Function at 0x14002fc4c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x170
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, r8
mov rbp, rdx
mov rbx, rcx
lea r8, str.CRegistryClassFilter::IsKnownSubKey____n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
xor esi, esi
mov qword [rsp + 0x38], rsi
and dword [rsp + 0x40], esi
xor edi, edi
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call fcn.14002f904
test eax, eax
je 0x14002fcbd
lea edi, [rsi + 1]
jmp 0x14002ff18
mov r9d, 0x20019
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.14000bc38
test eax, eax
jne 0x14002ff13
mov byte [rsp + 0x50], dil
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x51]
call fcn.1400988d0
mov edx, 0x104
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x50]
call fcn.1400990e0
mov rax, qword [rbx + 0x40]
mov rsi, qword [rsp + 0x38]
cmp qword [rax + 0x30], rdi
je 0x14002fd62
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Class
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002fd62
mov rax, qword [rbx]
mov r8, qword [rbx + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14002fd62
mov edi, 1
jmp 0x14002ff18
mov rax, qword [rbx + 0x58]
cmp qword [rax + 0x30], rdi
je 0x14002fdba
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Installer32
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002fdba
mov rax, qword [rbx]
mov r8, qword [rbx + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14002fdba
mov edi, 1
jmp 0x14002ff18
mov rax, qword [rbx + 0x58]
cmp qword [rax + 0x30], rdi
je 0x14002fe12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Installer
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002fe12
mov rax, qword [rbx]
mov r8, qword [rbx + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14002fe12
mov edi, 1
jmp 0x14002ff18
mov rax, qword [rbx + 0x48]
cmp qword [rax + 0x30], rdi
je 0x14002fe64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002fe64
mov rax, qword [rbx]
mov r8, qword [rbx + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x14002ff18
mov rax, qword [rbx + 0x50]
cmp qword [rax + 0x30], rdi
je 0x14002feb9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NTMPDriver
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002feb9
mov rax, qword [rbx]
mov r8, qword [rbx + 0x50]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14002feb9
mov edi, 1
jmp 0x14002ff18
mov rax, qword [rbx + 0x60]
cmp qword [rax + 0x30], rdi
je 0x14002ff18
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MatchingDeviceId
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002ff18
mov rax, qword [rbx]
mov r8, qword [rbx + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x20]
mov ecx, edi
mov edi, 1
test eax, eax
cmovne ecx, edi
mov edi, ecx
jmp 0x14002ff18
mov rsi, qword [rsp + 0x38]
lea r8, str.CRegistryClassFilter::IsKnownSubKey____n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
test rsi, rsi
je 0x14002ff3e
mov rcx, rsi
call fcn.14004e608
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140061100
add rsp, 0x170
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret