Function at 0x140017110
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r14, rdx
xor r15d, r15d
mov ebp, r15d
mov word [rsp + 0x290], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x246]
call fcn.14009c4e0
call fcn.140055b68
mov rcx, rax
mov eax, r15d
test rcx, rcx
setne al
test eax, eax
jne 0x14001718f
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x1400e9c18]
or r12, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400171d3
movzx edi, dx
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x1400171f0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006090
jmp 0x1400171f0
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.1400062e0
nop
mov rcx, r14
call qword [sym.imp.USER32.dll_CharUpperW]
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001734e
mov dword [rsp + 0x58], SafeArrayDestroyData
mov r13d, r15d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140017345
nop
mov edi, r15d
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140017328
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400172e0
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_CharUpperW]
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.14009b200
test rax, rax
jne 0x1400172e5
lea edi, [rax + 1]
jmp 0x1400172e5
mov edi, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140017328
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rdi + 9]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140017328
add ebp, 1
add r13d, 1
lea r8, [rsp + 0x58]
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140017240
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14001736f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebp
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14009af10
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret