Function at 0x140012570
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15, rdx
mov dword [rsp + 0x40], 0x230
lea rdx, [rsp + 0x40]
mov r14, rcx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailW]
test eax, eax
je 0x140012ba0
mov qword [rsp + 0x2d0], rbx
lea r9, [rsp + 0x60]
mov qword [rsp + 0x2a0], rbp
lea rcx, [r15 + 4]
mov qword [rsp + 0x298], rsi
mov edx, 0x20019
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x280], r13
xor r13d, r13d
cmp word [rsp + 0x60], r13w
mov qword [rsp + 0x20], r13
cmove r9, r13
lea r8d, [r13 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov r12, 0xffffffffffffffff
mov rbp, rax
cmp rax, r12
je 0x1400127a3
mov ecx, 0x2004
call fcn.14001a57c
mov rdi, rax
test rax, rax
je 0x1400127a3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.UpperFilters
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400126e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140012703
cmp dword [rsp + 0x34], 7
jne 0x140012703
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.14001a574
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.14001a57c
mov rdi, rax
test rax, rax
je 0x1400127a3
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.UpperFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012664
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r13w
mov rcx, rdi
mov word [rdi + rax*2], r13w
call fcn.140010970
mov rsi, rax
test rax, rax
jne 0x14001270b
mov rcx, rdi
jmp 0x14001279e
cmp qword [rax], r13
je 0x14001278c
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
mov ecx, 1
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee07
call fcn.140010750
mov rdi, rsi
cmp qword [rsi], r13
je 0x14001278c
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x140012755
mov rdx, qword [rdi]
lea rcx, [0x1400436f0]
call fcn.140006740
add rdi, 8
cmp qword [rdi], r13
jne 0x140012750
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x14001279a
call fcn.14001a574
lea rcx, [rsi - 8]
call fcn.14001a574
mov r8d, 0x11
mov rdx, r15
mov rcx, r14
call fcn.140010c20
mov rsi, rax
test rax, rax
je 0x140012853
cmp qword [rax], r13
je 0x14001283c
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
mov ecx, 1
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee08
call fcn.140010750
mov rdi, rsi
cmp qword [rsi], r13
je 0x14001283c
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x140012805
mov rdx, qword [rdi]
lea rcx, [0x1400436f0]
call fcn.140006740
add rdi, 8
cmp qword [rdi], r13
jne 0x140012800
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x14001284a
call fcn.14001a574
lea rcx, [rsi - 8]
call fcn.14001a574
mov r8d, 4
mov rdx, r15
mov rcx, r14
call fcn.140010830
mov ecx, 1
mov rdi, rax
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
mov ecx, 1
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee09
call fcn.140010750
test rdi, rdi
je 0x1400128e0
cmp word [rdi], r13w
je 0x1400128e0
mov ebx, 2
nop word [rax + rax]
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x1400128b0
mov rdx, rdi
lea rcx, [0x1400436f0]
call fcn.140006740
jmp 0x140012919
mov ebx, 2
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x1400128e5
lea ecx, [rbx + 1]
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee0a
call fcn.140010750
test rdi, rdi
je 0x140012926
mov rcx, rdi
call fcn.14001a574
cmp rbp, r12
je 0x140012abc
mov ecx, 0x2004
call fcn.14001a57c
mov rdi, rax
test rax, rax
je 0x140012ab3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.LowerFilters
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400129f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140012a17
cmp dword [rsp + 0x34], 7
jne 0x140012a17
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.14001a574
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.14001a57c
mov rdi, rax
test rax, rax
je 0x140012ab3
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.LowerFilters
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012978
mov ecx, dword [rsp + 0x30]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r13w
mov rcx, rdi
mov word [rdi + rax*2], r13w
call fcn.140010970
mov rsi, rax
test rax, rax
jne 0x140012a1f
mov rcx, rdi
jmp 0x140012aae
cmp qword [rax], r13
je 0x140012a9c
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
mov ecx, 1
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee0b
call fcn.140010750
mov rdi, rsi
cmp qword [rsi], r13
je 0x140012a9c
nop dword [rax]
mov ebx, 2
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x140012a65
mov rdx, qword [rdi]
lea rcx, [0x1400436f0]
call fcn.140006740
add rdi, 8
cmp qword [rdi], r13
jne 0x140012a60
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140012aaa
call fcn.14001a574
lea rcx, [rsi - 8]
call fcn.14001a574
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x12
mov rdx, r15
mov rcx, r14
call fcn.140010c20
mov r13, qword [rsp + 0x280]
mov rsi, rax
mov r12, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2a0]
test rax, rax
je 0x140012b83
cmp qword [rax], 0
je 0x140012b6c
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
mov ecx, 1
call fcn.1400227cc
mov rcx, rax
mov edx, 0xee0c
call fcn.140010750
cmp qword [rsi], 0
mov rdi, rsi
je 0x140012b6c
mov ebx, 2
mov ecx, 1
call fcn.1400227cc
mov rdx, rax
lea rcx, [0x140043684]
call fcn.140022900
sub rbx, 1
jne 0x140012b35
mov rdx, qword [rdi]
lea rcx, [0x1400436f0]
call fcn.140006740
add rdi, 8
cmp qword [rdi], rbx
jne 0x140012b30
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x140012b7a
call fcn.14001a574
lea rcx, [rsi - 8]
call fcn.14001a574
mov rdi, qword [rsp + 0x290]
mov eax, 1
mov rsi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001a550
add rsp, 0x2a8
pop r15
pop r14
ret