Function at 0x140001f30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
lea rcx, [0x1400174c0]
mov r13d, ebp
lea edx, [rbp + 3]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140001fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_open_system_class_registry_key__error__d.
mov edx, 0x400
mov r9d, eax
lea rcx, [0x140025540]
call fcn.1400012b0
lea r9d, [rbp + 0x10]
xor ecx, ecx
lea r8, [0x140024cd0]
lea rdx, [0x140025540]
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rbp + 0xb]
jmp 0x140002271
mov r14d, 0x10
mov dword [rsp + 0x90], r14d
mov rcx, r14
call fcn.140007384
mov rbx, rax
test rax, rax
je 0x140002248
lea rax, [rsp + 0x90]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.LowerFilters
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 0xea
jne 0x140002017
mov rcx, rbx
call fcn.140007198
mov ecx, dword [rsp + 0x90]
jmp 0x140001fbf
test eax, eax
jne 0x14000203f
mov rax, rbx
cmp word [rbx], bp
je 0x14000205f
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bp
jne 0x140002027
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], bp
jne 0x140002023
jmp 0x14000205f
cmp eax, 8
je 0x140002240
cmp eax, 0x5aa
je 0x140002240
cmp eax, 2
jne 0x140002231
mov word [rbx], bp
mov r15, rbx
mov rdi, rbx
mov esi, ebp
cmp word [rbx], bp
je 0x14000209c
or rbp, 0xffffffffffffffff
xor eax, eax
inc rbp
cmp word [rdi + rbp*2], ax
jne 0x140002072
lea rdx, [0x14001f170]
mov rcx, rdi
inc rbp
call fcn.1400051e8
test eax, eax
je 0x1400020ca
lea rdi, [rdi + rbp*2]
xor ebp, ebp
cmp word [rdi], bp
jne 0x14000206c
mov eax, ebp
mov ecx, 1
cmp dword [rsp + 0x80], ebp
je 0x1400020db
test eax, eax
je 0x1400021b9
mov rcx, rbx
mov rsi, rbp
call fcn.140001e7c
mov rdi, rax
add rdi, rdi
jmp 0x14000217d
cmp rdi, rbx
mov ecx, 1
mov eax, ecx
cmove esi, ecx
xor ebp, ebp
jmp 0x1400020a3
test eax, eax
je 0x1400020f6
test r13d, r13d
je 0x1400020ee
test esi, esi
jne 0x1400021be
jmp 0x1400020f6
test esi, esi
jne 0x1400021c8
mov rcx, rbx
mov esi, 0xc
call fcn.140001e7c
mov rdi, rax
add rdi, rdi
lea rcx, [rdi + 0xc]
call fcn.140007384
mov r15, rax
test rax, rax
je 0x140002209
lea rcx, [rax + 0xc]
mov r8, rdi
mov rdx, rbx
call fcn.140003e60
mov rcx, rbx
call fcn.140007198
lea r8, [0x14001f170]
mov rdx, r15
sub r8, r15
lea ecx, [rsi - 6]
lea r14d, [rsi - 0xb]
lea rax, [rcx + 0x7ffffff8]
test rax, rax
je 0x14000216b
movzx eax, word [r8 + rdx]
test ax, ax
je 0x14000216b
mov word [rdx], ax
add rdx, 2
sub rcx, r14
jne 0x140002149
mov r14d, 0x10
test rcx, rcx
jne 0x14000217a
sub rdx, 2
mov word [rdx], bp
lea eax, [rsi + rdi]
mov r9d, 7
mov dword [rsp + 0x28], eax
lea rdx, str.LowerFilters
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r15
mov ebx, eax
call fcn.140007198
test ebx, ebx
jne 0x1400021e0
lea r13d, [rbx + 1]
jmp 0x140001fb4
test r13d, r13d
je 0x1400021c8
mov rax, qword [rsp + 0x88]
mov dword [rax], ecx
mov rcx, rbx
call fcn.140007198
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140002271
mov r9d, r14d
lea r8, [0x140024cd0]
lea rdx, str.Unable_to_update_system_class_filters.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xd
jmp 0x140002271
mov rcx, rbx
call fcn.140007198
mov r9d, r14d
lea r8, [0x140024cd0]
lea rdx, str.Out_of_memory_adding_filter.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x11
jmp 0x140002271
mov rcx, rbx
call fcn.140007198
mov edi, 0xc
jmp 0x14000224d
mov rcx, rbx
call fcn.140007198
mov edi, 0x11
mov r9d, r14d
lea r8, [0x140024cd0]
lea rdx, str.Unable_to_get_system_class_filters.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret