Function at 0x140018d40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x900]
sub rsp, 0xa00
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rbp + 0x8f0], rax
xor edi, edi
lea rcx, [rbp + 0xf0]
xor edx, edx
mov dword [rsp + 0x30], edi
mov r8d, 0x800
mov dword [rsp + 0x34], edi
mov r14d, edi
call fcn.14014ba20
xor edx, edx
mov dword [rsp + 0x4c], 0x800
mov r8d, 0x100
lea rcx, [rsp + 0x34]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeW]
test eax, eax
je 0x140018dbe
mov r8d, eax
lea rdx, str.unexpected_error__CM_Get_Device_ID_List_Size_return_Value_of__lu
lea ecx, [rdi + 2]
call fcn.140016160
xor eax, eax
jmp 0x140019181
mov r8d, dword [rsp + 0x34]
mov rax, qword [0x14034b9d0]
add r8, r8
mov qword [rsp + 0xa28], rsi
test rax, rax
jne 0x140018de0
lea r8d, [rax + 6]
jmp 0x140018dfe
mov rcx, qword [0x14034b9d0]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140018e16
lea r8d, [rax + 0xe]
lea rdx, str.unexpected_error__failed_to_allocate_memory_to_the_device_list__err_d
mov ecx, 2
call fcn.140016160
xor eax, eax
jmp 0x140019179
mov r8d, dword [rsp + 0x34]
mov r9d, 0x100
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListW]
test eax, eax
je 0x140018e69
mov r8d, eax
lea rdx, str.unexpected_error__CM_Get_Device_ID_List_return_Value_of__lu
mov ecx, 2
call fcn.140016160
mov rax, qword [0x14034b9d0]
test rax, rax
je 0x140018e62
mov rcx, qword [0x14034b9d0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x140019179
mov qword [rsp + 0xa20], rbx
mov qword [rsp + 0xa30], r15
mov r15, rsi
cmp di, word [rsi]
je 0x140018f74
nop word [rax + rax]
xor edx, edx
mov dword [rsp + 0x48], edi
mov r8d, 0x190
lea rcx, [rsp + 0x60]
call fcn.14014ba20
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeW]
test eax, eax
jne 0x140018fa7
xor edx, edx
mov dword [rsp + 0x38], 0x190
mov r8d, 0x190
lea rcx, [rsp + 0x60]
call fcn.14014ba20
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], edi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [0x1401b7fd0]
call qword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_PropertyW]
test eax, eax
je 0x140018f12
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018f56
mov edx, 0x3e
lea rcx, str.SWCVID_8086PID_PIESID_0001
call fcn.14015039c
mov rbx, rax
lea rcx, [rsp + 0x60]
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
add bx, bx
call fcn.14015039c
add ax, ax
cmp ax, bx
jb 0x140018f56
lea rdx, str.SWCVID_8086PID_PIESID_0001
lea rcx, [rsp + 0x60]
call fcn.14014c018
test rax, rax
jne 0x140018f9f
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
mov rcx, rsi
call fcn.14015039c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp di, word [rsi]
jne 0x140018e90
mov rcx, qword [0x14034b9d0]
test rcx, rcx
je 0x140018f92
mov rcx, qword [0x14034b9d0]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
jne 0x140018fe5
mov eax, r14d
jmp 0x140019169
mov r14d, 1
jmp 0x140018f74
mov r8d, eax
lea rdx, str.unexpected_error__CM_Locate_DevNode_return_Value_of__lu
mov ecx, 2
call fcn.140016160
mov rax, qword [0x14034b9d0]
mov dword [rsp + 0x30], edi
test rax, rax
je 0x140018f97
mov rcx, qword [0x14034b9d0]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r14d
jmp 0x140019169
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 1
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x20019
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.SETUPAPI.dll_CM_Open_DevNode_Key]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x140019150
test rcx, rcx
je 0x140019150
lea rax, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp + 0xf0]
lea rdx, str.PiePathHint
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
test ebx, ebx
je 0x140019087
xor r8d, r8d
lea rdx, str.unexpected_error__GetRegKeyWCHARValue_return_Value_of__lu
lea ecx, [r8 + 2]
call fcn.140016160
jmp 0x140019167
mov edx, 0x400
lea rax, [rbp + 0xf0]
mov ecx, edx
cmp word [rax], di
je 0x1400190a4
add rax, 2
sub rcx, 1
jne 0x140019095
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmove rax, rdi
je 0x140019101
lea rcx, [rbp + 0xf0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1400190f3
lea r9, str.MurocApi.dll
mov eax, 0x7ffffffe
sub r9, rcx
test rax, rax
je 0x1400190f3
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x1400190f3
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x1400190d2
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
jne 0x140019140
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0xf0]
mov ecx, 2
mov r9d, eax
lea rdx, str.unexpected_error__Muroc_LoadLibrary__ws__Failed._le__0x_08lx
call fcn.140016160
mov eax, edi
jmp 0x140019169
mov edi, 1
mov qword [0x14034b9f0], rax
mov eax, edi
jmp 0x140019169
mov r9, rcx
lea rdx, str.unexpected_error__CM_Open_DevNode_Key_return_Value_0x_08lx__software_key___p_n
mov ecx, 2
mov r8d, eax
call fcn.140016160
xor eax, eax
mov rbx, qword [rsp + 0xa20]
mov r15, qword [rsp + 0xa30]
mov rsi, qword [rsp + 0xa28]
mov rcx, qword [rbp + 0x8f0]
xor rcx, rsp
call fcn.140149500
add rsp, 0xa00
pop r14
pop rdi
pop rbp
ret