Function at 0x100051d14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x100083138]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x88], rdx
mov r15, rcx
mov qword [r11 - 0x418], rcx
and qword [rsp + 0x70], 0
xor esi, esi
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x58]
call fcn.100020360
nop
mov r8, qword [r15]
lea rdx, [0x100013120]
lea ecx, [rsi + 1]
call fcn.100054fd8
lea rcx, [0x100012988]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x100051dae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10005236f
lea rdx, [0x1000129a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x100051ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100052366
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov rcx, qword [r15]
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x10005234d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x10005234d
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x100051e38
xor ecx, ecx
jmp 0x100051e4b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.10001ff98
lea rcx, [rsp + 0x60]
call fcn.10004bde4
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.100062b44
test eax, eax
jne 0x100051e8d
mov edi, 0x65b
jmp 0x100052366
and dword [rsp + 0x4c], 0
and dword [rsp + 0x48], 0
mov dword [rsp + 0xc8], 0x20
xor edi, edi
lea r8, [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x100052332
mov rbp, qword [rsp + 0x58]
add edi, 1
mov dword [rsp + 0x6c], edi
or r13, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.100020360
nop
xor edi, edi
mov dword [rsp + 0x44], edi
and qword [rsp + 0x20], rdi
mov r9d, 0xc8
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x100051f18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1000522a3
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x100051fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x100051f6a
movzx eax, r12w
or eax, 0x800f0000
jmp 0x100051f7a
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovle eax, r12d
cmp eax, 0x800f0204
je 0x100051f9f
lea r8, [rsp + 0xf0]
lea rdx, [0x1000131f0]
mov ecx, 2
call fcn.100054fd8
jmp 0x1000522a3
lea rcx, [rsp + 0x50]
call fcn.10002006c
jmp 0x1000522e1
mov rbx, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x100051fda
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.100020154
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jl 0x100052327
mov dword [rbx - 0x10], edi
and word [rbx + 0x208], 0
mov dword [rsp + 0x68], 0x208
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x100012b08]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100052079
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x10005230a
cmp ecx, dword [rbx - 0xc]
jg 0x10005230a
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
and word [rbx + rax*2], 0
lea r8, [rsp + 0xf0]
lea rdx, [0x100013250]
mov ecx, 2
call fcn.100054fd8
mov edi, dword [rsp + 0x44]
jmp 0x100052295
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x10005231c
cmp ecx, dword [rbx - 0xc]
jg 0x10005231c
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
and word [rbx + rax*2], 0
mov rax, rbp
sub rbx, rbp
movzx ecx, word [rax]
cmp cx, word [rax + rbx]
jne 0x1000520c4
add rax, 2
test cx, cx
jne 0x1000520ae
xor eax, eax
jmp 0x1000520c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100052279
lea r8, [rsp + 0xf0]
lea rdx, [0x1000132b0]
lea ebx, [rax + 1]
mov ecx, ebx
call fcn.100054fd8
mov edi, ebx
mov dword [rsp + 0x44], ebx
xor r9d, r9d
mov r8d, dword [rsp + 0xdc]
lea rdx, [rsp + 0xa4]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
je 0x1000521e8
cmp eax, 0x25
je 0x1000521e8
lea r8, [rsp + 0xf0]
lea rdx, [0x100013330]
mov ecx, ebx
call fcn.100054fd8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x10005215a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x10005227c
lea rax, [rsp + 0x90]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.100020428
mov rdi, rax
cmp dword [rbp - 8], ebx
jle 0x1000521a9
mov edx, dword [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.10002009c
mov rbp, qword [rsp + 0x58]
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.100020428
nop
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, r12
mov r8, rdi
mov rdx, rax
mov rcx, r13
call fcn.10005392c
mov r12d, eax
test eax, eax
jne 0x10005227c
jmp 0x100052279
lea r8, [rsp + 0xf0]
lea rdx, [0x1000133e0]
mov ecx, ebx
call fcn.100054fd8
and dword [rsp + 0x40], 0
and qword [rsp + 0x30], 0
mov ebx, 4
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rbx + 6]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
jne 0x100052244
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100052295
or dword [rsp + 0x40], 0x20
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
mov r8d, 0xa
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
jne 0x100052279
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100052295
xor r12d, r12d
cmp r13, 0xffffffffffffffff
je 0x100052291
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edi, dword [rsp + 0x44]
jmp 0x100052295
mov edi, dword [rsp + 0x44]
test r14, r14
je 0x1000522a3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
je 0x1000522d7
test edi, edi
je 0x1000522cf
lea r8, [rsp + 0xf0]
lea rdx, [0x100013470]
mov ecx, 3
call fcn.100054fd8
mov dword [rsp + 0x4c], 1
jmp 0x1000522d7
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
call fcn.10002006c
lea r8, [rsp + 0xc8]
mov edi, dword [rsp + 0x6c]
mov edx, edi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x100052315
mov r12, qword [rsp + 0x98]
jmp 0x100051ec5
mov ecx, 0x80070057
call fcn.1000201f8
nop
mov rbx, qword [rsp + 0x78]
jmp 0x100052332
mov ecx, 0x80070057
call fcn.1000201f8
int3
mov ecx, 0x80070057
call fcn.1000201f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x100052349
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100052366
xor edi, edi
jmp 0x100052366
mov r8, qword [r15]
lea rdx, [0x100013180]
mov ecx, 3
call fcn.100054fd8
mov edi, 0x65b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x1000523a8
cmp dword [rsp + 0x4c], edi
je 0x10005238f
lea rdx, [0x1000134d0]
lea ecx, [rdi + 3]
call fcn.100054fd8
mov edi, 0x643
jmp 0x1000523a8
cmp dword [rsp + 0x48], 0
je 0x1000523a8
lea rdx, [0x100013580]
mov ecx, 2
call fcn.100054fd8
nop
lea rcx, [rsp + 0x58]
call fcn.10002006c
nop
test rsi, rsi
je 0x1000523d4
lock add dword [rsi + 8], 0xffffffff
jne 0x1000523ce
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rsp + 0x60], 0
mov rcx, r15
call fcn.10002006c
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10006bd80
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret