Function at 0x140051da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x300], rax
movzx r13d, r9b
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x58], r8
mov qword [r11 - 0x260], 7
xor r15d, r15d
mov qword [r11 - 0x268], r15
mov word [r11 - 0x278], r15w
lea r8d, [r15 + 0x18]
lea rdx, str.Unregister_DeviceControl
lea rcx, [r11 - 0x280]
call fcn.140001870
nop
lea r9, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae r9, qword [rsp + 0xd0]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
mov r14d, 1
mov r8d, r14d
lea edx, [r15 + 0x32]
mov rcx, rsi
call fcn.1400144a0
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1400388c0
lea r9, str.SystemCurrentControlSet_
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.140051280
mov ebp, eax
test eax, eax
jne 0x1400520fa
xor bl, bl
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemSelect_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140051f08
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Current
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, r14d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x140051f10
mov dword [rsp + 0x38], 0xffffffff
mov word [rsp + 0xf0], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.1400719a0
xor bl, bl
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemSelect_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052006
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Default
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, r14d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x140052006
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x38], eax
je 0x140052006
mov dword [rsp + 0x20], eax
lea r9, str.SystemControlSet
lea r8, str._s_03i_
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call fcn.140066ef4
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400388c0
lea r9, [rsp + 0xf0]
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.140051280
xor bl, bl
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemSelect_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400520de
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.LastKnownGood
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, r14d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400520de
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x38], eax
je 0x1400520de
mov dword [rsp + 0x20], eax
lea r9, str.SystemControlSet
lea r8, str._s_03i_
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call fcn.140066ef4
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400388c0
lea r9, [rsp + 0xf0]
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.140051280
test r13b, r13b
je 0x1400520fa
mov r9d, 0x2710
movzx r8d, r14b
mov rdx, r12
mov rcx, rsi
call fcn.14004df20
mov ebp, eax
lea r9, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae r9, qword [rsp + 0xd0]
mov dword [rsp + 0x28], ebp
lea rax, str.Return_code__0x_x_
mov qword [rsp + 0x20], rax
mov r8d, r14d
mov edx, 0x28
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae r9, qword [rsp + 0xd0]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov r8d, r14d
mov edx, 0x32
mov rcx, rsi
call fcn.1400144a0
nop
cmp qword [rsp + 0xe8], 8
jb 0x140052183
mov rcx, qword [rsp + 0xd0]
call fcn.140065920
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r15
mov word [rsp + 0xd0], r15w
mov rcx, rdi
call fcn.140026d60
nop
mov rcx, qword [rdi]
call fcn.140065920
mov eax, ebp
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x368]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret