Function at 0x1400ab6b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xce0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0xcd0], rax
mov r15, rdx
mov r14, rcx
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x44], ebx
xor al, al
mov byte [rsp + 0x40], al
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor r8d, r8d
lea rdx, [0x14022ee70]
lea rcx, [rsp + 0x60]
call fcn.140018360
nop
lea r9d, [rdi + 2]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14023e408]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r12, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400ab798
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400ab783
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab77e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac269
call fcn.1401a9a50
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor al, al
jmp 0x1400ac23c
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xa0], 0x20
mov r13d, edi
mov esi, 5
nop
lea r8, [rsp + 0xa0]
mov edx, r13d
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov rcx, r12
test eax, eax
je 0x1400ac1ac
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, 1
jne 0x1400ac1a4
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0xad0]
call fcn.1401d04f0
mov dword [rsp + 0x58], edi
lea r8, [rsp + 0xc0]
lea rdx, str.SYSTEMCurrentControlSetControlClass_s
lea rcx, [rsp + 0xad0]
call fcn.1400a4440
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0xad0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400ab8cf
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400ab8ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab8b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac26f
call fcn.1401a9a50
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
xor al, al
jmp 0x1400ac23c
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MatchingDeviceId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.1002
lea rcx, [rsp + 0xc0]
call fcn.1401d0680
test rax, rax
jne 0x1400ab93c
lea rdx, str.1022
lea rcx, [rsp + 0xc0]
call fcn.1401d0680
test rax, rax
je 0x1400ac199
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x2d0]
call fcn.1401d04f0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ReleaseVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ab9bf
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x2d0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ab9a0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x60]
call fcn.140018360
jmp 0x1400aba2d
cmp eax, 0xea
jne 0x1400aba2d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ReleaseVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400aba2d
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x2d0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400aba10
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x60]
call fcn.140018360
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], di
mov r8, rsi
cmp qword [rsp + 0x70], 5
cmovb r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.140018360
or ebx, 1
mov dword [rsp + 0x44], ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RadeonSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abb70
lea r9, [rsp + 0x80]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
cmp rsi, 8
cmovae r9, rdi
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abb36
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abb3c
sub r9, r10
cmp ax, cx
ja 0x1400abb3c
cmp rdx, 1
je 0x1400abb36
dec rdx
add r8, 2
movzx eax, word [r8 + r9]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abb17
jmp 0x1400abb3c
cmp rbx, 5
je 0x1400abb56
mov r8d, 9
lea rdx, str.Adrenalin
mov rcx, r14
call fcn.140018360
jmp 0x1400abc57
mov r8d, 9
lea rdx, str.Adrenalin
mov rcx, r15
call fcn.140018360
jmp 0x1400abc57
cmp eax, 0xea
jne 0x1400abc3f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RadeonSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abc3f
lea r9, [rsp + 0x80]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
cmp rsi, 8
cmovae r9, rdi
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abb36
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abb3c
sub r9, r10
cmp ax, cx
ja 0x1400abb3c
cmp rdx, 1
je 0x1400abb36
dec rdx
add r8, 2
movzx eax, word [r8 + r9]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abc15
jmp 0x1400abb3c
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x80]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FireproSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abd2a
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abcf0
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abcf6
sub r9, r10
cmp ax, cx
ja 0x1400abcf6
cmp rdx, 1
je 0x1400abcf0
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abcd1
jmp 0x1400abcf6
cmp rbx, 5
je 0x1400abd10
mov r8d, 3
lea rdx, [0x140234810]
mov rcx, r14
call fcn.140018360
jmp 0x1400abe00
mov r8d, 3
lea rdx, [0x140234810]
mov rcx, r15
call fcn.140018360
jmp 0x1400abe00
cmp eax, 0xea
jne 0x1400abe00
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FireproSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abe00
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abdce
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abdd4
sub r9, r10
cmp ax, cx
ja 0x1400abdd4
cmp rdx, 1
je 0x1400abdce
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abdaf
jmp 0x1400abdd4
cmp rbx, 5
je 0x1400abdeb
mov r8d, 3
lea rdx, [0x140234810]
mov rcx, r14
call fcn.140018360
jmp 0x1400abe00
mov r8d, 3
lea rdx, [0x140234810]
mov rcx, r15
call fcn.140018360
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CreatorSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abed3
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abe99
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abe9f
sub r9, r10
cmp ax, cx
ja 0x1400abe9f
cmp rdx, 1
je 0x1400abe99
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abe7a
jmp 0x1400abe9f
cmp rbx, 5
je 0x1400abeb9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r14
call fcn.140018360
jmp 0x1400abfa9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r15
call fcn.140018360
jmp 0x1400abfa9
cmp eax, 0xea
jne 0x1400abfa9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CreatorSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400abfa9
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400abf77
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400abf7d
sub r9, r10
cmp ax, cx
ja 0x1400abf7d
cmp rdx, 1
je 0x1400abf77
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400abf58
jmp 0x1400abf7d
cmp rbx, 5
je 0x1400abf94
mov r8d, 7
lea rdx, str.Creator
mov rcx, r14
call fcn.140018360
jmp 0x1400abfa9
mov r8d, 7
lea rdx, str.Creator
mov rcx, r15
call fcn.140018360
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CloudSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac07c
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ac042
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ac048
sub r9, r10
cmp ax, cx
ja 0x1400ac048
cmp rdx, 1
je 0x1400ac042
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ac023
jmp 0x1400ac048
cmp rbx, 5
je 0x1400ac062
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r14
call fcn.140018360
jmp 0x1400ac153
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r15
call fcn.140018360
jmp 0x1400ac153
cmp eax, 0xea
jne 0x1400ac153
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CloudSoftwareVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac153
lea r9, [rsp + 0x80]
cmp rsi, 8
cmovae r9, rdi
mov rdx, rbx
cmp rbx, 5
mov eax, 5
cmova rdx, rax
lea r10, str.21.09
mov r8, r10
test rdx, rdx
je 0x1400ac120
movzx eax, word [r9]
mov ecx, 0x32
cmp ax, cx
jb 0x1400ac126
sub r9, r10
cmp ax, cx
ja 0x1400ac126
cmp rdx, 1
je 0x1400ac120
dec rdx
add r8, 2
movzx eax, word [r9 + r8]
movzx ecx, word [r8]
cmp ax, cx
jae 0x1400ac101
jmp 0x1400ac126
cmp rbx, 5
je 0x1400ac13d
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r14
call fcn.140018360
jmp 0x1400ac153
mov r8d, 0xe
lea rdx, str.Cloud_Software
mov rcx, r15
call fcn.140018360
nop
cmp rsi, 8
jb 0x1400ac18e
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400ac186
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac275
mov rcx, rdi
call fcn.1401a9a50
mov esi, 5
xor edi, edi
mov ebx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
jmp 0x1400ab7c0
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400ac1f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400ac1f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400ac27b
call fcn.1401a9a50
movzx eax, byte [rsp + 0x40]
jmp 0x1400ac23c
mov rcx, qword [rsp + 0xcd0]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0xce0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1401e3dbc
int3
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3