Function at 0x14005f700
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x398]
sub rsp, 0x470
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rbp + 0x58], 0xffffffff80000002
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.SYSTEMCurrentControlSetEnumUSBSTOR
test rdx, 0xffffffffffff0000
jne 0x14005f7a4
movzx edi, dx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005f7b5
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400029f0
jmp 0x14005f7b5
mov r8d, 0x25
lea rcx, [rsp + 0x48]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.SYSTEMCurrentControlSetEnumUSB
test rdx, 0xffffffffffff0000
jne 0x14005f800
movzx edi, dx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005f811
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400029f0
jmp 0x14005f811
mov r8d, 0x21
lea rcx, [rsp + 0x60]
call fcn.140002120
nop
mov rcx, rbx
call fcn.140053be0
lea rdx, [rbp + 0x58]
mov qword [rbp - 0x10], rdx
lea rax, [rbp + 0x58]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x28], r13
mov dword [rbp + 0x30], r13d
mov qword [rbp + 0x38], r13
mov r9d, 0x20019
mov r8, qword [rsp + 0x48]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x28]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
jne 0x14005f8c2
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14005f872
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x28], r13
mov dword [rbp + 0x30], r13d
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005f89b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14005f8bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x140060e4c
mov esi, r13d
or r12, 0xffffffffffffffff
mov dword [rbp - 0x74], 0x100
mov dword [rsp + 0x44], esi
lea rax, [rbp + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x74]
lea r8, [rbp + 0x160]
mov edx, esi
mov rdi, qword [rbp + 0x28]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x14005ffcf
test eax, eax
jne 0x14005ffcf
lea r8, [0x14012ed28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xd8]
call fcn.1400162e0
nop
lea r8, [rbp + 0x160]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400162e0
nop
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005f96b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov qword [rbp + 0x90], r13
mov dword [rbp + 0x98], r13d
mov qword [rbp + 0xa0], r13
mov r9d, 0x20019
mov r8, qword [rbp - 0x20]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x90]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
je 0x14005ffb7
mov r15d, r13d
mov dword [rbp - 0x78], 0x100
lea rax, [rbp + 0x158]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x160]
mov edx, r15d
mov rdi, qword [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x14005ff17
test eax, eax
jne 0x14005ff17
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x160]
lea r14, [rbp + 0x160]
shr r14, 0x10
test r14, r14
jne 0x14005fa61
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005fb58
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400029f0
mov rsi, qword [rsp + 0x50]
jmp 0x14005fb58
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14005fad6
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14005fb58
cmp dword [rdx + 0x10], eax
jge 0x14005faa8
cmp dword [rsi - 0xc], eax
jl 0x14005ff5d
mov dword [rsi - 0x10], r13d
mov word [rsi], r13w
jmp 0x14005fb58
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005fabf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
jmp 0x14005fb58
mov r13d, dword [rsi - 0x10]
lea rbx, [rbp + 0x160]
sub rbx, rsi
sar rbx, 1
test ecx, ecx
js 0x14005ffac
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005fb11
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.1400020c0
mov rsi, qword [rsp + 0x50]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp rbx, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x14005fb35
lea r8, [rsi + rbx*2]
call fcn.1400d4ebc
jmp 0x14005fb41
lea r8, [rbp + 0x160]
call fcn.1400d4e34
cmp edi, dword [rsi - 0xc]
jg 0x14005ffa1
mov dword [rsi - 0x10], edi
xor ecx, ecx
mov word [r13 + rsi], cx
xor r13d, r13d
mov edx, dword [rsi - 0x10]
mov eax, r13d
cmp edx, 2
setg al
test eax, eax
je 0x14005ff89
add edx, 0xfffffffe
mov r8d, 2
lea rcx, [rsp + 0x50]
call fcn.14005d700
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rax, str.FriendlyName
test rax, 0xffffffffffff0000
jne 0x14005fbe0
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005fbf3
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400029f0
jmp 0x14005fbf3
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x78], rsi
lea rax, [rbp + 0x160]
test r14, r14
jne 0x14005fc41
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005fd38
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400029f0
jmp 0x14005fd38
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14005fcb6
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14005fd38
cmp dword [rdx + 0x10], eax
jge 0x14005fc88
cmp dword [rsi - 0xc], eax
jl 0x14005ff68
mov dword [rsi - 0x10], r13d
mov word [rsi], r13w
jmp 0x14005fd38
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005fc9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
jmp 0x14005fd38
mov r13d, dword [rsi - 0x10]
lea rbx, [rbp + 0x160]
sub rbx, rsi
sar rbx, 1
test ecx, ecx
js 0x14005ff7e
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005fcf1
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.1400020c0
