Function at 0x1000012f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x320
mov rax, qword [0x100003110]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor edi, edi
mov r12, rdi
or rsi, 0xffffffffffffffff
cmp ecx, 2
jne 0x1000014b7
mov r12, qword [rdx + 8]
cmp r12, rdi
je 0x1000014b7
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 6]
xor r8d, r8d
lea rdx, [0x1000011e0]
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsExW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x10000137e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000014b7
mov r13d, edi
xor edx, edx
lea r8d, [rdx + 0x1c]
lea rcx, [rsp + 0x5c]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], 0x20
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
cmp eax, edi
je 0x1000014b1
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x100001457
mov word [rsp + 0x80], di
xor edx, edx
lea r8d, [rdx + 0x7a]
lea rcx, [rsp + 0x82]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x40], 0x7c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x1000011f0]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rbx, eax
mov rcx, r14
call qword [entry0]
cmp rbx, rdi
jne 0x100001457
lea rdx, [rsp + 0x80]
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x10000148c
inc r13d
xor edx, edx
lea r8d, [rdx + 0x1c]
lea rcx, [rsp + 0x5c]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], 0x20
lea r8, [rsp + 0x58]
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
cmp eax, edi
je 0x1000014b1
jmp 0x1000013b1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rsi
or rcx, 0xffffffffffffffff
call sub.newdev.dll_DiUninstallDevice
cmp eax, edi
jne 0x1000014b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000014b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rsi, 0xffffffffffffffff
je 0x1000014c6
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp r12, rdi
je 0x100001558
mov word [rsp + 0x100], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x102]
call sub.msvcrt.dll_memset
mov rbx, rdi
mov qword [rsp + 0x48], rbx
mov r9, r12
lea r8, [0x100001218]
mov edx, 0x208
lea rcx, [rsp + 0x100]
call fcn.100001288
cmp eax, edi
jl 0x100001546
lea r8, [rsp + 0x100]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, rdi
jne 0x10000153c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100001546
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
cmp rbx, rdi
je 0x100001558
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100001558
xor eax, eax
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.100001890
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret