Function at 0x41d090
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x398
mov qword [rsp + 0x390], rbx
mov qword [rsp + 0x388], rbp
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x378], rdi
mov qword [rsp + 0x370], r12
mov rsi, rcx
mov qword [rsp + 0x368], r13
call fcn.004545a0
test eax, eax
je 0x41d141
lea rdx, str.CDevNode::IsEnumDevice_n
lea rcx, [rsp + 0x150]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x150]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x41d113
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.004548a0
cmp dword [rsi + 4], 0
mov ebx, 1
jne 0x41d314
mov rbp, qword [rsi + 8]
mov dword [rsp + 0x44], 0x104
cmp rbp, 0xffffffffffffffff
je 0x41d1a5
call fcn.00413910
lea r8, [rsi + 0x10]
mov r9d, 7
mov rcx, rax
lea rax, [rsp + 0x44]
mov rdx, rbp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x250]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.00412120
lea rdx, str.UNKNOWN
lea rcx, [rsp + 0x250]
call fcn.00488120
test eax, eax
je 0x41d2fc
mov r12, qword [rsi + 8]
xor ebp, ebp
mov dword [rsp + 0x40], 0x104
cmp r12, 0xffffffffffffffff
mov r13d, ebp
je 0x41d27d
call fcn.00413910
mov dword [rsp + 0x30], 0x20019
lea r8, [rsi + 0x10]
mov r9d, ebx
mov rdx, r12
mov rcx, rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebp
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x41d27d
lea r8, [rsp + 0x48]
lea rdx, str.Child0000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d269
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.HardwareID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
test eax, eax
cmove r13d, ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
je 0x41d27d
cmp dword [rsp + 0x40], ebp
jne 0x41d2fc
mov r12, qword [rsi + 8]
mov dword [rsp + 0x40], 0x104
cmp r12, 0xffffffffffffffff
je 0x41d2fa
call fcn.00413910
mov dword [rsp + 0x30], 0x20019
lea r8, [rsi + 0x10]
mov r9d, ebx
mov rdx, r12
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebp
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x41d2fa
lea rax, [rsp + 0x40]
lea rdx, str.ChildID
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rdi
test eax, eax
cmove ebp, ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, ebp
mov r13, qword [rsp + 0x368]
mov r12, qword [rsp + 0x370]
mov rbp, qword [rsp + 0x388]
call fcn.004545a0
mov rsi, qword [rsp + 0x380]
test eax, eax
je 0x41d393
lea rdx, str.CDevNode::IsEnumDevice_:_bRetVal___d_n
lea rcx, [rsp + 0x150]
mov r8d, ebx
call fcn.00486850
xor eax, eax
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rax, [rsp + 0x150]
xor edx, edx
movzx ecx, byte [rax + rdx]
inc rdx
test cl, cl
mov byte [rdi + rdx - 2], cl
jne 0x41d365
call fcn.004546e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x378]
mov eax, ebx
mov rbx, qword [rsp + 0x390]
add rsp, 0x398
ret