Function at 0x140002ec0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rdi, rdx
mov edx, 0xf003f
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov qword [rbp + 0x17], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140002efa
xor al, al
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0xd0], rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0xa8], rsi
lea r9, [rbp + 0x7f]
mov qword [rsp + 0xa0], r12
lea rdx, str.LowerFilters
xor r12d, r12d
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
mov qword [rsp + 0x98], r13
xor r8d, r8d
mov qword [rbp - 9], r12
mov rcx, r14
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x90], r15
movdqu xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003424
mov ebx, dword [rbp + 0x77]
mov r13d, r12d
shr rbx, 1
mov esi, r12d
mov qword [rbp - 1], r12
mov qword [rbp + 7], r12
je 0x140002f9f
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400025d0
mov r13, rax
mov qword [rbp - 1], rax
lea r8, [rbx + rbx]
xor edx, edx
add rax, r8
mov rcx, r13
mov qword [rbp + 7], rax
call fcn.140031130
mov rsi, r13
lea rax, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x7f]
lea rdx, str.LowerFilters
mov qword [rsp + 0x20], r13
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140002fe3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r15b, r15b
jmp 0x1400033e0
mov r14, r12
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], r12w
jne 0x140002ff0
test rbx, rbx
je 0x140003333
mov r9, rsi
nop word [rax + rax]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [r9 + rax*2], r12w
jne 0x140003020
cmp qword [rdi + 0x18], 8
mov r10, rdi
mov rcx, qword [rdi + 0x10]
jb 0x14000303b
mov r10, qword [rdi]
cmp rcx, rax
jne 0x14000307c
mov rax, r9
test rcx, rcx
je 0x14000308d
movzx edx, word [r10]
movzx r8d, word [r9]
cmp dx, r8w
jb 0x14000307c
sub r10, r9
cmp dx, r8w
ja 0x14000307c
cmp rcx, 1
je 0x14000308d
movzx edx, word [r10 + rax + 2]
add rax, 2
dec rcx
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14000305d
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x21], r9
lea rcx, [rbp - 0x19]
call fcn.1400015a0
inc rbx
add r14, rbx
mov rbx, 0xffffffffffffffff
lea r9, [rsi + r14*2]
nop
inc rbx
cmp word [r9 + rbx*2], r12w
jne 0x1400030a0
test rbx, rbx
jne 0x140003010
mov rdx, qword [rbp - 0x11]
mov r15, qword [rbp - 0x19]
cmp r15, rdx
je 0x140003333
mov rbx, r12
mov rcx, r15
nop word [rax + rax]
inc rbx
add rbx, qword [rcx + 0x10]
add rcx, 0x20
cmp rcx, rdx
jne 0x1400030d0
mov qword [rbp - 0x29], r12
xorps xmm0, xmm0
movabs r14, 0x7fffffffffffffff
movdqu xmmword [rbp - 0x39], xmm0
add rbx, 1
je 0x14000312a
cmp rbx, r14
ja 0x1400034c1
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400025d0
mov rdi, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rax, [rax + rbx*2]
movzx ebx, byte [rbp + 0x77]
mov qword [rbp - 0x29], rax
jmp 0x14000314d
mov rdi, qword [rbp - 0x31]
movzx ebx, byte [rbp + 0x77]
jmp 0x14000314d
movabs r14, 0x7fffffffffffffff
xor r12d, r12d
cmp qword [r15 + 0x18], 8
jb 0x140003161
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15]
lea r9, [rax + rcx*2]
jmp 0x14000316e
mov rax, qword [r15 + 0x10]
mov r8, r15
lea r9, [r15 + rax*2]
jb 0x140003171
mov r8, qword [r15]
mov rdx, rdi
mov byte [rsp + 0x20], bl
lea rcx, [rbp - 0x39]
call fcn.1400011e0
mov rdi, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x29]
cmp rdi, rsi
je 0x14000319f
mov r14, qword [rbp - 0x39]
mov word [rdi], r12w
add rdi, 2
jmp 0x14000325a
mov r13, qword [rbp - 0x39]
sub rdi, r13
mov rax, rdi
sar rax, 1
mov qword [rbp - 0x21], rax
cmp rax, r14
je 0x1400034c1
lea rdx, [rax + 1]
sub rsi, r13
sar rsi, 1
mov rax, r14
mov rcx, rsi
mov qword [rbp + 0xf], rdx
shr rcx, 1
sub rax, rcx
cmp rsi, rax
jbe 0x1400031dd
mov r12, r14
jmp 0x1400031e8
lea r12, [rcx + rsi]
cmp r12, rdx
cmovb r12, rdx
mov rdx, r12
lea rcx, [rbp - 0x39]
call fcn.1400025d0
mov r14, rax
xor ecx, ecx
mov rax, qword [rbp - 0x21]
mov r8, rdi
mov rdx, r13
mov word [r14 + rax*2], cx
mov rcx, r14
call fcn.140030a80
test r13, r13
je 0x140003246
lea rdx, [rsi + rsi]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000323e
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034bb
mov rcx, r13
call fcn.14002fbbc
mov rax, qword [rbp + 0xf]
lea rsi, [r14 + r12*2]
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], rsi
lea rdi, [r14 + rax*2]
add r15, 0x20
mov qword [rbp - 0x31], rdi
mov r12, rdi
cmp r15, qword [rbp - 0x11]
jne 0x140003140
cmp rdi, rsi
je 0x140003286
mov r13, qword [rbp - 1]
xor eax, eax
mov word [rdi], ax
add r12, 2
jmp 0x14000334d
sub r12, r14
movabs rbx, 0x7fffffffffffffff
mov r15, r12
sar r15, 1
cmp r15, rbx
je 0x1400034c1
sub rsi, r14
lea r13, [r15 + 1]
sar rsi, 1
mov rax, rbx
mov rcx, rsi
shr rcx, 1
sub rax, rcx
cmp rsi, rax
ja 0x1400032c8
lea rbx, [rcx + rsi]
cmp rbx, r13
cmovb rbx, r13
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400025d0
mov rdi, rax
mov r8, r12
xor eax, eax
mov rdx, r14
mov rcx, rdi
mov word [rdi + r15*2], ax
call fcn.140030a80
test r14, r14
je 0x140003322
lea rdx, [rsi + rsi]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000331a
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034bb
mov rcx, r14
call fcn.14002fbbc
lea r12, [rdi + r13*2]
mov r14, rdi
mov r13, qword [rbp - 1]
lea rsi, [rdi + rbx*2]
jmp 0x14000334d
mov ecx, 2
call fcn.14002fb80
mov r14, rax
lea rsi, [rax + 2]
xor eax, eax
mov word [r14], ax
mov r12, rsi
mov rdi, qword [rbp + 0x17]
lea rdx, str.LowerFilters
sub r12, r14
mov r9d, 7
sar r12, 1
xor r8d, r8d
add r12d, r12d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
test eax, eax
je 0x140003399
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r15b, r15b
jmp 0x1400033a2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15b, 1
test r14, r14
je 0x1400033e0
sub rsi, r14
sar rsi, 1
add rsi, rsi
cmp rsi, 0x1000
jb 0x1400033d5
mov rcx, qword [r14 - 8]
add rsi, 0x27
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x1400034bb
mov r14, rcx
mov rdx, rsi
mov rcx, r14
call fcn.14002fbbc
test r13, r13
je 0x140003435
mov rcx, qword [rbp + 7]
mov rax, r13
sub rcx, r13
sar rcx, 1
add rcx, rcx
cmp rcx, 0x1000
jb 0x140003417
mov r13, qword [r13 - 8]
add rcx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034bb
mov rdx, rcx
mov rcx, r13
call fcn.14002fbbc
jmp 0x140003435
mov rcx, r14
cmp eax, 2
jne 0x14000347a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15b, 1
mov rsi, qword [rbp - 0x19]
test rsi, rsi
je 0x140003483
mov rdi, qword [rbp - 0x11]
mov rbx, rsi
cmp rsi, rdi
je 0x140003461
nop word [rax + rax]
mov rcx, rbx
call fcn.140001730
add rbx, 0x20
cmp rbx, rdi
jne 0x140003450
mov r8, qword [rbp - 9]
lea rcx, [rbp - 0x19]
sub r8, rsi
mov rdx, rsi
sar r8, 5
call fcn.1400028d0
jmp 0x140003483
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15b, r15b
mov r13, qword [rsp + 0x98]
movzx eax, r15b
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
call fcn.140035ecc
int3
call fcn.140001e50
int3