Function at 0x140011b30
Capabilities:
Query or enumerate registry value
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x140043110]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov qword [rsp + 0x58], rcx
xor r12d, r12d
lea rcx, [rbp + 0x1e2]
xor edx, edx
mov r8d, 0x7fe
mov r13d, r12d
mov word [rbp + 0x1e0], r12w
call fcn.1400140c0
lea rcx, [rsp + 0x60]
mov ebx, r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x68], rbx
call fcn.1400126b0
lea r8, str.SOFTWAREIntelIGFXDPP_
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], r12d
mov qword [rbp - 0x80], r12
call fcn.140005dc0
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x140011d73
lea rax, [rsp + 0x48]
lea r9, [rbp - 0x58]
lea rdx, str.NumApps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, r12d
cmp dword [rsp + 0x34], ebx
jbe 0x140011d5d
movabs r15, 0x555555555555554
nop word [rax + rax]
lea rcx, [rbp - 0x2e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x30], r12w
call fcn.1400140c0
inc r14d
lea r8, str.ApplicationName_d
lea rcx, [rbp + 0x1e0]
mov r9d, r14d
mov edx, 0x400
call fcn.140016cf0
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x1e0]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011cc7
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 1
ja 0x140011cc7
cmp dword [rsp + 0x38], r12d
jne 0x140011cc7
movzx eax, r12w
mov word [rbp - 0x30], ax
jmp 0x140011ccb
movzx eax, word [rbp - 0x30]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
test ax, ax
jne 0x140011ce6
mov r8, r12
jmp 0x140011cfa
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x140011cf0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140012980
mov r8, qword [rdi + 8]
lea r9, [rbp - 0x50]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.140011680
mov rcx, rax
mov rax, r15
sub rax, rbx
cmp rax, 1
jb 0x14001243a
mov qword [rdi + 8], rcx
mov rax, qword [rcx + 8]
inc rbx
mov qword [rax], rcx
cmp qword [rbp - 0x38], 8
mov qword [rsp + 0x68], rbx
jb 0x140011d52
mov rcx, qword [rbp - 0x50]
call fcn.140013100
cmp r14d, dword [rsp + 0x34]
jb 0x140011c40
test rsi, rsi
je 0x140011d73
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x70], r12
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400123a0
nop
mov ecx, 0x18
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x140011db7
lea rcx, str.SELECT__FROM_Win32_ProcessStartTrace_where_ProcessName
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140011dba
jmp 0x14001242f
mov rdi, r12
mov qword [rsp + 0x40], rdi
test rdi, rdi
je 0x14001250d
cmp qword [rbx + 0x28], 8
lea r15, [rbx + 0x10]
jb 0x140011dd8
mov r14, qword [r15]
jmp 0x140011ddb
mov r14, r15
mov ecx, 0x18
call fcn.140014460
mov rsi, rax
test rax, rax
je 0x140011e13
mov rcx, r14
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140011e16
test r14, r14
je 0x140011e16
jmp 0x140012447
mov rsi, r12
mov qword [rbp - 0x60], rsi
test rsi, rsi
je 0x140012502
mov ecx, 0x18
call fcn.140014460
test rax, rax
je 0x1400124f7
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140011700
mov r14, rax
test rax, rax
je 0x1400124f7
lock dec dword [rdi + 0x10]
jne 0x140011e84
mov rcx, qword [rdi]
test rcx, rcx
je 0x140011e6a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140011e7c
call fcn.140013208
mov qword [rdi + 8], r12
mov rcx, rdi
call fcn.140013100
mov qword [rsp + 0x40], r14
lock dec dword [rsi + 0x10]
jne 0x140011eba
mov rcx, qword [rsi]
test rcx, rcx
je 0x140011ea0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140011eb2
call fcn.140013208
mov qword [rsi + 8], r12
mov rcx, rsi
call fcn.140013100
mov ecx, 0x18
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x140011ef1
lea rcx, [0x140031c24]
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140011ef4
jmp 0x140012452
mov rdi, r12
mov qword [rbp - 0x70], rdi
test rdi, rdi
je 0x1400124ec
mov ecx, 0x18
call fcn.140014460
test rax, rax
je 0x1400124e1
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140011700
mov r12, rax
test rax, rax
je 0x1400124e1
lock dec dword [r14 + 0x10]
jne 0x140011f6b
mov rcx, qword [r14]
test rcx, rcx
je 0x140011f4d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140011f63
call fcn.140013208
mov qword [r14 + 8], 0
mov rcx, r14
call fcn.140013100
lock dec dword [rdi + 0x10]
jne 0x140011fa4
mov rcx, qword [rdi]
test rcx, rcx
je 0x140011f86
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140011f9c
call fcn.140013208
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140013100
mov r13, qword [rsp + 0x58]
mov r14, qword [r12]
mov ecx, 0x18
mov rsi, qword [r13 + 0x18]
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x1400124d6
