Function at 0x140008370
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x14002e0b0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, rdx
mov r14, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rdx, str.SYSTEMCurrentControlSetControlClass_
xor r13d, r13d
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x140008407
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140004bf0
test rax, rax
je 0x140008505
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140004840
jmp 0x140008505
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14000847f
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140008505
cmp dword [rdx + 0x10], eax
jge 0x140008451
cmp dword [rbx - 0xc], eax
jge 0x140008445
mov ecx, 0x80070057
call fcn.140004d20
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], ax
jmp 0x140008505
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140008468
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x140008505
mov ebp, dword [rbx - 0x10]
mov r12, rdx
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400084b4
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400049e0
mov rbx, qword [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass_
cmp r12, rbp
ja 0x1400084d4
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140010180
jmp 0x1400084ec
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
mov r8, rdx
mov rdx, rbp
mov rcx, rbx
call fcn.1400100b0
test edi, edi
js 0x14000873d
cmp edi, dword [rbx - 0xc]
jg 0x14000873d
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], r13w
mov r8, r14
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400091f0
nop
mov word [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rsp + 0x62]
call fcn.140011570
mov r9, qword [rsp + 0x38]
lea r8, str.Checking_Driver_Registry:__s_n
mov edx, 2
lea rcx, [0x14002f750]
call fcn.14000bba0
mov edi, 0xff
mov rdx, rdi
lea rax, [rsp + 0x60]
lea r8, [0x1400266cc]
lea rcx, [rsp + 0x60]
sub r8, rcx
nop
nop
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140008589
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140008570
jmp 0x14000858e
test rdx, rdx
jne 0x140008592
sub rax, 2
mov word [rax], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400086e1
mov dword [rsp + 0x40], 0x200
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DeviceID
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008648
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x60]
sub rdx, rcx
movzx ecx, word [rdx + rax]
test cx, cx
je 0x14000862c
mov word [rax], cx
add rax, 2
sub rdi, 1
jne 0x140008614
jmp 0x140008631
test rdi, rdi
jne 0x140008635
sub rax, 2
mov word [rax], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
je 0x1400086e1
lea r9, [rsp + 0x60]
lea r8, str.DeviceID:__s_n
mov edx, 2
lea rcx, [0x14002f750]
call fcn.14000bba0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400046e0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400086bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400086da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 1
jmp 0x140008748
lea r8, str.Failed_to_get_DeviceID_from_the_Registry_n
mov edx, 5
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000871b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140008739
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x140008748
mov ecx, 0x80070057
call fcn.140004d20
nop
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000f470
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret