Function at 0x1400539c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov qword [rax + 8], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rsp + 0x70], xmm11
mov r12, rcx
xor r13d, r13d
mov qword [rbp - 0x51], r13
mov dword [rbp - 0x49], r13d
mov qword [rbp - 0x41], r13
mov r9d, 0x20019
lea r8, str.systemcurrentcontrolsetenumusb
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x51]
call fcn.14003e3a0
test eax, eax
jne 0x140053dc6
xorps xmm11, xmm11
xorps xmm6, xmm6
mov r15d, r13d
mov dword [rbp + 0x6f], 0x100
mov ecx, 0x202
call fcn.14008c198
mov rsi, rax
lea rdi, vtable.ATL::CAtlStringMgr.0
lea r14, [r13 - 1]
movsd xmm9, qword [0x1402f90c8]
movss xmm8, dword [0x1402f90c0]
movss xmm7, dword [0x1402f90d8]
movss xmm10, dword [0x1402f90f0]
nop dword [rax + rax]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x6f]
mov r8, rsi
mov edx, r15d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140053cfc
call fcn.140011f18
test rax, rax
je 0x140053e66
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
cmp rcx, rdi
jne 0x140053e33
lock inc dword [rax + 0x20]
add rax, 0x10
add rax, 0x18
mov qword [rbp + 0x77], rax
test rsi, rsi
je 0x140053b1d
cmp rsi, 0x10000
jae 0x140053b0e
movzx edx, si
lea rcx, [rbp + 0x77]
call fcn.140012700
jmp 0x140053b30
mov rax, r14
inc rax
cmp word [rsi + rax*2], 0
jne 0x140053b11
jmp 0x140053b20
mov eax, r13d
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp + 0x77]
call fcn.140002a7c
nop
mov rbx, qword [rbp + 0x77]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x140053e5b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140053b60
mov edx, edi
lea rcx, [rbp + 0x77]
call fcn.140002a1c
mov rbx, qword [rbp + 0x77]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14023853c
cmp edi, dword [rbx - 0xc]
jg 0x140053e50
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r13w
add rbx, 0xffffffffffffffe8
mov rcx, rbx
call fcn.140002c94
add rax, 0x18
mov qword [rbp - 0x69], rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
lea rdi, vtable.ATL::CAtlStringMgr.0
jg 0x140053be4
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x140053e3d
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rdx, vtable.ATL::CWin32Heap.0
cmp rax, rdx
jne 0x140053e3d
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x69]
mov rdx, r14
lea rbx, str.root_hub
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [rbx + rdx*2 + 2]
jne 0x140053c12
add rdx, 2
cmp rdx, 9
je 0x140053c72
movzx ecx, word [rax + rdx*2]
cmp cx, word [rbx + rdx*2]
je 0x140053bf2
mov rdx, r14
lea rbx, str.root_hub20
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [rbx + rdx*2 + 2]
jne 0x140053c40
add rdx, 2
cmp rdx, 0xb
je 0x140053c86
movzx ecx, word [rax + rdx*2]
cmp cx, word [rbx + rdx*2]
je 0x140053c20
mov rdx, r14
lea rbx, str.root_hub30
nop word [rax + rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [rbx + rdx*2 + 2]
jne 0x140053c9b
add rdx, 2
cmp rdx, 0xb
je 0x140053c90
movzx ecx, word [rax + rdx*2]
cmp cx, word [rbx + rdx*2]
jne 0x140053c9b
jmp 0x140053c50
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
comisd xmm9, xmm0
jbe 0x140053c12
movaps xmm6, xmm8
jmp 0x140053c9b
comiss xmm7, xmm6
jbe 0x140053c40
movaps xmm6, xmm7
jmp 0x140053c9b
movaps xmm0, xmm10
maxss xmm0, xmm6
movaps xmm6, xmm0
inc r15d
mov dword [rbp + 0x6f], 0x100
lea rdx, [rax - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053a90
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x140053e48
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140053e48
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140053a90
comiss xmm6, xmm11
jbe 0x140053db9
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140053e71
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rdi
jne 0x140053e7c
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rbp + 0x7f], rax
xorps xmm2, xmm2
cvtss2sd xmm2, xmm6
movq r8, xmm2
lea rdx, str._.1f
lea rcx, [rbp + 0x7f]
call fcn.14004d8a0
mov rbx, qword [rbp + 0x7f]
mov r9, rbx
xor r8d, r8d
mov edx, 0x115b4
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140053db9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x140053e2d
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140053e2d
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140053dc6
mov rcx, rsi
call fcn.14008c190
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140053dd9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r13
mov dword [rbp - 0x49], r13d
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140053df0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r13
mov dword [rbp - 0x49], r13d
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call r8
nop
jmp 0x140053db9
mov rcx, rax
call rdx
jmp 0x140053aea
mov rdx, rbx
call r8
jmp 0x140053be4
call r8
jmp 0x140053a90
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
nop
mov ecx, 0x80004005
call fcn.140002d3c
int3
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x140053d2f