lea rcx, [0x140031c28]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov qword [rdi], rax
test rax, rax
je 0x1400124cb
mov rax, qword [rsi]
xor r9d, r9d
mov r8, r14
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
call qword [rax + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x14001204e
mov rcx, qword [rdi]
test rcx, rcx
je 0x140012030
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140012046
call fcn.140013208
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140013100
test r13d, r13d
js 0x140012348
mov ecx, 0x18
call fcn.140014460
xor r13d, r13d
mov rsi, rax
test rax, rax
je 0x140012091
lea rcx, [0x140031c30]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140012094
jmp 0x14001245d
mov rsi, r13
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x1400124c0
cmp qword [r15 + 0x18], 8
jb 0x1400120ac
mov r15, qword [r15]
mov ecx, 0x18
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x1400120e4
mov rcx, r15
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400120e7
test r15, r15
je 0x1400120e7
jmp 0x140012468
mov rdi, r13
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x1400124b5
mov ecx, 0x18
call fcn.140014460
test rax, rax
je 0x1400124aa
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140011700
mov r14, rax
test rax, rax
je 0x1400124aa
lock dec dword [rsi + 0x10]
jne 0x140012155
mov rcx, qword [rsi]
test rcx, rcx
je 0x14001213b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001214d
call fcn.140013208
mov qword [rsi + 8], r13
mov rcx, rsi
call fcn.140013100
mov qword [rsp + 0x50], r14
lock dec dword [rdi + 0x10]
jne 0x14001218b
mov rcx, qword [rdi]
test rcx, rcx
je 0x140012171
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140012183
call fcn.140013208
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.140013100
mov ecx, 0x18
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x1400121c2
lea rcx, [0x140031c24]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400121c5
jmp 0x140012473
mov rdi, r13
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x14001249f
mov ecx, 0x18
call fcn.140014460
test rax, rax
je 0x140012494
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140011700
mov rsi, rax
test rax, rax
je 0x140012494
lock dec dword [r14 + 0x10]
jne 0x140012234
mov rcx, qword [r14]
test rcx, rcx
je 0x14001221a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14001222c
call fcn.140013208
mov qword [r14 + 8], r13
mov rcx, r14
call fcn.140013100
lock dec dword [rdi + 0x10]
jne 0x140012265
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001224b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001225d
call fcn.140013208
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.140013100
mov r13, qword [rsp + 0x58]
mov r15, qword [rsi]
mov ecx, 0x18
mov r14, qword [r13 + 0x18]
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x140012489
lea rcx, [0x140031c28]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14001247e
mov r10, qword [r14]
xor r9d, r9d
mov r8, r15
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
call qword [r10 + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x14001230f
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400122f1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140012307
call fcn.140013208
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140013100
lock dec dword [rsi + 0x10]
jne 0x140012348
mov rcx, qword [rsi]
test rcx, rcx
je 0x14001232a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140012340
call fcn.140013208
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.140013100
lock dec dword [r12 + 0x10]
jne 0x140012387
mov rcx, qword [r12]
test rcx, rcx
je 0x140012367
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14001237f
call fcn.140013208
mov qword [r12 + 8], 0
mov rcx, r12
call fcn.140013100
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x60]
xor r12d, r12d
cmp rbx, rdi
jne 0x140011d80
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x1400123ae
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rbx, rdi
je 0x1400123f4
nop dword [rax]
cmp qword [rbx + 0x28], 8
mov rsi, qword [rbx]
jb 0x1400123d3
mov rcx, qword [rbx + 0x10]
call fcn.140013100
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r12
mov rcx, rbx
mov word [rbx + 0x10], r12w
call fcn.140013100
mov rbx, rsi
cmp rsi, rdi
jne 0x1400123c0
mov rcx, rdi
call fcn.140013100
mov eax, r13d
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.140013b10
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140012e10
int3
lea rcx, str.list_T__too_long
call fcn.140028594
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3
mov ecx, 0x8007000e
call fcn.140012e10
int3