Function at 0x14000c380
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp + 0xf], 0xfffffffffffffffe
xor r12d, r12d
mov r14d, r12d
mov dword [rbp + 0x6f], r12d
mov dword [rbp + 0x77], r12d
call fcn.140002de0
mov rcx, rax
test rax, rax
je 0x14000c867
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
mov r13d, r12d
mov dword [rbp + 0x7f], r12d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x77]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_List_SizeW]
lea rsi, [r12 - 1]
test eax, eax
je 0x14000c42c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CM_Get_Device_ID_List_Size_failed__ret:__x
call fcn.140010f80
mov r8d, 0x2bc
lea r9, [0x140090270]
lea rdx, str.SetBtSelectiveSuspendEnabled
lea rcx, str.__hs_____d_:_____s
call fcn.140011770
jmp 0x14000c4d3
mov edi, dword [rbp + 0x77]
add rdi, rdi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
mov edx, 8
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov qword [rbp - 1], rax
test rax, rax
jne 0x14000c46e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DeviceList_HeapAlloc_failed__ret:_0x_x
call fcn.140010f80
mov r8d, 0x2c3
jmp 0x14000c40d
mov r9d, 0x10000142
mov r8d, dword [rbp + 0x77]
mov rdx, rax
lea rcx, str.BTHUSB
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_Device_ID_ListW]
test eax, eax
je 0x14000c51e
mov edx, eax
lea rcx, str.CM_Get_Device_ID_ListW_failed__ret:__x
call fcn.140010f80
mov r8d, 0x2ca
lea r9, [0x140090270]
lea rdx, str.SetBtSelectiveSuspendEnabled
lea rcx, str.__hs_____d_:_____s
call fcn.140011770
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
mov r12d, 0
sete r12b
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000c507
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r12d
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp - 1]
mov r15, rax
cmp word [rax], r13w
je 0x14000c4be
mov rax, rsi
nop
inc rax
cmp word [r15 + rax*2], 0
jne 0x14000c530
mov r8d, eax
mov rdx, r15
lea rcx, [rbp - 0x39]
call fcn.140005cc0
mov rbx, qword [rbp - 0x39]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14000c85c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000c57a
mov edx, edi
lea rcx, [rbp - 0x39]
call fcn.140003ce0
mov rbx, qword [rbp - 0x39]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14002a87c
cmp edi, dword [rbx - 0xc]
jg 0x14000c851
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x25]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Locate_DevNodeW]
test eax, eax
jne 0x14000c838
xor r9d, r9d
mov r8d, dword [rbp - 0x25]
lea rdx, [rbp + 7]
lea rcx, [rbp + 0xb]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_DevNode_Status]
test eax, eax
je 0x14000c5de
cmp eax, 0xd
jne 0x14000c81f
test r13d, r13d
je 0x14000c7fe
jmp 0x14000c5e5
mov dword [rbp + 0x7f], 1
mov dword [rbp - 0x31], 0xffffffff
mov dword [rbp - 0x29], 4
mov dword [rbp - 0x2d], 4
call fcn.140002de0
test rax, rax
je 0x14000c899
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rax, str.SYSTEMCurrentControlSetEnum_
lea rcx, [rbp - 0x19]
cmp rax, 0x10000
jae 0x14000c636
movzx edx, ax
call fcn.140002fb0
jmp 0x14000c645
mov r8d, 0x1e
mov rdx, rax
call fcn.140005cc0
nop
mov rsi, qword [rbp - 0x19]
lea r13, [rsi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x14000c661
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14000c678
call fcn.140002de0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x14000c88e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 9], rdi
or r14d, 1
mov dword [rbp + 0x6f], r14d
mov eax, dword [rbx - 0x10]
mov dword [rbp - 0x21], eax
movsxd r14, dword [rsi - 0x10]
lea r12d, [r14 + rax]
test r12d, r12d
js 0x14000c883
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14000c6ca
mov edx, r12d
lea rcx, [rbp - 9]
call fcn.140003ce0
mov rdi, qword [rbp - 9]
add r14, r14
mov r9, r14
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14000d640
movsxd rdx, dword [rbp - 0x21]
add rdx, rdx
lea rcx, [r14 + rdi]
mov r9, rdx
mov r8, rbx
call fcn.14000d640
cmp r12d, dword [rdi - 0xc]
jg 0x14000c878
mov dword [rdi - 0x10], r12d
movsxd rax, r12d
xor r12d, r12d
mov word [rdi + rax*2], r12w
mov edx, dword [rdi - 0x10]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x14000c872
and dword [rbp + 0x6f], 0xfffffffe
lea rdx, [rdi - 0x18]
mov rsi, 0xffffffffffffffff
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000c749
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c7d8
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.SelectiveSuspendEnabled
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c7a5
mov eax, dword [rbp + 0x67]
cmp dword [rbp - 0x31], eax
je 0x14000c7cd
mov eax, dword [rbp - 0x2d]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x29]
xor r8d, r8d
lea rdx, str.SelectiveSuspendEnabled
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
mov eax, esi
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x14000c7f2
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + 8]
mov r13d, dword [rbp + 0x7f]
mov r14d, dword [rbp + 0x6f]
mov rbx, qword [rbp - 0x39]
mov rax, rsi
lea rax, [rax + 1]
cmp word [r15 + rax*2], 0
jne 0x14000c801
lea r15, [r15 + rax*2]
add r15, 2
cmp word [r15], 0
jmp 0x14000c529
mov edx, eax
lea rcx, str.CM_Get_DevNode_Status_failed__ret:__x
call fcn.140010f80
mov r8d, 0x2e6
jmp 0x14000c4a4
mov edx, eax
lea rcx, str.CM_Locate_DevNode_failed__ret:__x
call fcn.140010f80
mov r8d, 0x2d9
jmp 0x14000c4a4
mov ecx, 0x80070057
call fcn.140002520
int3
mov ecx, 0x80070057
call fcn.140002520
nop
mov ecx, 0x80004005
call fcn.140002520
nop
call fcn.140005e30
int3
mov ecx, 0x80070057
call fcn.140002520
int3
mov ecx, 0x80070057
call fcn.140002520
int3
mov ecx, 0x80004005
call fcn.140002520
nop
mov ecx, 0x80004005
call fcn.140002520
int3