Function at 0x140049e90
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rsp + 0x70], xmm11
mov r12, rcx
xor ebp, ebp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x60], rbp
mov qword [rax + 0x20], rbp
lea rax, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.systemcurrentcontrolsetenumusb
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004a21c
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], ebp
xorps xmm11, xmm11
xorps xmm6, xmm6
mov r15d, ebp
mov dword [rsp + 0x118], 0x100
mov ecx, 0x202
call fcn.140003f10
mov rsi, rax
lea r14, [rbp - 1]
lea r13, str.root_hub30
movsd xmm10, qword [0x1402d3598]
movss xmm8, dword [0x1402d3590]
movss xmm7, dword [0x1402d35a8]
movss xmm9, dword [0x1402d35b8]
nop word [rax + rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x118]
mov r8, rsi
mov edx, r15d
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004a17f
call fcn.1400102e4
test rax, rax
je 0x14004a263
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x120], rax
test rsi, rsi
je 0x14004a000
cmp rsi, 0x10000
jae 0x140049ff0
movzx edx, si
lea rcx, [rsp + 0x120]
call fcn.140010b40
jmp 0x14004a014
mov r8, r14
inc r8
cmp word [rsi + r8*2], 0
jne 0x140049ff3
jmp 0x14004a003
mov r8d, ebp
mov rdx, rsi
lea rcx, [rsp + 0x120]
call fcn.140002b2c
nop
mov rbx, qword [rsp + 0x120]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14004a26e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004a050
mov edx, edi
lea rcx, [rsp + 0x120]
call fcn.140002ac8
mov rbx, qword [rsp + 0x120]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140232790
cmp edi, dword [rbx - 0xc]
jg 0x14004a26e
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], bp
lea rdi, [rbx - 0x18]
mov rcx, rdi
call fcn.140002cec
mov rbx, rax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14004a096
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r14
lea rdi, str.root_hub
movzx eax, word [rbx + rcx*2 + 0x1a]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x14004a0c5
add rcx, 2
cmp rcx, 9
je 0x14004a126
movzx eax, word [rbx + rcx*2 + 0x18]
cmp ax, word [rdi + rcx*2]
je 0x14004a0a0
mov rcx, r14
lea rdi, str.root_hub20
nop
movzx eax, word [rbx + rcx*2 + 0x1a]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x14004a0f1
add rcx, 2
cmp rcx, 0xb
je 0x14004a13a
movzx eax, word [rbx + rcx*2 + 0x18]
cmp ax, word [rdi + rcx*2]
je 0x14004a0d0
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rcx*2 + 0x1a]
cmp ax, word [r13 + rcx*2 + 2]
jne 0x14004a14f
add rcx, 2
cmp rcx, 0xb
je 0x14004a144
movzx eax, word [rbx + rcx*2 + 0x18]
cmp ax, word [r13 + rcx*2]
jne 0x14004a14f
jmp 0x14004a100
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
comisd xmm10, xmm0
jbe 0x14004a0c5
movaps xmm6, xmm8
jmp 0x14004a14f
comiss xmm7, xmm6
jbe 0x14004a0f1
movaps xmm6, xmm7
jmp 0x14004a14f
movaps xmm0, xmm9
maxss xmm0, xmm6
movaps xmm6, xmm0
inc r15d
mov dword [rsp + 0x118], 0x100
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140049f70
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140049f70
comiss xmm6, xmm11
jbe 0x14004a1f5
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x14004a263
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
xorps xmm2, xmm2
cvtss2sd xmm2, xmm6
movq r8, xmm2
lea rdx, str._.1f
lea rcx, [rsp + 0x40]
call fcn.140044a30
mov rbx, qword [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
mov edx, 0x115b4
mov rcx, qword [r12]
call fcn.14001e7c0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14004a1f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x14004a202
mov rcx, rsi
call fcn.1400041d4
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x14004a217
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004a21c
mov rbp, qword [rsp + 0x50]
test rbp, rbp
je 0x14004a22a
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002dfc
nop
mov ecx, 0x80070057
call fcn.140002dfc
int3