Function at 0x1400a4d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xb60
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0xb50], rax
xor ebx, ebx
mov r15d, ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0xb0], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x120]
call fcn.1401d04f0
mov dword [rsp + 0xd8], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x540]
call fcn.1401d04f0
mov dword [rsp + 0xdc], 0x208
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc8], rbx
mov r14d, 7
mov qword [rsp + 0xd0], r14
mov word [rsp + 0xb8], bx
lea r9d, [rbx + 2]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14023e408]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400a4f64
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a4ee0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4edb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59ae
call fcn.1401a9a50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a4f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59b4
call fcn.1401a9a50
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a597c
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
mov dword [rsp + 0x100], 0x20
mov r12d, ebx
mov dword [rsp + 0x44], ebx
lea rax, str.Display
mov qword [rsp + 0x50], rax
lea rax, [0x14023d288]
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xb8]
nop dword [rax]
lea r8, [rsp + 0x100]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400a5879
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0x100]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, 1
jne 0x1400a586c
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x750]
call fcn.1401d04f0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x950]
call fcn.1401d04f0
lea rax, [rsp + 0x330]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a5040
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x70]
call fcn.140018360
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
setae r11b
mov r10, qword [rsp + 0x70]
cmovae rdx, r10
mov r9, qword [rsp + 0x80]
test r9, r9
je 0x1400a50ba
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdx + rax*2]
cmp word [r8], 0x5c
je 0x1400a50b2
cmp r8, rdx
je 0x1400a50ba
sub r8, 2
cmp word [r8], 0x5c
jne 0x1400a50a2
sub r8, rdx
sar r8, 1
jmp 0x1400a50c1
mov r8, 0xffffffffffffffff
cmp r8, 0xffffffffffffffff
je 0x1400a5139
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 7
cmp r9, r8
cmovb r8, r9
lea rdx, [rsp + 0x70]
test r11b, r11b
cmovne rdx, r10
lea rcx, [rsp + 0xe0]
call fcn.140018360
or r15d, 1
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x90]
call fcn.1400272a0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xa0], xmm1
lea r8, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r8, qword [rsp + 0x90]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0x750]
call fcn.1400a4440
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x750]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a52af
cmp r14, 8
jb 0x1400a51d2
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a51ca
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59ba
mov rcx, rdi
call fcn.1401a9a50
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a522b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5226
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c0
call fcn.1401a9a50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a528c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c6
call fcn.1401a9a50
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a597c
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.Class
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a586c
lea rax, [rsp + 0x120]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a5300
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xb8]
call fcn.140018360
lea r11, [rsp + 0xb8]
mov r14, qword [rsp + 0xd0]
cmp r14, 8
setae r13b
mov rdi, qword [rsp + 0xb8]
cmovae r11, rdi
mov rax, qword [rsp + 0xc8]
cmp rax, 7
jb 0x1400a586c
add rax, 0xfffffffffffffffa
lea rsi, [r11 + rax*2]
mov rax, r11
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov rdx, rbx
je 0x1400a538b
cmp word [rax], 0x44
je 0x1400a5388
cmp rcx, 1
je 0x1400a538b
dec rcx
add rax, 2
cmp word [rax], 0x44
jne 0x1400a5375
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400a5867
mov r9d, 7
lea rdx, str.Display
movzx ecx, word [rax]
mov r8d, MsiGetPropertyW
cmp cx, r8w
jb 0x1400a53dd
mov r10, rax
sub r10, qword [rsp + 0x50]
cmp cx, r8w
ja 0x1400a53dd
cmp r9, 1
je 0x1400a53e6
dec r9
add rdx, 2
movzx ecx, word [r10 + rdx]
movzx r8d, word [rdx]
cmp cx, r8w
jae 0x1400a53bf
add rax, 2
jmp 0x1400a5361
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400a5867
lea r8, [rsp + 0x330]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0x950]
call fcn.1400a4440
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x950]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a5559
test r13b, r13b
je 0x1400a547c
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a5474
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59ba
mov rcx, rdi
call fcn.1401a9a50
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a54d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a54d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c0
call fcn.1401a9a50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a5536
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5531
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c6
call fcn.1401a9a50
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
xor eax, eax
jmp 0x1400a597c
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x540]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.ProviderName
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a5867
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 7
lea rax, [rsp + 0x540]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a55c3
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0xe0]
call fcn.140018360
lea rsi, [rsp + 0xe0]
mov r14, qword [rsp + 0xf8]
cmp r14, 8
setae r15b
mov r8, qword [rsp + 0xe0]
cmovae rsi, r8
mov rax, qword [rsp + 0xf0]
cmp rax, 0x1c
jb 0x1400a5820
add rax, 0xffffffffffffffe5
lea r12, [rsi + rax*2]
mov rax, rsi
nop dword [rax]
nop dword [rax + rax]
mov rcx, r12
sub rcx, rax
sar rcx, 1
mov rdx, rbx
je 0x1400a565a
cmp word [rax], 0x41
je 0x1400a5657
cmp rcx, 1
je 0x1400a565a
dec rcx
add rax, 2
cmp word [rax], 0x41
jne 0x1400a5644
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400a581b
mov r10d, 0x1c
lea r9, [0x14023d288]
movzx ecx, word [rdx]
mov edx, 0x41
cmp cx, dx
jb 0x1400a56a8
mov r11, rax
sub r11, qword [rsp + 0x58]
cmp cx, dx
ja 0x1400a56a8
cmp r10, 1
je 0x1400a56ae
dec r10
add r9, 2
movzx ecx, word [r9 + r11]
movzx edx, word [r9]
cmp cx, dx
jae 0x1400a568b
add rax, 2
jmp 0x1400a5630
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400a581b
test r15b, r15b
je 0x1400a56f9
lea rdx, [r14*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400a56f0
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59cc
mov rcx, r8
call fcn.1401a9a50
nop
test r13b, r13b
je 0x1400a573b
mov rdx, qword [rsp + 0xd0]
lea rdx, [rdx*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a5733
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59ba
mov rcx, rdi
call fcn.1401a9a50
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a5794
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a578f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c0
call fcn.1401a9a50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a57f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a57f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59c6
call fcn.1401a9a50
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], bx
mov eax, 1
jmp 0x1400a597c
mov r12d, dword [rsp + 0x44]
test r15b, r15b
je 0x1400a585a
lea rdx, [r14*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400a5852
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59cc
mov rcx, r8
call fcn.1401a9a50
mov r15d, dword [rsp + 0x40]
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0x48]
inc r12d
mov dword [rsp + 0x44], r12d
jmp 0x1400a4fb0
jmp 0x1400a5892
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
cmp r14, 8
jb 0x1400a58d8
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a58cf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59d2
mov rcx, rdi
call fcn.1401a9a50
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a591d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59d8
call fcn.1401a9a50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x1400a597a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5975
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a59de
call fcn.1401a9a50
xor eax, eax
mov rcx, qword [rsp + 0xb50]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0xb60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3