Function at 0x140011aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15, rdx
mov dword [rsp + 0x40], 0x230
lea rdx, [rsp + 0x40]
mov r14, rcx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailW]
test eax, eax
je 0x1400120d0
mov qword [rsp + 0x2d0], rbx
lea r9, [rsp + 0x60]
mov qword [rsp + 0x2a0], rbp
lea rcx, [r15 + 4]
mov qword [rsp + 0x298], rsi
mov edx, 0x20019
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x280], r13
xor r13d, r13d
cmp word [rsp + 0x60], r13w
mov qword [rsp + 0x20], r13
cmove r9, r13
lea r8d, [r13 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov r12, 0xffffffffffffffff
mov rbp, rax
cmp rax, r12
je 0x140011cd3
mov ecx, 0x2004
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140011cd3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.UpperFilters
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011c10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140011c33
cmp dword [rsp + 0x34], 7
jne 0x140011c33
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.140019b64
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140011cd3
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.UpperFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011b94
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r13w
mov rcx, rdi
mov word [rdi + rax*2], r13w
call fcn.14000fee0
mov rsi, rax
test rax, rax
jne 0x140011c3b
mov rcx, rdi
jmp 0x140011cce
cmp qword [rax], r13
je 0x140011cbc
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
mov ecx, 1
call fcn.140021e20
mov rcx, rax
mov edx, 0xee07
call fcn.14000fcc0
mov rdi, rsi
cmp qword [rsi], r13
je 0x140011cbc
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140011c85
mov rdx, qword [rdi]
lea rcx, [0x1400427b0]
call fcn.140006530
add rdi, 8
cmp qword [rdi], r13
jne 0x140011c80
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140011cca
call fcn.140019b64
lea rcx, [rsi - 8]
call fcn.140019b64
mov r8d, 0x11
mov rdx, r15
mov rcx, r14
call fcn.140010160
mov rsi, rax
test rax, rax
je 0x140011d83
cmp qword [rax], r13
je 0x140011d6c
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
mov ecx, 1
call fcn.140021e20
mov rcx, rax
mov edx, 0xee08
call fcn.14000fcc0
mov rdi, rsi
cmp qword [rsi], r13
je 0x140011d6c
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140011d35
mov rdx, qword [rdi]
lea rcx, [0x1400427b0]
call fcn.140006530
add rdi, 8
cmp qword [rdi], r13
jne 0x140011d30
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140011d7a
call fcn.140019b64
lea rcx, [rsi - 8]
call fcn.140019b64
mov r8d, 4
mov rdx, r15
mov rcx, r14
call fcn.14000fda0
mov ecx, 1
mov rdi, rax
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
mov ecx, 1
call fcn.140021e20
mov rcx, rax
mov edx, 0xee09
call fcn.14000fcc0
test rdi, rdi
je 0x140011e10
cmp word [rdi], r13w
je 0x140011e10
mov ebx, 2
nop word [rax + rax]
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140011de0
mov rdx, rdi
lea rcx, [0x1400427b0]
call fcn.140006530
jmp 0x140011e49
mov ebx, 2
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140011e15
lea ecx, [rbx + 1]
call fcn.140021e20
mov rcx, rax
mov edx, 0xee0a
call fcn.14000fcc0
test rdi, rdi
je 0x140011e56
mov rcx, rdi
call fcn.140019b64
cmp rbp, r12
je 0x140011fec
mov ecx, 0x2004
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140011fe3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.LowerFilters
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011f24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140011f47
cmp dword [rsp + 0x34], 7
jne 0x140011f47
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.140019b64
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140019b6c
mov rdi, rax
test rax, rax
je 0x140011fe3
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.LowerFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011ea8
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r13w
mov rcx, rdi
mov word [rdi + rax*2], r13w
call fcn.14000fee0
mov rsi, rax
test rax, rax
jne 0x140011f4f
mov rcx, rdi
jmp 0x140011fde
cmp qword [rax], r13
je 0x140011fcc
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
mov ecx, 1
call fcn.140021e20
mov rcx, rax
mov edx, 0xee0b
call fcn.14000fcc0
mov rdi, rsi
cmp qword [rsi], r13
je 0x140011fcc
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140011f95
mov rdx, qword [rdi]
lea rcx, [0x1400427b0]
call fcn.140006530
add rdi, 8
cmp qword [rdi], r13
jne 0x140011f90
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140011fda
call fcn.140019b64
lea rcx, [rsi - 8]
call fcn.140019b64
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x12
mov rdx, r15
mov rcx, r14
call fcn.140010160
mov r13, qword [rsp + 0x280]
mov rsi, rax
mov r12, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2a0]
test rax, rax
je 0x1400120b3
cmp qword [rax], 0
je 0x14001209c
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
mov ecx, 1
call fcn.140021e20
mov rcx, rax
mov edx, 0xee0c
call fcn.14000fcc0
cmp qword [rsi], 0
mov rdi, rsi
je 0x14001209c
mov ebx, 2
mov ecx, 1
call fcn.140021e20
mov rdx, rax
lea rcx, [0x140042744]
call fcn.140021f60
sub rbx, 1
jne 0x140012065
mov rdx, qword [rdi]
lea rcx, [0x1400427b0]
call fcn.140006530
add rdi, 8
cmp qword [rdi], rbx
jne 0x140012060
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x1400120aa
call fcn.140019b64
lea rcx, [rsi - 8]
call fcn.140019b64
mov rdi, qword [rsp + 0x290]
mov eax, 1
mov rsi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140019b40
add rsp, 0x2a8
pop r15
pop r14
ret