mov rsi, qword [rsp + 0x78]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp rbx, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x14005fd15
lea r8, [rsi + rbx*2]
call fcn.1400d4ebc
jmp 0x14005fd21
lea r8, [rbp + 0x160]
call fcn.1400d4e34
cmp edi, dword [rsi - 0xc]
jg 0x14005ff73
mov dword [rsi - 0x10], edi
xor ecx, ecx
mov word [r13 + rsi], cx
xor r13d, r13d
lea r8, [0x14012ed28]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x100]
call fcn.1400162e0
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.14001cad0
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x60]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140060e80
movzx edi, al
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov ecx, r12d
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14005fd9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005fdc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005fde3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005fe02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test dil, dil
je 0x14005fecb
mov ecx, 0x38
call fcn.1400d5224
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x14005fe2b
mov rcx, rax
call fcn.14004cba0
jmp 0x14005fe2e
mov rax, r13
mov qword [rbp + 0x10], rax
lea rbx, [rax + 0x10]
mov rdi, qword [rbp - 0x50]
lea rcx, [rdi - 0x18]
mov rsi, qword [rbx]
sub rsi, 0x18
cmp rcx, rsi
je 0x14005fe96
cmp dword [rsi + 0x10], 0
jl 0x14005fe87
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14005fe87
call fcn.140001d80
mov rdi, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14005fe7a
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + VariantCopy]
lea rax, [rdi + 0x18]
mov qword [rbx], rax
mov rdi, qword [rbp - 0x50]
jmp 0x14005fe96
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.140002120
lea r8, [rbp + 0x10]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.140053a90
nop
mov rsi, qword [rbp + 0x10]
test rsi, rsi
je 0x14005fec5
mov rcx, rsi
call fcn.140053040
mov rcx, rsi
call fcn.1400d4d78
mov qword [rbp + 0x10], r13
jmp 0x14005fed3
mov rdi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x80]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005feef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005ff0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc r15d
jmp 0x14005f9b0
test rdi, rdi
je 0x14005ff2c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x90], r13
mov dword [rbp + 0x98], r13d
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005ff52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov esi, dword [rsp + 0x44]
inc esi
jmp 0x14005f8c9
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov dword [rbp + 8], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp + 8]
call fcn.1400de560
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov dword [rbp + 0x1c], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp + 0x1c]
call fcn.1400de560
nop
mov esi, r13d
mov dword [rbp - 0x70], 0x100
mov dword [rsp + 0x44], esi
lea rax, [rbp + 0x128]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x160]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400606d8
test eax, eax
jne 0x1400606d8
lea r8, [0x14012ed28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x110]
call fcn.1400162e0
nop
lea r8, [rbp + 0x160]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400162e0
nop
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060070
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov qword [rbp + 0xa8], r13
mov dword [rbp + 0xb0], r13d
mov qword [rbp + 0xb8], r13
mov r9d, 0x20019
mov r8, qword [rbp - 0x18]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xa8]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
je 0x1400606c0
mov r15d, r13d
mov dword [rbp - 0x68], 0x100
lea rax, [rbp + 0x140]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x68]
lea r8, [rbp + 0x160]
mov edx, r15d
mov rdi, qword [rbp + 0xa8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x14006061c
test eax, eax
jne 0x14006061c
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x160]
lea r14, [rbp + 0x160]
shr r14, 0x10
test r14, r14
jne 0x140060166
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14006025d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400029f0
mov rsi, qword [rsp + 0x58]
jmp 0x14006025d
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x1400601db
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006025d
cmp dword [rdx + 0x10], eax
jge 0x1400601ad
cmp dword [rsi - 0xc], eax
jl 0x140060666
mov dword [rsi - 0x10], r13d
mov word [rsi], r13w
jmp 0x14006025d
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400601c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x58], rsi
jmp 0x14006025d
mov r13d, dword [rsi - 0x10]
lea rbx, [rbp + 0x160]
sub rbx, rsi
sar rbx, 1
test ecx, ecx
js 0x1400606b5
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140060216
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.1400020c0
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp rbx, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x14006023a
lea r8, [rsi + rbx*2]
call fcn.1400d4ebc
jmp 0x140060246
lea r8, [rbp + 0x160]
call fcn.1400d4e34
cmp edi, dword [rsi - 0xc]
jg 0x1400606aa
mov dword [rsi - 0x10], edi
xor ecx, ecx
mov word [r13 + rsi], cx
xor r13d, r13d
mov edx, dword [rsi - 0x10]
mov eax, r13d
cmp edx, 2
setg al
test eax, eax
je 0x140060692
add edx, 0xfffffffe
mov r8d, 2
lea rcx, [rsp + 0x58]
call fcn.14005d700
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rax, str.FriendlyName
test rax, 0xffffffffffff0000
jne 0x1400602e5
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x1400602f8
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400029f0
jmp 0x1400602f8
mov r8d, recv
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x160]
test r14, r14
jne 0x140060346
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14006043d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400029f0
jmp 0x14006043d
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x1400603bb
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14006043d
cmp dword [rdx + 0x10], eax
jge 0x14006038d
cmp dword [rsi - 0xc], eax
jl 0x140060671
mov dword [rsi - 0x10], r13d
mov word [rsi], r13w
jmp 0x14006043d
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400603a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
jmp 0x14006043d
mov r13d, dword [rsi - 0x10]
lea rbx, [rbp + 0x160]
sub rbx, rsi
sar rbx, 1
test ecx, ecx
js 0x140060687
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400603f6
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.1400020c0
mov rsi, qword [rsp + 0x70]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp rbx, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x14006041a
lea r8, [rsi + rbx*2]
call fcn.1400d4ebc
jmp 0x140060426
lea r8, [rbp + 0x160]
call fcn.1400d4e34
cmp edi, dword [rsi - 0xc]
jg 0x14006067c
mov dword [rsi - 0x10], edi
xor ecx, ecx
mov word [r13 + rsi], cx
xor r13d, r13d
lea r8, [0x14012ed28]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xc0]
call fcn.1400162e0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.14001cad0
nop
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x30]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140060e80
movzx edi, al
mov rdx, qword [rbp + 0x120]
add rdx, 0xffffffffffffffe8
mov ecx, r12d
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400604a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400604c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400604e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060507
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test dil, dil
je 0x1400605d0
mov ecx, 0x38
call fcn.1400d5224
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x140060530
mov rcx, rax
call fcn.14004cba0
jmp 0x140060533
mov rax, r13
mov qword [rbp], rax
lea rbx, [rax + 0x10]
mov rdi, qword [rbp - 0x40]
lea rcx, [rdi - 0x18]
mov rsi, qword [rbx]
sub rsi, 0x18
cmp rcx, rsi
je 0x14006059b
cmp dword [rsi + 0x10], 0
jl 0x14006058c
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14006058c
call fcn.140001d80
mov rdi, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006057f
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + VariantCopy]
lea rax, [rdi + 0x18]
mov qword [rbx], rax
mov rdi, qword [rbp - 0x40]
jmp 0x14006059b
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.140002120
lea r8, [rbp]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.140053a90
nop
mov rsi, qword [rbp]
test rsi, rsi
je 0x1400605ca
mov rcx, rsi
call fcn.140053040
mov rcx, rsi
call fcn.1400d4d78
mov qword [rbp], r13
jmp 0x1400605d8
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x80]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400605f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060614
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc r15d
jmp 0x1400600b5
test rdi, rdi
je 0x140060631
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xa8], r13
mov dword [rbp + 0xb0], r13d
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060657
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov esi, dword [rsp + 0x44]
inc esi
mov rdi, qword [rbp + 0x28]
jmp 0x14005ffd2
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov dword [rbp - 4], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp - 4]
call fcn.1400de560
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov dword [rbp + 0x20], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp + 0x20]
call fcn.1400de560
nop
test rdi, rdi
je 0x1400606ea
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x28], r13
mov dword [rbp + 0x30], r13d
mov eax, r13d
cmp qword [rbx + 8], 0
setne al
test eax, eax
jne 0x140060749
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006071e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14005f8bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x140060e4c
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x48], r13d
mov qword [rbp + 0x50], r13
mov r9d, 0x20019
mov rdi, qword [rsp + 0x60]
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x40]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
jne 0x1400607dd
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140060792
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x48], r13d
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400607b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14005f8bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x140060e4c
mov r15d, r13d
mov dword [rbp - 0x64], 0x100
lea rax, [rbp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x64]
lea r8, [rbp + 0x160]
mov edx, r15d
mov rdi, qword [rbp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140060df3
test eax, eax
jne 0x140060df3
lea r8, [0x14012ed28]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xd0]
call fcn.1400162e0
nop
lea r8, [rbp + 0x160]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400162e0
nop
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006087f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov qword [rbp + 0x78], r13
mov dword [rbp + 0x80], r13d
mov qword [rbp + 0x88], r13
mov r9d, 0x20019
mov r8, qword [rbp - 0x28]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
je 0x140060ddb
mov r14d, r13d
mov dword [rbp - 0x6c], 0x100
lea rax, [rbp + 0x138]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x6c]
lea r8, [rbp + 0x160]
mov edx, r14d
mov rdi, qword [rbp + 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140060d6b
test eax, eax
jne 0x140060d6b
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x160]
lea r13, [rbp + 0x160]
shr r13, 0x10
test r13, r13
jne 0x140060960
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140060988
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400029f0
jmp 0x140060988
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x68]
call fcn.140002120
nop
mov rax, qword [rsp + 0x68]
xor ecx, ecx
cmp dword [rax - 0x10], ecx
setne cl
test ecx, ecx
je 0x140060dc3
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdx, str.Service
lea rcx, [rbp + 0x60]
call fcn.140002ad0
nop
mov ebx, dword [rsp + 0x40]
or ebx, 1
mov dword [rsp + 0x40], ebx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rax, [rbp + 0x160]
test r13, r13
jne 0x140060a17
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140060a3e
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.1400029f0
jmp 0x140060a3e
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x58]
call fcn.140002120
nop
or ebx, 2
mov dword [rsp + 0x40], ebx
lea r8, [0x14012ed28]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x118]
call fcn.1400162e0
nop
or ebx, 4
mov dword [rsp + 0x40], ebx
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14001cad0
nop
or ebx, 8
mov dword [rsp + 0x40], ebx
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140060e80
test al, al
je 0x140060abc
xor eax, eax
lea rdi, str.USBSTOR
mov rsi, qword [rbp - 0x38]
mov ecx, 8
repe cmpsw word [rsi], word [rdi]
je 0x140060ab3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x140060abc
xor dil, dil
jmp 0x140060abf
mov dil, 1
test bl, 8
je 0x140060af1
and ebx, 0xfffffff7
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060aed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
test bl, 4
je 0x140060b23
and ebx, 0xfffffffb
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060b1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
test bl, 2
je 0x140060b52
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060b4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
test bl, 1
je 0x140060b7d
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060b7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test dil, dil
je 0x140060ba7
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060ba2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140060d40
xor esi, esi
mov qword [rbp + 0x68], rsi
lea r8, [rbp + 0x68]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp - 0x80]
call fcn.1400539e0
test al, al
je 0x140060d20
lea rdx, str.HardwareID
lea rcx, [rbp + 0x70]
call fcn.140002ad0
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x160]
test r13, r13
jne 0x140060c1d
movzx edi, ax
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140060c44
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400029f0
jmp 0x140060c44
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x48]
call fcn.140002120
nop
lea r8, [0x14012ed28]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xf8]
call fcn.1400162e0
nop
lea r8, [rbp - 0x48]
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.14001cad0
nop
mov r9, qword [rbp + 0x68]
add r9, 0x20
lea r8, [rbp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400610e0
mov edi, esi
test al, al
setne dil
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060cb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060cd9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060cf9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060d18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test edi, edi
je 0x140060dab
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060d40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060d60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc r14d
xor r13d, r13d
jmp 0x1400608be
test rdi, rdi
je 0x140060d7d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x78], r13
mov dword [rbp + 0x80], r13d
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060da3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc r15d
jmp 0x1400607e0
mov dword [rbp - 8], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp - 8]
call fcn.1400de560
nop
mov dword [rbp + 0xc], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp + 0xc]
call fcn.1400de560
nop
mov dword [rbp + 0x18], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rbp + 0x18]
call fcn.1400de560
nop
test rdi, rdi
je 0x140060e05
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x48], r13d
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140060e2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140060e4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov al, 1
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret