Function at 0x140017550
Capabilities:
Query or enumerate registry value
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov qword [rsp + 0x40], rcx
xor r12d, r12d
lea rcx, [rbp + 0x1e2]
xor edx, edx
mov r8d, 0x7fe
mov r13d, r12d
mov word [rbp + 0x1e0], r12w
call fcn.140018f80
lea rcx, [rsp + 0x60]
mov ebx, r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x68], rbx
call fcn.14000e310
lea r8, str.SOFTWAREIntelIGFXDPP_
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], r12d
mov qword [rbp - 0x80], r12
call fcn.140005ff0
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x140017793
lea rax, [rsp + 0x58]
lea r9, [rbp - 0x70]
lea rdx, str.NumApps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, r12d
cmp dword [rsp + 0x34], ebx
jbe 0x14001777d
movabs r15, 0x555555555555554
nop word [rax + rax]
lea rcx, [rbp - 0x2e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x30], r12w
call fcn.140018f80
inc r14d
lea r8, str.ApplicationName_d
lea rcx, [rbp + 0x1e0]
mov r9d, r14d
mov edx, 0x400
call fcn.14001aad4
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x1e0]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400176e7
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x1400176e7
cmp dword [rsp + 0x38], r12d
jne 0x1400176e7
movzx eax, r12w
mov word [rbp - 0x30], ax
jmp 0x1400176eb
movzx eax, word [rbp - 0x30]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
test ax, ax
jne 0x140017706
mov r8, r12
jmp 0x14001771a
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x140017710
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000e940
mov r8, qword [rdi + 8]
lea r9, [rbp - 0x50]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.14000ac80
mov rcx, rax
mov rax, r15
sub rax, rbx
cmp rax, 1
jb 0x140017e60
mov qword [rdi + 8], rcx
mov rax, qword [rcx + 8]
inc rbx
mov qword [rax], rcx
cmp qword [rbp - 0x38], 8
mov qword [rsp + 0x68], rbx
jb 0x140017772
mov rcx, qword [rbp - 0x50]
call fcn.1400184c0
cmp r14d, dword [rsp + 0x34]
jb 0x140017660
test rsi, rsi
je 0x140017793
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x70], r12
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140017dc9
nop
mov ecx, 0x18
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x1400177d7
lea rcx, str.SELECT__FROM_Win32_ProcessStartTrace_where_ProcessName
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400177da
jmp 0x140017e55
mov rdi, r12
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x140017f33
cmp qword [rbx + 0x28], 8
lea r15, [rbx + 0x10]
jb 0x1400177f8
mov r14, qword [r15]
jmp 0x1400177fb
mov r14, r15
mov ecx, 0x18
call fcn.140019320
mov rsi, rax
test rax, rax
je 0x140017833
mov rcx, r14
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140017836
test r14, r14
je 0x140017836
jmp 0x140017e6d
mov rsi, r12
mov qword [rbp - 0x60], rsi
test rsi, rsi
je 0x140017f28
mov ecx, 0x18
call fcn.140019320
test rax, rax
je 0x140017f1d
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000b4a0
mov r14, rax
test rax, rax
je 0x140017f1d
lock dec dword [rdi + 0x10]
jne 0x1400178a4
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001788a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001789c
call fcn.1400197b0
mov qword [rdi + 8], r12
mov rcx, rdi
call fcn.1400184c0
mov qword [rsp + 0x48], r14
lock dec dword [rsi + 0x10]
jne 0x1400178da
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400178c0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400178d2
call fcn.1400197b0
mov qword [rsi + 8], r12
mov rcx, rsi
call fcn.1400184c0
mov ecx, 0x18
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x140017911
lea rcx, [0x140035ce4]
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017914
jmp 0x140017e78
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x140017f12
mov ecx, 0x18
call fcn.140019320
test rax, rax
je 0x140017f07
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000b4a0
mov r12, rax
test rax, rax
je 0x140017f07
lock dec dword [r14 + 0x10]
jne 0x14001798b
mov rcx, qword [r14]
test rcx, rcx
je 0x14001796d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140017983
call fcn.1400197b0
mov qword [r14 + 8], 0
mov rcx, r14
call fcn.1400184c0
lock dec dword [rdi + 0x10]
jne 0x1400179c4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400179a6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400179bc
call fcn.1400197b0
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184c0
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + 0x18]
test rsi, rsi
je 0x140017d71
mov r14, qword [r12]
mov ecx, 0x18
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x140017efc
lea rcx, [0x140035ce8]
xor r13d, r13d
mov dword [rax + 0x10], 1
mov qword [rax + 8], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov qword [rdi], rax
test rax, rax
je 0x140017ef1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov r8, r14
mov qword [rsp + 0x20], r13
call qword [rax + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x140017a77
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017a59
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017a6f
call fcn.1400197b0
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184c0
test r13d, r13d
js 0x140017d71
mov ecx, 0x18
call fcn.140019320
xor r13d, r13d
mov rsi, rax
test rax, rax
je 0x140017aba
lea rcx, [0x140035cf0]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140017abd
jmp 0x140017e83
mov rsi, r13
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x140017ee6
cmp qword [r15 + 0x18], 8
jb 0x140017ad5
mov r15, qword [r15]
mov ecx, 0x18
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x140017b0d
mov rcx, r15
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017b10
test r15, r15
je 0x140017b10
jmp 0x140017e8e
mov rdi, r13
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x140017edb
mov ecx, 0x18
call fcn.140019320
test rax, rax
je 0x140017ed0
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000b4a0
mov r14, rax
test rax, rax
je 0x140017ed0
lock dec dword [rsi + 0x10]
jne 0x140017b7e
mov rcx, qword [rsi]
test rcx, rcx
je 0x140017b64
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140017b76
call fcn.1400197b0
mov qword [rsi + 8], r13
mov rcx, rsi
call fcn.1400184c0
mov qword [rsp + 0x50], r14
lock dec dword [rdi + 0x10]
jne 0x140017bb4
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017b9a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017bac
call fcn.1400197b0
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.1400184c0
mov ecx, 0x18
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x140017beb
lea rcx, [0x140035ce4]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140017bee
jmp 0x140017e99
mov rdi, r13
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140017ec5
mov ecx, 0x18
call fcn.140019320
test rax, rax
je 0x140017eba
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000b4a0
mov rsi, rax
test rax, rax
je 0x140017eba
lock dec dword [r14 + 0x10]
jne 0x140017c5d
mov rcx, qword [r14]
test rcx, rcx
je 0x140017c43
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140017c55
call fcn.1400197b0
mov qword [r14 + 8], r13
mov rcx, r14
call fcn.1400184c0
lock dec dword [rdi + 0x10]
jne 0x140017c8e
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017c74
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017c86
call fcn.1400197b0
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.1400184c0
mov r13, qword [rsp + 0x40]
mov r15, qword [rsi]
mov ecx, 0x18
mov r14, qword [r13 + 0x18]
call fcn.140019320
mov rdi, rax
test rax, rax
je 0x140017eaf
lea rcx, [0x140035ce8]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140017ea4
mov r10, qword [r14]
xor r9d, r9d
mov r8, r15
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
call qword [r10 + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x140017d38
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017d1a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140017d30
call fcn.1400197b0
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.1400184c0
lock dec dword [rsi + 0x10]
jne 0x140017d71
mov rcx, qword [rsi]
test rcx, rcx
je 0x140017d53
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140017d69
call fcn.1400197b0
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.1400184c0
lock dec dword [r12 + 0x10]
jne 0x140017db0
mov rcx, qword [r12]
test rcx, rcx
je 0x140017d90
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140017da8
call fcn.1400197b0
mov qword [r12 + 8], 0
mov rcx, r12
call fcn.1400184c0
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x60]
xor r12d, r12d
cmp rbx, rdi
jne 0x1400177a0
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x140017dd7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rbx, rdi
je 0x140017e1a
cmp qword [rbx + 0x28], 8
mov rsi, qword [rbx]
jb 0x140017df9
mov rcx, qword [rbx + 0x10]
call fcn.1400184c0
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r12
mov rcx, rbx
mov word [rbx + 0x10], r12w
call fcn.1400184c0
mov rbx, rsi
cmp rsi, rdi
jne 0x140017de6
mov rcx, rdi
call fcn.1400184c0
mov eax, r13d
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.140018f50
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400181d0
int3
lea rcx, str.list_T__too_long
call fcn.14002efc4
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3
mov ecx, 0x8007000e
call fcn.1400181d0
int3