Function at 0x100065b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x328
mov qword [rsp + 0x2f8], 0xfffffffffffffffe
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x318], rax
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x88]
call fcn.100014450
nop
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0xffffffffffffffff
lea rcx, [rsp + 0x90]
call fcn.100014450
nop
lea rcx, [rsp + 0xa0]
call fcn.100014450
nop
mov dword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x330]
call fcn.100013fb0
movzx eax, al
test eax, eax
jne 0x100065be2
mov rcx, qword [rsp + 0x330]
call fcn.1000488d0
movzx eax, al
test eax, eax
jne 0x100065c22
mov dword [rsp + 0x2c8], 0x57
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2c8]
jmp 0x1000660f4
cmp qword [rsp + 0x338], 0
jne 0x100065c6d
mov dword [rsp + 0x2cc], 0x57
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2cc]
jmp 0x1000660f4
mov rax, qword [rsp + 0x338]
mov dword [rax], 0
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x330]
call fcn.10006e1d0
test eax, eax
jne 0x100065cf0
mov rax, qword [rsp + 0x330]
mov r8, qword [rax]
lea rdx, [0x10000cb20]
mov ecx, 2
call fcn.100053cc0
mov dword [rsp + 0x2d0], 0
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2d0]
jmp 0x1000660f4
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x2e0], rax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x2e0]
call fcn.1000148e0
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.10006e390
test eax, eax
je 0x100065d59
mov r8, qword [rsp + 0x88]
lea rdx, [0x10000cae8]
mov ecx, 1
call fcn.100053cc0
jmp 0x100065d7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rsp + 0x88]
lea r8, [0x10000cab8]
mov edx, eax
mov ecx, 3
call fcn.100053dc0
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x88]
call fcn.1000482e0
movzx eax, al
test eax, eax
jne 0x100065de6
mov dword [rsp + 0x70], 0x57
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x2e8], eax
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2e8]
jmp 0x1000660f4
mov qword [rsp + 0x78], 0xffffffffffffffff
mov r9d, 6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0xffffffffffffffff
jne 0x100065e51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2ec], eax
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2ec]
jmp 0x1000660f4
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x40], 0x20
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x310], eax
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x310]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov ecx, dword [rsp + 0x68]
inc ecx
mov dword [rsp + 0x68], ecx
test eax, eax
je 0x10006603d
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x100066038
mov dword [rsp + 0x34], 0x208
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x10000caa8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100066024
lea rcx, [rsp + 0xa0]
call fcn.100013bb0
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0xb0]
mov edx, 1
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x100066024
mov dword [rsp + 0x80], 0
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call fcn.1000683e0
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x100065f98
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
jmp 0x10006600c
call fcn.100053ca0
test eax, eax
je 0x10006600c
lea rcx, [rsp + 0x2c0]
call fcn.100014450
nop
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call fcn.100068ed0
test eax, eax
jne 0x100065fe9
mov r9, qword [rsp + 0x2c0]
lea r8, [0x10000ca50]
mov edx, dword [rsp + 0x6c]
mov ecx, 3
call fcn.100053dc0
jmp 0x100065fff
lea r8, [0x10000ca18]
mov edx, dword [rsp + 0x6c]
mov ecx, 3
call fcn.100053dc0
nop
lea rcx, [rsp + 0x2c0]
call fcn.1000144b0
cmp dword [rsp + 0x80], 0
je 0x100066024
mov rax, qword [rsp + 0x338]
mov dword [rax], 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], 0xffffffffffffffff
jmp 0x100065e61
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x100066050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov qword [rsp + 0x78], 0xffffffffffffffff
call fcn.100053ca0
test eax, eax
je 0x1000660b9
cmp dword [rsp + 0x98], 0
je 0x10006609d
mov rax, qword [rsp + 0x330]
mov r9, qword [rax]
mov r8d, dword [rsp + 0x98]
lea rdx, [0x10000c9c0]
mov ecx, 1
call fcn.100053cc0
jmp 0x1000660b9
mov rax, qword [rsp + 0x330]
mov r8, qword [rax]
lea rdx, [0x10000c970]
mov ecx, 1
call fcn.100053cc0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x2f0], eax
lea rcx, [rsp + 0xa0]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x90]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x318]
call fcn.100087ed0
add rsp, 0x328
ret