Function at 0x140016000
Capabilities:
Query or enumerate registry value
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x14004a110]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov qword [rsp + 0x40], rcx
xor r12d, r12d
lea rcx, [rbp + 0x1e2]
xor edx, edx
mov r8d, 0x7fe
mov r13d, r12d
mov word [rbp + 0x1e0], r12w
call fcn.140017a30
lea rcx, [rsp + 0x60]
mov ebx, r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x68], rbx
call fcn.14000db40
lea r8, str.SOFTWAREIntelIGFXDPP_
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], r12d
mov qword [rbp - 0x80], r12
call fcn.140005d10
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x140016243
lea rax, [rsp + 0x58]
lea r9, [rbp - 0x70]
lea rdx, str.NumApps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, r12d
cmp dword [rsp + 0x34], ebx
jbe 0x14001622d
movabs r15, 0x555555555555554
nop word [rax + rax]
lea rcx, [rbp - 0x2e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x30], r12w
call fcn.140017a30
inc r14d
lea r8, str.ApplicationName_d
lea rcx, [rbp + 0x1e0]
mov r9d, r14d
mov edx, 0x400
call fcn.140019584
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x1e0]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016197
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x140016197
cmp dword [rsp + 0x38], r12d
jne 0x140016197
movzx eax, r12w
mov word [rbp - 0x30], ax
jmp 0x14001619b
movzx eax, word [rbp - 0x30]
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
test ax, ax
jne 0x1400161b6
mov r8, r12
jmp 0x1400161ca
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x1400161c0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000dec0
mov r8, qword [rdi + 8]
lea r9, [rbp - 0x50]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.14000a510
mov rcx, rax
mov rax, r15
sub rax, rbx
cmp rax, 1
jb 0x140016910
mov qword [rdi + 8], rcx
mov rax, qword [rcx + 8]
inc rbx
mov qword [rax], rcx
cmp qword [rbp - 0x38], 8
mov qword [rsp + 0x68], rbx
jb 0x140016222
mov rcx, qword [rbp - 0x50]
call fcn.140016f70
cmp r14d, dword [rsp + 0x34]
jb 0x140016110
test rsi, rsi
je 0x140016243
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x70], r12
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140016879
nop
mov ecx, 0x18
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x140016287
lea rcx, str.SELECT__FROM_Win32_ProcessStartTrace_where_ProcessName
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14001628a
jmp 0x140016905
mov rdi, r12
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x1400169e3
cmp qword [rbx + 0x28], 8
lea r15, [rbx + 0x10]
jb 0x1400162a8
mov r14, qword [r15]
jmp 0x1400162ab
mov r14, r15
mov ecx, 0x18
call fcn.140017dd0
mov rsi, rax
test rax, rax
je 0x1400162e3
mov rcx, r14
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x1400162e6
test r14, r14
je 0x1400162e6
jmp 0x14001691d
mov rsi, r12
mov qword [rbp - 0x60], rsi
test rsi, rsi
je 0x1400169d8
mov ecx, 0x18
call fcn.140017dd0
test rax, rax
je 0x1400169cd
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000ad30
mov r14, rax
test rax, rax
je 0x1400169cd
lock dec dword [rdi + 0x10]
jne 0x140016354
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001633a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001634c
call fcn.140018260
mov qword [rdi + 8], r12
mov rcx, rdi
call fcn.140016f70
mov qword [rsp + 0x48], r14
lock dec dword [rsi + 0x10]
jne 0x14001638a
mov rcx, qword [rsi]
test rcx, rcx
je 0x140016370
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140016382
call fcn.140018260
mov qword [rsi + 8], r12
mov rcx, rsi
call fcn.140016f70
mov ecx, 0x18
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x1400163c1
lea rcx, [0x140034904]
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400163c4
jmp 0x140016928
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x1400169c2
mov ecx, 0x18
call fcn.140017dd0
test rax, rax
je 0x1400169b7
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000ad30
mov r12, rax
test rax, rax
je 0x1400169b7
lock dec dword [r14 + 0x10]
jne 0x14001643b
mov rcx, qword [r14]
test rcx, rcx
je 0x14001641d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140016433
call fcn.140018260
mov qword [r14 + 8], 0
mov rcx, r14
call fcn.140016f70
lock dec dword [rdi + 0x10]
jne 0x140016474
mov rcx, qword [rdi]
test rcx, rcx
je 0x140016456
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001646c
call fcn.140018260
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140016f70
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + 0x18]
test rsi, rsi
je 0x140016821
mov r14, qword [r12]
mov ecx, 0x18
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x1400169ac
lea rcx, [0x140034908]
xor r13d, r13d
mov dword [rax + 0x10], 1
mov qword [rax + 8], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov qword [rdi], rax
test rax, rax
je 0x1400169a1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov r8, r14
mov qword [rsp + 0x20], r13
call qword [rax + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x140016527
mov rcx, qword [rdi]
test rcx, rcx
je 0x140016509
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001651f
call fcn.140018260
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140016f70
test r13d, r13d
js 0x140016821
mov ecx, 0x18
call fcn.140017dd0
xor r13d, r13d
mov rsi, rax
test rax, rax
je 0x14001656a
lea rcx, [0x140034910]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x14001656d
jmp 0x140016933
mov rsi, r13
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x140016996
cmp qword [r15 + 0x18], 8
jb 0x140016585
mov r15, qword [r15]
mov ecx, 0x18
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x1400165bd
mov rcx, r15
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400165c0
test r15, r15
je 0x1400165c0
jmp 0x14001693e
mov rdi, r13
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x14001698b
mov ecx, 0x18
call fcn.140017dd0
test rax, rax
je 0x140016980
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ad30
mov r14, rax
test rax, rax
je 0x140016980
lock dec dword [rsi + 0x10]
jne 0x14001662e
mov rcx, qword [rsi]
test rcx, rcx
je 0x140016614
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140016626
call fcn.140018260
mov qword [rsi + 8], r13
mov rcx, rsi
call fcn.140016f70
mov qword [rsp + 0x50], r14
lock dec dword [rdi + 0x10]
jne 0x140016664
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001664a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001665c
call fcn.140018260
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.140016f70
mov ecx, 0x18
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x14001669b
lea rcx, [0x140034904]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14001669e
jmp 0x140016949
mov rdi, r13
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x140016975
mov ecx, 0x18
call fcn.140017dd0
test rax, rax
je 0x14001696a
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000ad30
mov rsi, rax
test rax, rax
je 0x14001696a
lock dec dword [r14 + 0x10]
jne 0x14001670d
mov rcx, qword [r14]
test rcx, rcx
je 0x1400166f3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140016705
call fcn.140018260
mov qword [r14 + 8], r13
mov rcx, r14
call fcn.140016f70
lock dec dword [rdi + 0x10]
jne 0x14001673e
mov rcx, qword [rdi]
test rcx, rcx
je 0x140016724
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140016736
call fcn.140018260
mov qword [rdi + 8], r13
mov rcx, rdi
call fcn.140016f70
mov r13, qword [rsp + 0x40]
mov r15, qword [rsi]
mov ecx, 0x18
mov r14, qword [r13 + 0x18]
call fcn.140017dd0
mov rdi, rax
test rax, rax
je 0x14001695f
lea rcx, [0x140034908]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140016954
mov r10, qword [r14]
xor r9d, r9d
mov r8, r15
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
call qword [r10 + VarDecFix]
lock dec dword [rdi + 0x10]
mov r13d, eax
jne 0x1400167e8
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400167ca
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400167e0
call fcn.140018260
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.140016f70
lock dec dword [rsi + 0x10]
jne 0x140016821
mov rcx, qword [rsi]
test rcx, rcx
je 0x140016803
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140016819
call fcn.140018260
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.140016f70
lock dec dword [r12 + 0x10]
jne 0x140016860
mov rcx, qword [r12]
test rcx, rcx
je 0x140016840
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140016858
call fcn.140018260
mov qword [r12 + 8], 0
mov rcx, r12
call fcn.140016f70
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x60]
xor r12d, r12d
cmp rbx, rdi
jne 0x140016250
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x140016887
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rbx, rdi
je 0x1400168ca
cmp qword [rbx + 0x28], 8
mov rsi, qword [rbx]
jb 0x1400168a9
mov rcx, qword [rbx + 0x10]
call fcn.140016f70
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x20], r12
mov rcx, rbx
mov word [rbx + 0x10], r12w
call fcn.140016f70
mov rbx, rsi
cmp rsi, rdi
jne 0x140016896
mov rcx, rdi
call fcn.140016f70
mov eax, r13d
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.140017a00
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140016c80
int3
lea rcx, str.list_T__too_long
call fcn.14002da28
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3
mov ecx, 0x8007000e
call fcn.140016c80
int3