Function at 0x14000d6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2d8], rbx
mov rax, qword [0x1400ae088]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, r8
mov r14, rdx
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_List_SizeW]
test eax, eax
je 0x14000d733
mov edx, eax
lea rcx, str.CM_Get_Device_ID_List_Size_failed__ret:__x
call fcn.140018760
mov r8d, 0x784
lea r9, [0x1400af290]
lea rdx, str.EnumDeviceAndGetDriverInfoEx
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
jmp 0x14000d7dd
mov ebx, dword [rsp + 0x30]
add rbx, rbx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x14000d775
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DeviceList_HeapAlloc_failed__ret:_0x_x
call fcn.140018760
mov r8d, 0x78d
jmp 0x14000d714
mov r9d, 0x10000142
mov r8d, dword [rsp + 0x30]
mov rdx, r15
lea rcx, str.RtkBtFilter
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_ListW]
test eax, eax
je 0x14000d80c
mov edx, eax
lea rcx, str.CM_Get_Device_ID_ListW_failed__ret:__x
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x796
lea rdx, str.EnumDeviceAndGetDriverInfoEx
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov dword [r12], edi
mov dword [r14], edi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140023950
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x48], 0x200
mov rsi, r15
cmp word [r15], di
je 0x14000d7c9
nop word [rax + rax]
mov dword [r12], 1
call fcn.1400030f0
mov rcx, rax
test rax, rax
je 0x14000dbb2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000d860
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140005a50
mov rdx, qword [rsp + 0x40]
lea rcx, str.Present_hardwareid:__s
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x7ad
lea rdx, str.EnumDeviceAndGetDriverInfoEx
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
call fcn.1400030f0
mov rcx, rax
test rax, rax
je 0x14000dba7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, 0x1e
lea rdx, str.SYSTEMCurrentControlSetEnum_
lea rcx, [rsp + 0x58]
call fcn.140005a50
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140008f10
nop
mov rcx, qword [rax]
mov edx, dword [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x14000dbde
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000d930
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d9cd
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, [0x14008d620]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14000d9c2
mov edx, eax
lea rcx, str.RegQueryValueEx_fail__error_code:__x
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x7c1
lea rdx, str.EnumDeviceAndGetDriverInfoEx
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.1400030f0
test rax, rax
je 0x14000dbd3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
cmp rax, 0x10000
jae 0x14000da0e
lea rax, [rsp + 0x70]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140003290
jmp 0x14000da3d
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000da20
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140005a50
nop
mov rbx, qword [rsp + 0x38]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14000dbc8
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000da70
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004030
mov rbx, qword [rsp + 0x38]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14004a9a8
cmp edi, dword [rbx - 0xc]
jg 0x14000dbbd
mov dword [rbx - 0x10], edi
mov rax, rdi
xor edi, edi
mov word [rbx + rax*2], di
mov rdx, rbx
lea rcx, str.Mfg:__s
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x7c9
lea rdx, str.EnumDeviceAndGetDriverInfoEx
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
cmp dword [rbx - 0x10], edi
jl 0x14000db1e
lea rdx, str.realtek
mov rcx, rbx
call fcn.140024bf4
test rax, rax
je 0x14000daf7
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000daf7
mov dword [r14], 1
mov dword [r13], 1
jmp 0x14000db1e
cmp dword [rbx - 0x10], edi
jl 0x14000db1e
lea rdx, [0x14008d6a0]
mov rcx, rbx
call fcn.140024bf4
test rax, rax
je 0x14000db1e
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000db1e
mov dword [r14], edi
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000db3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000db5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000db7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rsi + rax*2], 0
jne 0x14000db85
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], 0
jne 0x14000d830
jmp 0x14000d7c9
mov ecx, 0x80004005
call fcn.140002850
nop
mov ecx, 0x80004005
call fcn.140002850
nop
mov ecx, 0x80070057
call fcn.140002850
int3
mov ecx, 0x80070057
call fcn.140002850
nop
mov ecx, 0x80004005
call fcn.140002850
nop
call fcn.140005bc0
int3