 0x20
or r15d, 1
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x40], r15d
lea r9, [rsp + 0x78]
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x70], r14
cmp qword [rsp + 0x90], 8
cmovae r9, r14
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
call fcn.14002db00
cmp rax, 0xffffffffffffffff
je 0x1400ed447
mov rcx, qword [rsp + 0x58]
mov r12, qword [rcx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r12
cmp rax, 4
jb 0x1400ed808
mov r13, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400ed320
mov r13, qword [rcx]
xor eax, eax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
lea r15, [r12 + 4]
mov esi, 7
lea r14, [rsp + 0x98]
cmp r15, rsi
jbe 0x1400ed399
mov rsi, r15
or rsi, 7
cmp rsi, rdx
jbe 0x1400ed362
mov rsi, rdx
jmp 0x1400ed36f
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140023c30
mov r14, rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], rsi
movabs rax, 0x5f005600450052
mov qword [r14], rax
lea rcx, [r14 + 8]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.1401cfe40
xor r12d, r12d
mov word [r14 + r15*2], r12w
mov r15d, dword [rsp + 0x44]
or r15d, 0x42
mov dword [rsp + 0x40], r15d
lea r9, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae r9, qword [rsp + 0x98]
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
call fcn.14002db00
mov r14, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
je 0x1400ed447
mov sil, 1
jmp 0x1400ed44a
mov r15d, dword [rsp + 0x44]
mov r14, qword [rsp + 0x78]
xor sil, sil
test r15b, 2
je 0x1400ed4a2
and r15d, 0xfffffffd
mov dword [rsp + 0x40], r15d
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x1400ed4a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed49c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed80d
call fcn.1401a9a50
nop
test r15b, 1
je 0x1400ed4f4
and r15d, 0xfffffffe
mov dword [rsp + 0x40], r15d
mov rax, qword [rsp + 0x90]
cmp rax, 8
jb 0x1400ed4f4
lea rdx, [rax*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400ed4ec
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed813
mov rcx, r14
call fcn.1401a9a50
test sil, sil
je 0x1400ed61d
mov r8, qword [rsp + 0xd0]
cmp qword [r8 + 0x18], 8
jb 0x1400ed50f
mov r8, qword [r8]
mov byte [rsp + 0x20], 1
lea r9, str.DriverDesc
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400772f0
or r15d, 4
mov dword [rsp + 0x40], r15d
mov rdx, qword [rsp + 0x168]
cmp rdx, 8
jb 0x1400ed57e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed579
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed819
call fcn.1401a9a50
mov qword [rsp + 0x160], r12
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], r12w
mov rcx, qword [rsp + 0x190]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rdi, qword [rcx]
test rdi, rdi
je 0x1400ed5d8
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400272a0
mov edx, 0x30
mov rcx, rdi
call fcn.1401a9a50
mov rdi, rbx
test rbx, rbx
jne 0x1400ed5b2
mov rbx, qword [rsp + 0x68]
mov edx, 0x30
mov rcx, qword [rsp + 0x190]
call fcn.1401a9a50
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ed600
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r12
mov rcx, qword [rsp + 0x60]
call fcn.1400272a0
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400272a0
mov rax, rbx
jmp 0x1400ed771
mov rax, qword [rsp + 0x168]
cmp rax, 8
jb 0x1400ed669
lea rdx, [rax*2 + 2]
mov rsi, qword [rsp + 0x150]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400ed660
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed819
mov rcx, rsi
call fcn.1401a9a50
nop
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x190]
mov rcx, qword [rsp + 0xe0]
jmp 0x1400ecd94
mov rax, qword [rsi + 8]
mov qword [rax], r12
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400ed711
nop
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.1400272a0
mov edx, 0x30
mov rcx, rsi
call fcn.1401a9a50
mov rsi, rbx
test rbx, rbx
jne 0x1400ed6f0
mov edx, 0x30
mov rcx, qword [rsp + 0x190]
call fcn.1401a9a50
mov rbx, qword [rsp + 0x68]
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x14022ee70]
mov rcx, rbx
call fcn.140018360
nop
test rdi, rdi
je 0x1400ed75d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r13
call fcn.1400272a0
nop
mov rcx, r14
call fcn.1400272a0
mov rax, rbx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401a9a30
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140015e70
nop
mov r8, rax
lea r9, str.Unable_to_open_registry_key
mov edx, ebx
lea rcx, [rsp + 0xe8]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0xe8]
call fcn.1401cfc8c
nop
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_get_registry_value
mov edx, r14d
lea rcx, [rsp + 0x110]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x110]
call fcn.1401cfc8c
nop
call fcn.1401e3dbc
nop
call fcn.1400153e0
nop
call fcn.1400153e0
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3