Function at 0x140005d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14006ee08]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
call fcn.1400197c4
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140005dc8
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rdi
call fcn.140005210
mov rax, qword [0x140070820]
mov dword [rax], 1
lea rdx, str.Search_Driver
mov rcx, rdi
call fcn.140018b24
mov ecx, 0x69
call fcn.1400197b0
test rax, rax
je 0x140005e22
mov r8d, 0x69
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001410
mov rbx, qword [rsp + 0x30]
lea rcx, [rdi + 0x258]
mov rdx, rbx
call fcn.140018b24
mov ecx, 0x6a
call fcn.1400197b0
test rax, rax
je 0x140005e58
mov r8d, 0x6a
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001410
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rdi + 0x300]
call fcn.140018b24
mov ecx, 0x6b
call fcn.1400197b0
test rax, rax
je 0x140005e8e
mov r8d, 0x6b
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001410
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rdi + 0x3a8]
call fcn.140018b24
mov ecx, 0x6c
call fcn.1400197b0
test rax, rax
je 0x140005ec4
mov r8d, 0x6c
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001410
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rdi + 0x450]
call fcn.140018b24
mov ecx, 0x6d
call fcn.1400197b0
test rax, rax
je 0x140005efa
mov r8d, 0x6d
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001410
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rdi + 0x4f8]
call fcn.140018b24
mov dword [rsp + 0x38], 0x100
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareMSISetupDrv
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005f93
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.MRUList
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005f88
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x143
mov rcx, qword [rdi + 0x880]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
lea rcx, [rdi + 0x300]
call fcn.140018c0c
mov edx, 1
lea rcx, [rdi + 0x3a8]
call fcn.140018c0c
mov edx, 1
lea rcx, [rdi + 0x450]
call fcn.140018c0c
mov edx, 1
lea rcx, [rdi + 0x4f8]
call fcn.140018c0c
lea rcx, [rdi + 0x840]
mov edx, 1
call fcn.140018c0c
lea rcx, [rdi + 0x8e8]
mov edx, 1
call fcn.140018c0c
lea rcx, [rdi + 0xb88]
mov edx, 1
call fcn.140018c6c
lea rcx, [rdi + 0xae0]
mov edx, 1
call fcn.140018c6c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006037
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400383f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret