Function at 0x140001770
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x140080020]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov ebx, r8d
mov rsi, rdx
mov edx, 0xf003f
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400017b6
xor al, al
jmp 0x140001c43
lea rax, str.LowerFilters
lea r15, str.UpperFilters
cmp ebx, 1
cmove r15, rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
xor r12d, r12d
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 9]
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001b0c
xorps xmm0, xmm0
mov edi, dword [rbp - 0x41]
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r12
cmp rdi, 2
jb 0x140001880
and rdi, 0xfffffffffffffffe
cmp rdi, 0x1000
jb 0x140001851
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140001c6d
call fcn.1400398f0
mov rcx, rax
test rax, rax
je 0x140001c67
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001863
test rdi, rdi
je 0x140001860
mov rcx, rdi
call fcn.1400398f0
jmp 0x140001863
mov rax, r12
mov qword [rbp - 1], rax
lea rbx, [rdi + rax]
mov qword [rbp + 0xf], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14003c150
mov qword [rbp + 7], rbx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 9]
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400018c3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x140001ac3
mov rdi, r12
mov rcx, qword [rbp - 1]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x1400018d1
mov r9, qword [rbp - 0x31]
test rbx, rbx
je 0x140001983
mov rdx, r12
nop dword [rax + rax]
add rdx, rcx
mov qword [rbp - 0x49], rdx
cmp r9, qword [rbp - 0x29]
je 0x140001941
mov qword [r9], r12
mov qword [r9 + 0x10], r12
mov qword [r9 + 0x18], 7
mov word [r9], r12w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140001920
mov rcx, r9
call fcn.140002800
mov r9, qword [rbp - 0x31]
add r9, 0x20
mov qword [rbp - 0x31], r9
jmp 0x140001955
lea r8, [rbp - 0x49]
mov rdx, r9
lea rcx, [rbp - 0x39]
call fcn.1400029e0
mov r9, qword [rbp - 0x31]
inc rbx
add rdi, rbx
lea rdx, [rdi + rdi]
mov rcx, qword [rbp - 1]
lea rax, [rcx + rdx]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140001970
test rbx, rbx
jne 0x1400018f0
mov r8, qword [rbp - 0x39]
cmp r8, r9
je 0x1400019d9
mov r11, qword [rsi + 0x18]
mov rbx, qword [rsi + 0x10]
mov rcx, rsi
cmp r11, 8
jb 0x1400019a0
mov rcx, qword [rsi]
mov r10, r8
cmp qword [r8 + 0x18], 8
jb 0x1400019ad
mov r10, qword [r8]
mov rdx, qword [r8 + 0x10]
cmp rdx, rbx
jne 0x1400019f1
test rdx, rdx
je 0x1400019d4
sub r10, rcx
nop
movzx eax, word [rcx]
cmp word [r10 + rcx], ax
jne 0x1400019f1
add rcx, 2
sub rdx, 1
jne 0x1400019c0
cmp r8, r9
jne 0x140001a0b
cmp r9, qword [rbp - 0x29]
je 0x1400019fc
mov rdx, rsi
mov rcx, r9
call fcn.1400031b0
add qword [rbp - 0x31], 0x20
jmp 0x140001a0b
add r8, 0x20
cmp r8, r9
je 0x1400019d9
jmp 0x140001994
mov r8, rsi
mov rdx, r9
lea rcx, [rbp - 0x39]
call fcn.140002cd0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x21]
call fcn.1400012d0
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
sub rax, rcx
sar rax, 1
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, r14
test eax, eax
je 0x140001a6e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x140001a76
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140001ac3
mov rax, qword [rbp - 0x11]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c73
call fcn.14003992c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r12
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140001bf9
mov rax, qword [rbp + 0xf]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001be7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c67
jmp 0x140001be7
cmp eax, 2
jne 0x140001bee
mov rax, qword [rbp - 0x31]
cmp rax, qword [rbp - 0x29]
je 0x140001b31
mov rdx, rsi
mov rcx, rax
call fcn.1400031b0
add qword [rbp - 0x31], 0x20
jmp 0x140001b40
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140002cd0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x21]
call fcn.1400012d0
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
sub rax, rcx
sar rax, 1
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, r14
test eax, eax
je 0x140001ba3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x140001bab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140001bf9
mov rax, qword [rbp - 0x11]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001be7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c79
call fcn.14003992c
jmp 0x140001bf9
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140001c40
mov rdx, qword [rbp - 0x31]
call fcn.140003120
mov rdx, qword [rbp - 0x29]
mov rcx, qword [rbp - 0x39]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c61
call fcn.14003992c
movzx eax, bl
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400398d0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400402c0
nop
call fcn.1400402c0
nop
call fcn.140001210
nop
call fcn.1400402c0
nop
call fcn.1400402c0
int3