Function at 0x1400219c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8450]
mov eax, 0x8550
call fcn.140070d90
sub rsp, rax
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x8440], rax
mov r12, rcx
mov qword [rbp - 0x38], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x230]
call fcn.140072740
mov dword [rsp + 0x70], 0x104
xor edi, edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], 0x3fff
mov dword [rsp + 0x68], edi
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140021a42
mov rdx, qword [r12]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140021f7b
lea rax, [rbp - 0x48]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x230]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x140021c1b
mov ebx, edi
lea rsi, str.LowerFilters
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x64], 0x3fff
mov word [rbp + 0x440], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x64]
lea r8, [rbp + 0x440]
mov edx, ebx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140021c0f
cmp dword [rsp + 0x68], 7
jne 0x140021c0f
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
lea rax, [rbp + 0x440]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140021b62
lea rdx, [rbp + 0x440]
lea rcx, [rbp - 0x30]
call fcn.1400027d0
lea r9, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r11, qword [rbp - 0x18]
cmp r11, 8
cmovae r9, r10
cmp qword [rbp - 0x20], 0xc
jne 0x140021bd4
mov r8d, 0xc
mov rax, rsi
movzx ecx, word [r9]
mov edx, 0x4c
cmp cx, dx
jb 0x140021bd4
sub r9, rsi
cmp cx, dx
ja 0x140021bd4
cmp r8, 1
je 0x140021dc0
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140021bb4
cmp r11, 8
jb 0x140021c0f
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140021c07
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002201b
mov rcx, r10
call fcn.140070654
inc ebx
cmp ebx, dword [rsp + 0x6c]
jb 0x140021af0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140021f7b
mov r13d, edi
movabs rbx, 0x7ffffffffffffffe
mov dword [rsp + 0x74], 0xff
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x74]
lea r8, [rbp + 0x30]
mov edx, r13d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140021f6d
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], di
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140021c92
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400027d0
nop
mov rcx, qword [r12 + 0x10]
mov rax, rbx
sub rax, rcx
mov rdx, qword [rbp - 0x20]
cmp rax, rdx
jb 0x140021ffd
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x140021cd2
mov r9, qword [r12]
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rax, qword [rbp - 0x30]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.140018a00
nop
mov r8d, 1
lea rdx, [0x1400bc204]
lea rcx, [rbp - 0x10]
call fcn.140014b80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140021d6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022009
call fcn.140070654
mov qword [rbp], rdi
mov qword [rbp + 8], 7
mov word [rbp - 0x10], di
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea r14, [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov r15, qword [rbp + 0x28]
cmp r15, 8
cmovae r14, rbx
mov rsi, qword [rbp + 0x20]
cmp rsi, 8
jae 0x140021e44
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], 7
jmp 0x140021ed9
cmp r11, 8
jb 0x140021dfc
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140021df3
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002201b
mov rcx, r10
call fcn.140070654
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140021e3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140021e38
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022003
mov rcx, r8
call fcn.140070654
mov al, 1
jmp 0x140021fba
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140022021
add rcx, rcx
cmp rcx, 0x1000
jb 0x140021eae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140022021
mov rcx, rax
call fcn.1400703c8
mov rcx, rax
test rax, rax
je 0x14002200f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140021ebc
test rcx, rcx
je 0x140021eba
call fcn.1400703c8
jmp 0x140021ebc
xor eax, eax
mov qword [rbp - 0x80], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140072090
mov qword [rbp - 0x68], rdi
xor edi, edi
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
call fcn.1400219c0
nop
cmp r15, 8
jb 0x140021f23
lea rdx, [r15*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140021f1a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022015
mov rcx, rbx
call fcn.140070654
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140021f63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021f5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002201b
call fcn.140070654
movabs rbx, 0x7ffffffffffffffe
inc r13d
cmp r13d, dword [rsp + 0x60]
jb 0x140021c34
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140021fb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140021fb3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022003
mov rcx, r8
call fcn.140070654
xor al, al
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 7
mov word [r12], di
mov rcx, qword [rbp + 0x8440]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x8550]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400020a0
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.140002000
int3