Function at 0x1400a93e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x81f0]
mov eax, 0x82f0
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x8330], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x81e0], rax
mov r14, r9
mov r13, r8
mov r15, rdx
xor r8d, r8d
lea rdx, str.CBaseInfoAddIn::GetEnumRegEntry
lea rcx, [rsp + 0x50]
call fcn.1400075a0
nop
mov qword [rsp + 0x20], r13
mov r9, r15
lea r8, str.hKeyPDrvData___p__lpcPreFix___p
mov esi, 1
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140007780
xor ebx, ebx
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
test r15, r15
je 0x1400a96ac
test r13, r13
je 0x1400a96ac
mov rcx, qword [r14 + 8]
mov r8, qword [r14]
cmp r8, rcx
je 0x1400a94ac
mov rdx, rcx
call fcn.1400ad370
mov rdi, rax
mov rdx, qword [r14 + 8]
mov rcx, rax
call fcn.1400ac5d0
mov qword [r14 + 8], rdi
mov r12d, ebx
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x7fd0]
call fcn.14024b970
mov dword [rsp + 0x48], 0x104
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x7fd0]
mov edx, r12d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7fd0]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, str._t_t_tidx___02d__Entry___s_Ret___08x.
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
test edi, edi
je 0x1400a9573
sub edi, 0xea
je 0x1400a9573
cmp edi, 0x19
je 0x1400a956c
lea r8, str._t_t_tunknown_RegEnumValue_return_valule.
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
mov esi, ebx
jmp 0x1400a968f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rdx, r13
lea rcx, [rbp + 0x7fd0]
call fcn.140249654
test eax, eax
jne 0x1400a968f
mov dword [rbp - 0x70], r12d
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x7fd0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x7fd0]
lea rcx, [rsp + 0x68]
call fcn.140001f40
nop
cmp qword [rbp - 0x50], 8
jb 0x1400a95e5
mov rcx, qword [rbp - 0x68]
call fcn.1401026ec
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
mov rcx, qword [rbp - 0x80]
cmp rcx, 8
jae 0x1400a961d
mov r8, qword [rsp + 0x78]
lea r8, [r8 + r8 + 2]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call fcn.140246c50
mov rcx, qword [rbp - 0x80]
jmp 0x1400a962b
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x40], eax
mov eax, dword [rsp + 0x44]
mov dword [rbp - 0x3c], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x7fd0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [rbp - 0x70]
mov rcx, r14
call fcn.1400ab310
inc r12d
cmp qword [rbp - 0x50], 8
jb 0x1400a96a2
mov rcx, qword [rbp - 0x68]
call fcn.1401026ec
test esi, esi
jne 0x1400a94b0
jmp 0x1400a96b7
mov ebx, 0x80010001
mov dword [0x1403b95bc], esi
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rcx, [rsp + 0x50]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rbp + 0x81e0]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x8330]
add rsp, 0x82f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret