Function at 0x140017280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x900]
sub rsp, 0xa00
mov rax, qword [0x14023c048]
xor rax, rsp
mov qword [rbp + 0x8f0], rax
xor edi, edi
lea rcx, [rbp + 0xf0]
xor edx, edx
mov dword [rsp + 0x30], edi
mov r8d, 0x800
mov dword [rsp + 0x34], edi
mov r15d, edi
call fcn.140167e60
xor edx, edx
mov dword [rsp + 0x4c], 0x800
mov r8d, 0x100
lea rcx, [rsp + 0x34]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeW]
test eax, eax
je 0x1400172fe
mov r8d, eax
lea rdx, str.unexpected_error__CM_Get_Device_ID_List_Size_return_Value_of__lu
lea ecx, [rdi + 2]
call fcn.140013600
xor eax, eax
jmp 0x140017638
mov r8d, dword [rsp + 0x34]
mov rax, qword [0x140256dc8]
add r8, r8
mov qword [rsp + 0xa30], r14
test rax, rax
jne 0x140017320
lea r8d, [rax + 6]
jmp 0x14001733e
mov rcx, qword [0x140256dc8]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x140017356
lea r8d, [rax + 0xe]
lea rdx, str.unexpected_error__failed_to_allocate_memory_to_the_device_list__err_d
mov ecx, 2
call fcn.140013600
xor eax, eax
jmp 0x140017630
mov r8d, dword [rsp + 0x34]
mov r9d, 0x100
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListW]
test eax, eax
je 0x140017393
mov r8d, eax
lea rdx, str.unexpected_error__CM_Get_Device_ID_List_return_Value_of__lu
mov ecx, 2
call fcn.140013600
mov rcx, r14
call fcn.1400137a0
xor eax, eax
jmp 0x140017630
mov qword [rsp + 0xa20], rbx
mov qword [rsp + 0xa28], rsi
mov rsi, r14
cmp di, word [r14]
je 0x140017498
xor edx, edx
mov dword [rsp + 0x48], edi
mov r8d, 0x190
lea rcx, [rsp + 0x60]
call fcn.140167e60
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeW]
test eax, eax
jne 0x140017573
xor edx, edx
mov dword [rsp + 0x38], 0x190
mov r8d, 0x190
lea rcx, [rsp + 0x60]
call fcn.140167e60
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], edi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [0x1401e51d0]
call qword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_PropertyW]
test eax, eax
je 0x140017432
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001747a
mov edx, 0x3e
lea rcx, str.SWCVID_8086PID_PIESID_0001
call fcn.14016b024
mov rbx, rax
lea rcx, [rsp + 0x60]
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
add bx, bx
call fcn.14016b024
add ax, ax
cmp ax, bx
jb 0x14001747a
lea rdx, str.SWCVID_8086PID_PIESID_0001
lea rcx, [rsp + 0x60]
call fcn.140168208
test rax, rax
jne 0x140017568
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
mov rcx, rsi
call fcn.14016b024
lea rsi, [rsi + rax*2]
add rsi, 2
cmp di, word [rsi]
jne 0x1400173b0
mov rax, qword [0x140256dc8]
test rax, rax
je 0x1400174b6
mov rcx, qword [0x140256dc8]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15d, r15d
je 0x14001761e
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 1
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x20019
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.SETUPAPI.dll_CM_Open_DevNode_Key]
mov r8d, eax
mov rax, qword [rsp + 0x40]
test r8d, r8d
jne 0x14001760a
test rax, rax
je 0x14001760a
lea rcx, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x50]
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
lea rdx, str.PiePathHint
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
test ebx, ebx
je 0x1400175af
xor r8d, r8d
lea rdx, str.unexpected_error__GetRegKeyWCHARValue_return_Value_of__lu
lea ecx, [r8 + 2]
call fcn.140013600
jmp 0x14001761e
mov r15d, 1
jmp 0x140017498
mov r8d, eax
lea rdx, str.unexpected_error__CM_Locate_DevNode_return_Value_of__lu
mov ecx, 2
call fcn.140013600
mov rax, qword [0x140256dc8]
mov dword [rsp + 0x30], edi
test rax, rax
je 0x14001761e
mov rcx, qword [0x140256dc8]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001761e
lea rcx, [rbp + 0xf0]
call fcn.140016880
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
jne 0x1400175fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0xf0]
mov ecx, 2
mov r9d, eax
lea rdx, str.unexpected_error__Muroc_LoadLibrary__ws__Failed._le__0x_08lx
call fcn.140013600
mov eax, edi
jmp 0x140017620
mov edi, 1
mov qword [0x140256de8], rax
mov eax, edi
jmp 0x140017620
mov r9, rax
lea rdx, str.unexpected_error__CM_Open_DevNode_Key_return_Value_0x_08lx__software_key___p_n
mov ecx, 2
call fcn.140013600
xor eax, eax
mov rsi, qword [rsp + 0xa28]
mov rbx, qword [rsp + 0xa20]
mov r14, qword [rsp + 0xa30]
mov rcx, qword [rbp + 0x8f0]
xor rcx, rsp
call fcn.140149290
add rsp, 0xa00
pop r15
pop rdi
pop rbp
ret