Function at 0x14001ffd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xac0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xab0], rax
mov rdi, rcx
mov r13d, 1
mov dword [rsp + 0x3c], r13d
call fcn.1400696cc
mov rcx, rax
xor ebp, ebp
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x14002003c
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x8b0]
call fcn.140080d50
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x6b0]
call fcn.140080d50
lea r9, [0x1400a7958]
mov r8, rdi
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.LPTENUM
mov r8, rdi
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
or r15, 0xffffffffffffffff
mov rcx, r15
lea rdi, [0x1400a4120]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1400a4120]
lea rcx, [rsp + 0x30]
call fcn.140003c40
mov esi, ebp
mov dword [rsp + 0x48], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x6b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14, [0x1400a7944]
test eax, eax
jne 0x140020823
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0xb0]
call fcn.140080d50
mov ebx, ebp
mov dword [rsp + 0x38], ebx
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1400205c1
nop
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020551
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x2b0]
call fcn.140080d50
mov edi, ebp
mov r9d, 0xfc
lea r8, [rsp + 0x2b0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140020289
nop
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020250
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0x1f8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.DeviceDesc
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020254
lea rcx, [rsp + 0x4b0]
call fcn.14001d0e0
mov esi, eax
jmp 0x140020254
mov dword [rsp + 0x3c], ebp
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
mov r9d, 0xfc
lea r8, [rsp + 0x2b0]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400201d0
mov dword [rsp + 0x48], esi
test esi, esi
je 0x14002053f
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
lea r12, [rsp + 0xb0]
lea rbx, [rsp + 0xb0]
mov rsi, qword [rsp + 0x30]
sub rbx, rsi
sar rbx, 1
mov r13d, dword [rsi - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, edx
jge 0x1400202ee
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rsi, qword [rsp + 0x30]
cmp rbx, r13
ja 0x1400202f7
lea r12, [rsi + rbx*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rsi + r13*2]
mov r9, rdx
mov r8, r12
call fcn.140080540
test edi, edi
js 0x1400205af
cmp edi, dword [rsi - 0xc]
jg 0x1400205af
lea r14, [rsi - 0x10]
mov dword [r14], edi
movsxd rax, edi
mov word [rsi + rax*2], 0
lea rax, [rsi - 0x18]
mov qword [rsp + 0x88], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14002034f
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140020360
call fcn.1400696cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
je 0x1400205a4
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
lea r12, [0x1400a7940]
test r12, 0xffffffffffff0000
jne 0x1400203bd
movzx ebx, r12w
mov ecx, ebx
call fcn.1400696b8
test rax, rax
je 0x140020491
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140003a40
mov rdi, qword [rsp + 0x68]
jmp 0x140020491
call qword [str.L__n_]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov r9d, r15d
mov r8, r12
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebx, [rax - 1]
test ebx, ebx
jle 0x14002043b
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140020405
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140003180
mov rdi, qword [rsp + 0x68]
call qword [str.L__n_]
mov ecx, eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, r15d
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp ebx, dword [rdi - 0xc]
jg 0x140020583
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], 0
jmp 0x140020491
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140020491
cmp dword [rdx + 0x10], 0
jge 0x140020462
cmp dword [rdi - 0xc], 0
jl 0x14002058e
mov dword [rdi - 0x10], ebp
mov word [rdi], 0
jmp 0x140020491
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002047a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rsi, qword [rsp + 0x30]
movsxd r15, dword [rdi - 0x10]
mov r13, rdi
mov r12, rdi
sub r12, rsi
sar r12, 1
mov r14d, dword [r14]
lea ebx, [r14 + r15]
mov ecx, 1
mov rax, qword [rsp + 0x88]
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400204d2
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rsi, qword [rsp + 0x30]
cmp r12, r14
ja 0x1400204db
lea r13, [rsi + r12*2]
mov rdx, r15
add rdx, rdx
lea rcx, [rsi + r14*2]
mov r9, rdx
mov r8, r13
call fcn.140080540
test ebx, ebx
js 0x140020599
cmp ebx, dword [rsi - 0xc]
jg 0x140020599
mov dword [rsi - 0x10], ebx
movsxd rax, ebx
mov word [rsi + rax*2], 0
lea rdx, [rdi - 0x18]
or r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140020537
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x38]
jmp 0x14002053f
mov esi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, dword [rsp + 0x3c]
jmp 0x140020558
mov r13d, ebp
mov dword [rsp + 0x3c], ebp
add ebx, 1
mov dword [rsp + 0x38], ebx
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
mov edx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1400205ba
jmp 0x140020160
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
lea r14, [0x1400a7944]
mov rdi, qword [rsp + 0x30]
lea rbx, [rdi - 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400205e0
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400205f1
call fcn.1400696cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140020608
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x70], rsi
test r14, 0xffffffffffff0000
jne 0x14002064f
movzx r12d, r14w
mov ecx, r12d
call fcn.1400696b8
test rax, rax
je 0x140020739
mov r8d, r12d
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003a40
mov rsi, qword [rsp + 0x70]
jmp 0x140020739
call qword [str.L__n_]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov r9d, r15d
mov r8, r14
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r12d, [rax - 1]
test r12d, r12d
jle 0x1400206db
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14002069b
mov edx, r12d
lea rcx, [rsp + 0x70]
call fcn.140003180
mov rsi, qword [rsp + 0x70]
call qword [str.L__n_]
mov ecx, eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
mov r9d, r15d
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp r12d, dword [rsi - 0xc]
jg 0x1400206d0
mov dword [rsi - 0x10], r12d
movsxd rax, r12d
mov word [rsi + rax*2], 0
jmp 0x140020739
mov ecx, 0x80070057
call fcn.140001000
int3
lea rdx, [rsi - 0x18]
mov r12, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140020739
cmp dword [rdx + 0x10], 0
jge 0x140020709
cmp dword [rsi - 0xc], 0
jge 0x1400206ff
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rsi - 0x10], ebp
mov word [rsi], 0
jmp 0x140020739
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140020721
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x70], rsi
mov rdi, qword [rsp + 0x30]
mov eax, ebp
test rsi, rsi
setne al
test eax, eax
jne 0x140020750
mov ecx, 0x80004005
call fcn.140001000
int3
mov rcx, rsi
sub rcx, rdi
movzx eax, word [rdi]
cmp ax, word [rdi + rcx]
jne 0x14002076c
add rdi, 2
test ax, ax
jne 0x140020756
mov eax, ebp
jmp 0x140020771
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne dil
lea rdx, [rsi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140020793
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140020816
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x1400207b9
cmp rax, qword [rbx]
jne 0x1400207b9
mov rdi, rbx
lock add dword [rbx + 0x10], 1
jmp 0x1400207f8
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x1400207d5
call fcn.1400019f0
int3
mov eax, dword [rbx + 8]
mov dword [rdi + 8], eax
mov eax, dword [rbx + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.140080540
lea rax, [rdi + 0x18]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
call fcn.140019870
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002082a
mov r13d, ebp
mov dword [rsp + 0x3c], ebp
xor eax, eax
mov rcx, r15
lea rdi, [0x1400a4120]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400208ab
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140020938
cmp dword [rdx + 0x10], eax
jge 0x14002087c
cmp dword [rbx - 0xc], eax
jge 0x140020871
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], ebp
mov word [rbx], ax
jmp 0x140020938
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140020894
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x140020938
mov rbx, qword [rsp + 0x30]
mov esi, dword [rbx - 0x10]
lea r12, [0x1400a4120]
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400208e2
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r12, rsi
ja 0x140020902
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140081c40
jmp 0x14002091e
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [0x1400a4120]
mov rdx, rsi
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x14002144d
cmp edi, dword [rbx - 0xc]
jg 0x14002144d
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
mov edi, ebp
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesClassPrinter
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020c96
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0xb0]
call fcn.140080d50
mov r15d, ebp
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140020bdf
nop
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020a67
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0x1f8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020a67
lea rcx, [rsp + 0x4b0]
call fcn.14001d0e0
mov edi, eax
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140020b9b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
lea r12, [rsp + 0xb0]
lea rsi, [rsp + 0xb0]
sub rsi, rbx
sar rsi, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x140020ad3
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rsi, r13
ja 0x140020adc
lea r12, [rbx + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r12
call fcn.140080540
test edi, edi
js 0x140020bcf
cmp edi, dword [rbx - 0xc]
jg 0x140020bcf
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400a5110]
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
lea r12, [0x1400a5110]
lea rsi, [0x1400a5110]
sub rsi, rbx
sar rsi, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x140020b64
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rsi, r13
ja 0x140020b6d
lea r12, [rbx + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r12
call fcn.140080540
test edi, edi
js 0x140020bc4
cmp edi, dword [rbx - 0xc]
jg 0x140020bc4
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
mov edi, dword [rsp + 0x38]
add r15d, 1
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
mov edx, r15d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140020bda
jmp 0x1400209b0
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov r13d, dword [rsp + 0x3c]
xor eax, eax
lea rdi, [0x1400a4120]
mov rsi, rbx
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x140020bfa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140020c92
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140020c30
cmp rax, qword [rbx - 0x18]
jne 0x140020c30
lea rsi, [rbx - 0x18]
lock add dword [rbx - 8], 1
mov rbx, qword [rsp + 0x30]
jmp 0x140020c6e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x140020c4c
call fcn.1400019f0
int3
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.140080540
lea rax, [rsi + 0x18]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
call fcn.140019870
or r15, 0xffffffffffffffff
jmp 0x140020c96
or r15, 0xffffffffffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, r15
lea rdi, [0x1400a4120]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140020d1d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140020da5
cmp dword [rdx + 0x10], eax
jge 0x140020cee
cmp dword [rbx - 0xc], eax
jge 0x140020ce3
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], ebp
mov word [rbx], ax
jmp 0x140020da5
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140020d06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x140020da5
mov esi, dword [rbx - 0x10]
lea r12, [0x1400a4120]
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140020d4f
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r12, rsi
ja 0x140020d6f
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140081c40
jmp 0x140020d8b
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [0x1400a4120]
mov rdx, rsi
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x140021442
cmp edi, dword [rbx - 0xc]
jg 0x140021442
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
mov esi, ebp
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.EnumUSBPRINT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002141e
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0xb0]
call fcn.140080d50
mov r12d, ebp
mov dword [rsp + 0x48], ebp
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140021284
nop
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140021218
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x2b0]
call fcn.140080d50
mov edi, ebp
mov r9d, 0xfc
lea r8, [rsp + 0x2b0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140020f49
nop
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020f10
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0x1f8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.DeviceDesc
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020f14
lea rcx, [rsp + 0x4b0]
call fcn.14001d0e0
mov esi, eax
jmp 0x140020f14
mov dword [rsp + 0x3c], ebp
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
mov r9d, 0xfc
lea r8, [rsp + 0x2b0]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x140020e90
mov dword [rsp + 0x38], esi
test esi, esi
je 0x140021206
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
lea r12, [rsp + 0xb0]
lea rsi, [rsp + 0xb0]
sub rsi, rbx
sar rsi, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x140020fa9
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rsi, r13
ja 0x140020fb2
lea r12, [rbx + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r12
call fcn.140080540
test edi, edi
js 0x140021279
cmp edi, dword [rbx - 0xc]
jg 0x140021279
lea r14, [rbx - 0x10]
mov dword [r14], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
lea rax, [rbx - 0x18]
mov qword [rsp + 0x88], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14002100a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002101b
call fcn.1400696cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
je 0x14002126e
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
lea r12, [0x1400a7940]
test r12, 0xffffffffffff0000
jne 0x140021078
movzx esi, r12w
mov ecx, esi
call fcn.1400696b8
test rax, rax
je 0x14002114c
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140003a40
mov rdi, qword [rsp + 0x60]
jmp 0x14002114c
call qword [str.L__n_]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov r9d, r15d
mov r8, r12
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
test esi, esi
jle 0x1400210f6
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400210c0
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.140003180
mov rdi, qword [rsp + 0x60]
call qword [str.L__n_]
mov ecx, eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov r9d, r15d
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, dword [rdi - 0xc]
jg 0x14002124d
mov dword [rdi - 0x10], esi
movsxd rax, esi
mov word [rdi + rax*2], 0
jmp 0x14002114c
lea rdx, [rdi - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14002114c
cmp dword [rdx + 0x10], 0
jge 0x14002111d
cmp dword [rdi - 0xc], 0
jl 0x140021258
mov dword [rdi - 0x10], ebp
mov word [rdi], 0
jmp 0x14002114c
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140021135
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
mov rbx, qword [rsp + 0x30]
movsxd r15, dword [rdi - 0x10]
mov r13, rdi
mov r12, rdi
sub r12, rbx
sar r12, 1
mov r14d, dword [r14]
lea esi, [r14 + r15]
mov ecx, 1
mov rax, qword [rsp + 0x88]
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x14002118d
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r12, r14
ja 0x140021196
lea r13, [rbx + r12*2]
mov rdx, r15
add rdx, rdx
lea rcx, [rbx + r14*2]
mov r9, rdx
mov r8, r13
call fcn.140080540
test esi, esi
js 0x140021263
cmp esi, dword [rbx - 0xc]
jg 0x140021263
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], 0
lea rdx, [rdi - 0x18]
or r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400211f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x48]
jmp 0x140021206
mov rbx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, dword [rsp + 0x3c]
jmp 0x14002121f
mov r13d, ebp
mov dword [rsp + 0x3c], ebp
add r12d, 1
mov dword [rsp + 0x48], r12d
mov r9d, 0xfc
lea r8, [rsp + 0xb0]
mov edx, r12d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140021284
jmp 0x140020e20
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002129e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400212af
call fcn.1400696cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x1400212c6
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x80], rdi
lea rdx, [0x1400a7944]
test rdx, 0xffffffffffff0000
jne 0x140021316
movzx r12d, dx
mov ecx, r12d
call fcn.1400696b8
test rax, rax
je 0x14002132b
mov r8d, r12d
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140003a40
mov rdi, qword [rsp + 0x80]
jmp 0x14002132b
lea rcx, [rsp + 0x80]
call fcn.14000fcf0
mov rdi, qword [rsp + 0x80]
mov eax, ebp
test rdi, rdi
setne al
test eax, eax
jne 0x140021342
mov ecx, 0x80004005
call fcn.140001000
int3
mov rcx, rdi
sub rcx, rbx
nop
nop
movzx eax, word [rbx]
cmp ax, word [rbx + rcx]
jne 0x140021364
add rbx, 2
test ax, ax
jne 0x140021350
jmp 0x140021369
sbb ebp, ebp
sbb ebp, 0xffffffff
test ebp, ebp
setne bl
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002138a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14002140c
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x1400213af
cmp rax, qword [rsi]
jne 0x1400213af
mov rdi, rsi
lock add dword [rsi + 0x10], 1
jmp 0x1400213ee
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x1400213cb
call fcn.1400019f0
int3
mov eax, dword [rsi + 8]
mov dword [rdi + 8], eax
mov eax, dword [rsi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.140080540
lea rax, [rdi + 0x18]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
call fcn.140019870
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x30]
jmp 0x140021421
mov r13d, ebp
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r15d
add r15d, 0xffffffff
test r15d, r15d
jg 0x14002143d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
jmp 0x140021458
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rsp + 0xab0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0xac0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret