Function at 0x140005458
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov rax, qword [0x1403bbc88]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movups xmm0, xmmword [str.xxxxx.xxxxx.xxxxx.xxxxx]
lea rax, str.VID_
xor esi, esi
movsd xmm1, qword [0x1403867b8]
lea r13, str.wdi_create_list
mov qword [rbp - 0x28], rax
lea r9, str.Global_s
lea rax, str.PID_
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x20], rax
mov r12, rdx
lea rax, [0x1403867a4]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x18], rax
lea edx, [rsi + 0x1a]
lea rax, str.usbhub
mov dword [rsp + 0x60], 1
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rax, str.usbhub3
movsd qword [rbp + 0x70], xmm1
mov qword [rbp - 8], rax
lea rcx, [rbp + 0x180]
lea rax, str.usb3hub
mov qword [rsp + 0x50], rsi
mov qword [rbp], rax
or r8, 0xffffffffffffffff
lea rax, str.nusb3hub
mov qword [rbp - 0x78], rsi
mov qword [rbp + 8], rax
mov ebx, esi
lea rax, str.rusb3hub
mov qword [rsp + 0x20], r13
mov qword [rbp + 0x10], rax
mov r14d, esi
lea rax, str.flxhcih
mov qword [rbp + 0x18], rax
lea rax, str.tihub3
mov qword [rbp + 0x20], rax
lea rax, str.etronhub3
mov qword [rbp + 0x28], rax
lea rax, str.viahub3
mov qword [rbp + 0x30], rax
lea rax, str.asmthub3
mov qword [rbp + 0x38], rax
lea rax, str.iusb3hub
mov qword [rbp + 0x40], rax
lea rax, str.vusb3hub
mov qword [rbp + 0x48], rax
lea rax, str.amdhub30
mov qword [rbp + 0x50], rax
lea rax, str.vhhub
mov qword [rbp + 0x58], rax
movabs rax, 0x70676363627375
mov qword [rbp + 0x78], rax
movups xmmword [rbp + 0x60], xmm0
call fcn.140003238
lea r8, [rbp + 0x180]
xor ecx, ecx
lea edx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
jne 0x1400055e3
lea eax, [rsi - 0xb]
jmp 0x140005b23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400055fa
mov esi, 0xfffffffa
jmp 0x140005b18
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x140005610
call fcn.140002b18
mov eax, dword [section..data]
cmp eax, 0x61
jge 0x140005633
lea r8, str.This_version_of_Windows_is_no_longer_supported
mov rdx, r13
mov ecx, 3
call fcn.1400082ac
mov esi, 0xfffffff4
jmp 0x140005b0f
lea r13, str.Cfgmgr32
mov qword [rdi], rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov esi, 0xfffffff5
test rax, rax
jne 0x140005676
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140005676
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
lea rdx, str.CM_Get_Device_IDA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1400056b6
lea r9, str.CM_Get_Device_IDA
mov qword [rsp + 0x20], r13
lea r8, str.Unable_to_locate__s___in__s_n
lea rdx, str.wdi_create_list
lea ecx, [rax + 3]
call fcn.1400082ac
jmp 0x140005b0a
mov r9d, 6
lea rdx, [0x1403868dc]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov qword [rbp - 0x80], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400056e3
lea esi, [rax - 3]
jmp 0x140005b05
xor ecx, ecx
mov dword [rsp + 0x4c], ebx
call fcn.140003bd8
lea r8, [rbp - 0x48]
mov dword [rbp - 0x48], 0x20
xor edx, edx
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140005aeb
mov r13d, 3
mov edx, 0x50
lea r14d, [rdx - 0x4f]
mov ecx, r14d
call fcn.14001b030
mov rdi, rax
test rax, rax
je 0x140005f51
lea rax, [rsp + 0x40]
mov byte [rbp + 0x60], bl
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], 0x100
lea r8d, [r14 + 8]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x1400057e7
test r12, r12
je 0x140005ab6
cmp dword [r12], ebx
je 0x140005ab6
mov dword [rsp + 0x28], 0x20019
lea rdx, [rbp - 0x48]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov r8d, r14d
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [rsp + 0x40], 0x18
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400057e5
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov rcx, rbx
lea rdx, str.DriverVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea rax, [rsp + 0x40]
mov byte [rbp + 0x80], bl
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], 0x100
mov r8d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x14000582c
mov rax, rbx
jmp 0x140005838
lea rcx, [rbp + 0x80]
call fcn.14001aad8
mov qword [rdi + 0x20], rax
lea r14, [rbp - 0x10]
mov dword [rsp + 0x68], ebx
xor eax, eax
lea rdx, str._NULL_
cmp qword [r14], rax
lea rcx, [rbp + 0x80]
cmovne rdx, qword [r14]
call fcn.14001ac28
test eax, eax
je 0x140005873
inc ebx
add r14, 8
cmp ebx, 0xe
jb 0x140005844
xor ebx, ebx
jmp 0x140005891
xor ebx, ebx
mov dword [rsp + 0x68], 1
test r12, r12
je 0x140005ab6
cmp dword [r12 + 4], ebx
je 0x140005ab6
lea rdx, [rbp + 0x78]
mov dword [rsp + 0x6c], ebx
lea rcx, [rbp + 0x80]
call fcn.14001ac28
test eax, eax
jne 0x1400058c5
test r12, r12
je 0x140005ab6
cmp dword [r12 + 4], ebx
je 0x140005ab6
mov dword [rsp + 0x6c], 1
lea rax, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], 0x100
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
lea r14, str.wdi_create_list
mov rdx, r14
test eax, eax
je 0x140005920
lea r9, [rbp + 0x80]
xor ecx, ecx
lea r8, str.Hardware_ID:__s
call fcn.1400082ac
jmp 0x140005935
lea r8, str.Could_not_get_hardware_ID
mov ecx, r13d
call fcn.1400082ac
mov byte [rbp + 0x80], bl
lea rcx, [rbp + 0x80]
call fcn.14001aad8
mov qword [rdi + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x40]
mov r8d, 2
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x48]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], 0x100
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x140005999
lea r9, [rbp + 0x80]
mov rdx, r14
lea r8, str.Compatible_ID:__s
xor ecx, ecx
call fcn.1400082ac
jmp 0x14000599f
mov byte [rbp + 0x80], bl
lea rcx, [rbp + 0x80]
call fcn.14001aad8
mov qword [rdi + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x40]
mov r8d, 0x11
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x48]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], 0x100
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x1400059ee
mov rax, rbx
jmp 0x140005a12
lea r9, [rbp + 0x80]
mov rdx, r14
lea r8, str.Upper_filter:__s
xor ecx, ecx
call fcn.1400082ac
lea rcx, [rbp + 0x80]
call fcn.14001aad8
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x48], rbx
cmp byte [rbp + 0x60], bl
je 0x140005a63
lea r9, [rbp + 0x60]
mov rdx, r14
lea r8, str.Driver_version:__s
xor ecx, ecx
call fcn.1400082ac
lea rcx, [rbp + 0x60]
jmp 0x140005a50
shl qword [rdi + 0x48], 0x10
mov rcx, rax
call fcn.14001b05c
movsxd rcx, eax
add qword [rdi + 0x48], rcx
xor ecx, ecx
lea rdx, [0x140385730]
call fcn.14001b000
test rax, rax
jne 0x140005a3a
jmp 0x140005a7d
cmp qword [rdi + 0x20], rbx
je 0x140005a7d
lea r8, str.Could_not_read_driver_version
mov rdx, r14
mov ecx, 2
call fcn.1400082ac
mov ecx, dword [rbp - 0x34]
lea rdx, [rbp + 0x80]
xor r9d, r9d
mov r8d, 0x100
call qword [rbp - 0x68]
mov rdx, r14
test eax, eax
je 0x140005b53
mov r9d, dword [rsp + 0x4c]
lea r8, str.Could_not_retrieve_simple_path_for_device__d:_CR_error__d
mov ecx, r13d
mov dword [rsp + 0x20], eax
call fcn.1400082ac
mov r14, qword [rsp + 0x50]
inc dword [rsp + 0x4c]
mov rcx, rdi
call fcn.140003bd8
mov edx, dword [rsp + 0x4c]
lea r8, [rbp - 0x48]
mov rcx, r15
mov dword [rbp - 0x48], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140005712
mov rdi, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov qword [rdi], r14
mov esi, 0xfffffffc
neg r14
sbb ecx, ecx
not ecx
and esi, ecx
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14000c340
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp qword [rdi + 0x20], rbx
lea rax, [rbp + 0x80]
mov ebx, dword [rsp + 0x4c]
lea r9, str.Driverless
cmovne r9, qword [rdi + 0x20]
lea r8, str._s_USB_device___d_:__s
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.1400082ac
lea rcx, [rbp + 0x80]
call fcn.14001aad8
mov qword [rdi + 0x28], rax
lea r9, [rbp - 0x70]
xor r14d, r14d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], r14d
lea r8, [0x1400349f0]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x48]
lea rax, [rbp + 0x1a0]
mov dword [rsp + 0x28], 0x200
mov rcx, r15
mov qword [rsp + 0x20], rax
mov word [rbp + 0x1a0], r14w
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
jne 0x140005c6d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x1a0]
mov dword [rsp + 0x28], 0x200
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140005c24
cmp word [rbp + 0x1a0], r14w
jne 0x140005c6d
xor ecx, ecx
call fcn.140007e4c
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea r8, str.Could_not_read_device_description_for__d:__s
xor ecx, ecx
lea rdx, str.wdi_create_list
call fcn.1400082ac
mov ebx, dword [rsp + 0x60]
lea r8, str.Unknown_Device__d
mov r9d, ebx
lea rcx, [rbp + 0x1a0]
mov edx, 0x100
call fcn.140003294
inc ebx
mov dword [rsp + 0x60], ebx
xor ebx, ebx
lea rdx, [0x140386a48]
lea rcx, [rbp + 0x80]
mov dword [rdi + 0xc], ebx
mov byte [rdi + 0x10], bl
call fcn.14001b000
mov dword [rsp + 0x64], ebx
mov r14, rax
mov ecx, ebx
test rax, rax
je 0x140005e60
xor r15d, r15d
test r14, r14
lea rcx, str._NULL_
mov rax, r14
mov r12d, r15d
cmove rax, rcx
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x28]
mov rsi, qword [rbp - 0x60]
mov qword [rsp + 0x78], rax
mov rbx, qword [rax]
test rbx, rbx
jne 0x140005cd2
mov rax, r15
mov rbx, rcx
jmp 0x140005cda
mov rcx, rbx
call fcn.14001ad10
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.14001af80
test eax, eax
jne 0x140005e14
mov eax, r12d
test r12d, r12d
je 0x140005dd2
sub eax, 1
je 0x140005da2
cmp eax, 1
je 0x140005d25
lea r8, str.Program_assertion_failed___Unexpected_case
lea rdx, str.wdi_create_list
mov ecx, r13d
call fcn.1400082ac
jmp 0x140005e14
lea r8, [rsp + 0x48]
mov rcx, r14
lea rdx, str.MI__02X
call fcn.1400052a4
cmp eax, 1
je 0x140005d47
lea r8, str.Could_not_convert_MI_string
jmp 0x140005d11
mov dword [rdi + 0xc], 1
lea rcx, [rbp + 0x1a0]
mov al, byte [rsp + 0x48]
mov byte [rdi + 0x10], al
call fcn.14001a758
add rax, 0x11
cmp rax, 0x100
jae 0x140005e14
movzx ebx, byte [rdi + 0x10]
lea rcx, [rbp + 0x1a0]
call fcn.14001a758
lea rcx, [rbp + 0x1a0]
mov r9d, ebx
lea r8, str.__Interface__d_
mov edx, 0x11
lea rcx, [rcx + rax*2]
call fcn.140003294
jmp 0x140005e14
lea r8, [rsp + 0x48]
mov rcx, r14
lea rdx, str.PID__04X
call fcn.1400052a4
cmp eax, 1
je 0x140005dc7
lea r8, str.Could_not_convert_PID_string
jmp 0x140005d11
movzx eax, word [rsp + 0x48]
mov word [rdi + 0xa], ax
jmp 0x140005e14
lea r8, [rsp + 0x48]
mov rcx, r14
lea rdx, str.VID__04X
call fcn.1400052a4
cmp eax, 1
je 0x140005e03
lea r8, str.Could_not_convert_VID_string
mov ecx, r13d
lea rdx, str.wdi_create_list
call fcn.1400082ac
jmp 0x140005e0c
movzx eax, word [rsp + 0x48]
mov word [rdi + 8], ax
mov dword [rsp + 0x64], 1
mov rax, qword [rsp + 0x78]
lea rcx, str._NULL_
add rax, 8
inc r12d
mov qword [rsp + 0x78], rax
cmp r12d, r13d
jb 0x140005cc2
lea rdx, [0x140386a48]
xor ecx, ecx
call fcn.14001b000
mov r14, rax
test rax, rax
jne 0x140005c9d
mov r15, qword [rbp - 0x80]
lea esi, [rax - 0xb]
mov ecx, dword [rsp + 0x64]
xor ebx, ebx
mov r12, qword [rbp - 0x58]
cmp dword [rsp + 0x68], ebx
je 0x140005e6e
test ecx, ecx
je 0x140005ab6
cmp dword [rsp + 0x6c], ebx
je 0x140005eb4
lea rcx, [rbp + 0x1a0]
call fcn.14001a758
add rax, 0x14
cmp rax, 0x100
jae 0x140005eb4
lea rcx, [rbp + 0x1a0]
call fcn.14001a758
lea rcx, [rbp + 0x1a0]
mov edx, 0x14
lea r8, str.__Composite_Parent_
lea rcx, [rcx + rax*2]
call fcn.140003294
lea rcx, [rbp + 0x1a0]
call fcn.140005398
mov qword [rdi + 0x18], rax
mov r9, rax
test rax, rax
je 0x140005f15
test r12, r12
je 0x140005f15
cmp dword [r12 + 8], ebx
je 0x140005f15
mov rcx, rax
call fcn.14001ad10
mov rcx, qword [rdi + 0x18]
lea rbx, [rax + rcx]
cmp rbx, rcx
je 0x140005f0b
lea r14, [rbx - 1]
movsx ecx, byte [r14]
call fcn.14001a560
test eax, eax
je 0x140005f07
mov rbx, r14
cmp r14, qword [rdi + 0x18]
jne 0x140005eed
mov r15, qword [rbp - 0x80]
xor eax, eax
mov byte [rbx], al
xor ebx, ebx
mov r9, qword [rdi + 0x18]
lea r8, str.Device_description:__s
xor ecx, ecx
lea rdx, str.wdi_create_list
call fcn.1400082ac
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x140005f3d
mov r14, rdi
mov qword [rsp + 0x50], rdi
jmp 0x140005f45
mov r14, qword [rsp + 0x50]
mov qword [rax], rdi
mov qword [rbp - 0x78], rdi
mov rdi, rbx
jmp 0x140005abb
mov rcx, qword [rsp + 0x50]
call fcn.140005f6c
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x140005b05