Function at 0x140011a10
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15, rdx
mov dword [rsp + 0x40], 0x230
lea rdx, [rsp + 0x40]
mov r14, rcx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailW]
test eax, eax
je 0x140012040
mov qword [rsp + 0x2d0], rbx
lea r9, [rsp + 0x60]
mov qword [rsp + 0x2a0], rbp
lea rcx, [r15 + 4]
mov qword [rsp + 0x298], rsi
mov edx, 0x20019
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x288], r12
xor r12d, r12d
cmp word [rsp + 0x60], r12w
mov qword [rsp + 0x280], r13
cmove r9, r12
mov qword [rsp + 0x20], r12
lea r8d, [r12 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov r13, 0xffffffffffffffff
mov rbp, rax
cmp rax, r13
je 0x140011c38
mov ecx, 0x2004
call fcn.1400198fc
mov rdi, rax
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.UpperFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011b73
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140011c30
cmp dword [rsp + 0x34], 7
jne 0x140011c30
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.1400198f4
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400198fc
mov rdi, rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.UpperFilters
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011b00
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r12w
mov rcx, rdi
mov word [rdi + rax*2], r12w
call fcn.14000fef0
mov rsi, rax
test rax, rax
je 0x140011c30
cmp qword [rax], r12
je 0x140011c1c
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
mov ecx, 1
call fcn.140025d28
mov rcx, rax
mov edx, 0xee07
call fcn.14000fcf0
mov rdi, rsi
cmp qword [rsi], r12
je 0x140011c1c
nop word [rax + rax]
mov ebx, 2
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011be5
mov rdx, qword [rdi]
lea rcx, [0x140047c40]
call fcn.140006520
add rdi, 8
cmp qword [rdi], r12
jne 0x140011be0
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140011c2a
call fcn.1400198f4
lea rcx, [rsi - 8]
jmp 0x140011c33
mov rcx, rdi
call fcn.1400198f4
mov r8d, 0x11
mov rdx, r15
mov rcx, r14
call fcn.140010130
mov rsi, rax
test rax, rax
je 0x140011cf3
cmp qword [rax], r12
je 0x140011cdc
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
mov ecx, 1
call fcn.140025d28
mov rcx, rax
mov edx, 0xee08
call fcn.14000fcf0
mov rdi, rsi
cmp qword [rsi], r12
je 0x140011cdc
nop word [rax + rax]
mov ebx, 2
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011ca5
mov rdx, qword [rdi]
lea rcx, [0x140047c40]
call fcn.140006520
add rdi, 8
cmp qword [rdi], r12
jne 0x140011ca0
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140011cea
call fcn.1400198f4
lea rcx, [rsi - 8]
call fcn.1400198f4
mov r8d, 4
mov rdx, r15
mov rcx, r14
call fcn.14000fdd0
mov ecx, 1
mov rdi, rax
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
mov ecx, 1
call fcn.140025d28
mov rcx, rax
mov edx, 0xee09
call fcn.14000fcf0
test rdi, rdi
je 0x140011d80
cmp word [rdi], r12w
je 0x140011d80
mov ebx, 2
nop word [rax + rax]
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011d50
mov rdx, rdi
lea rcx, [0x140047c40]
call fcn.140006520
jmp 0x140011dbe
mov ebx, 2
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011d85
lea ecx, [rbx + 1]
call fcn.140025d28
mov rcx, rax
mov edx, 0xee0a
call fcn.14000fcf0
test rdi, rdi
je 0x140011dc6
mov rcx, rdi
call fcn.1400198f4
cmp rbp, r13
je 0x140011f4f
mov ecx, 0x2004
call fcn.1400198fc
mov rdi, rax
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.LowerFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011e83
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140011f3e
cmp dword [rsp + 0x34], 7
jne 0x140011f3e
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.1400198f4
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400198fc
mov rdi, rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, str.LowerFilters
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011e10
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r12w
mov rcx, rdi
mov word [rdi + rax*2], r12w
call fcn.14000fef0
mov rsi, rax
test rax, rax
je 0x140011f3e
cmp qword [rax], r12
je 0x140011f2c
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
mov ecx, 1
call fcn.140025d28
mov rcx, rax
mov edx, 0xee0b
call fcn.14000fcf0
mov rdi, rsi
cmp qword [rsi], r12
je 0x140011f2c
nop dword [rax + rax]
mov ebx, 2
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011ef5
mov rdx, qword [rdi]
lea rcx, [0x140047c40]
call fcn.140006520
add rdi, 8
cmp qword [rdi], r12
jne 0x140011ef0
mov rcx, qword [rsi - 8]
lea rdi, [rsi - 8]
test rcx, rcx
je 0x140011f3e
call fcn.1400198f4
mov rcx, rdi
call fcn.1400198f4
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x12
mov rdx, r15
mov rcx, r14
call fcn.140010130
mov r13, qword [rsp + 0x280]
mov rsi, rax
mov r12, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2a0]
test rax, rax
je 0x140012023
cmp qword [rax], 0
je 0x14001200c
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
mov ecx, 1
call fcn.140025d28
mov rcx, rax
mov edx, 0xee0c
call fcn.14000fcf0
cmp qword [rsi], 0
mov rdi, rsi
je 0x14001200c
nop word [rax + rax]
mov ebx, 2
mov ecx, 1
call fcn.140025d28
mov rdx, rax
lea rcx, [0x140047bd4]
call fcn.140025e74
sub rbx, 1
jne 0x140011fd5
mov rdx, qword [rdi]
lea rcx, [0x140047c40]
call fcn.140006520
add rdi, 8
cmp qword [rdi], rbx
jne 0x140011fd0
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x14001201a
call fcn.1400198f4
lea rcx, [rsi - 8]
call fcn.1400198f4
mov rdi, qword [rsp + 0x290]
mov eax, 1
mov rsi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400198d0
add rsp, 0x2a8
pop r15
pop r14
ret