Function at 0x140003460
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
mov rax, qword [0x140020018]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x8f]
xor esi, esi
mov r15, qword [rbp + 0xa7]
mov rbx, rcx
mov rdi, qword [rbp + 0x6f]
mov rcx, r8
mov r14, qword [rbp + 0x97]
mov r13d, esi
mov qword [rbp - 0x49], rax
mov r12d, esi
mov rax, qword [rbp + 0x9f]
mov qword [rbp - 0x39], rdx
lea edx, [rsi + 1]
mov qword [rbp - 0x41], r9
mov qword [rbp - 0x51], r8
mov qword [rbp - 0x61], rax
mov dword [rbp - 0x6d], esi
mov qword [rbp - 0x69], rsi
mov dword [r15], esi
call fcn.140003dd0
test eax, eax
jne 0x14000352a
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0xec
mov ecx, 1
lea r8, str.....DriverLibrariesDrvSupLibinstall.c
mov dword [rsp + 0x28], ecx
lea rdx, str.May_15_2016
mov qword [rsp + 0x20], rax
call fcn.140004dc0
xor eax, eax
jmp 0x140003b88
test rdi, rdi
je 0x140003566
mov rcx, qword [rbp - 0x51]
mov rdx, rdi
call fcn.140004340
test eax, eax
jne 0x140003566
mov ecx, 0x7d1
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0xf4
jmp 0x140003502
lea r8, [rbp - 0x31]
mov rcx, rbx
lea rdx, [rbp - 0x71]
call fcn.140004200
test eax, eax
jne 0x1400035cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400035c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x102
mov ecx, 1
lea r8, str.....DriverLibrariesDrvSupLibinstall.c
mov dword [rsp + 0x28], ecx
lea rdx, str.May_15_2016
mov qword [rsp + 0x20], rax
call fcn.140004dc0
jmp 0x140003b3e
mov dword [rbp - 0x71], esi
jmp 0x140003a51
cmp dword [rbp - 0x71], esi
je 0x140003a51
mov rdi, qword [rbp - 0x61]
test r14, r14
je 0x140003658
cmp dword [r14], esi
jbe 0x140003658
cmp dword [rbp - 0x2d], 4
jne 0x140003609
mov rdx, rdi
mov rcx, rbx
call fcn.140004b30
test eax, eax
jne 0x140003602
mov dword [r15], 1
jmp 0x140003609
mov dword [rbp - 0x6d], 1
lea r8, [rbp - 0x31]
mov rcx, rbx
lea rdx, [rbp - 0x71]
call fcn.140004200
test eax, eax
je 0x140003a4b
cmp dword [rbp - 0x71], esi
je 0x140003a4e
mov rdx, r14
mov rcx, rbx
call fcn.1400033e0
test eax, eax
jne 0x140003658
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x134
jmp 0x14000359f
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.140003f70
test eax, eax
jne 0x14000369e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140003692
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x13d
jmp 0x14000359f
mov dword [r15], 1
jmp 0x140003a51
mov rcx, qword [rbp - 0x69]
mov edx, 1
call fcn.140003dd0
test eax, eax
jne 0x1400036b9
mov dword [rbp - 0x61], 1
jmp 0x1400036e6
mov rdx, qword [rbp - 0x69]
lea r9, [rbp - 0x61]
mov rcx, qword [rbp - 0x51]
mov r8d, 1
call fcn.140003bb0
test eax, eax
jne 0x1400036dd
mov dword [rbp - 0x61], 1
jmp 0x1400036e6
cmp dword [rbp - 0x61], esi
jle 0x14000386e
cmp dword [rbp - 0x2d], 4
jne 0x14000372c
mov rdx, rdi
mov rcx, rbx
call fcn.140004b30
test eax, eax
jne 0x140003704
mov dword [r15], 1
jmp 0x14000370b
mov dword [rbp - 0x6d], 1
lea r8, [rbp - 0x31]
mov rcx, rbx
lea rdx, [rbp - 0x71]
call fcn.140004200
test eax, eax
je 0x140003a4b
cmp dword [rbp - 0x71], esi
je 0x140003a4e
mov rdi, qword [rbp - 0x51]
mov r9d, 1
mov rdx, qword [rbp - 0x69]
mov rcx, rdi
xor r8d, r8d
call fcn.140003ca0
test eax, eax
jne 0x140003839
mov rax, qword [rbp - 0x69]
or rcx, 0xffffffffffffffff
mov dword [r15], 1
nop dword [rax]
cmp word [rax + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x140003760
lea rcx, [rcx*2 + 0xa]
call fcn.140008710
mov r13, rax
test rax, rax
jne 0x14000379f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x17d
jmp 0x14000359f
mov rcx, qword [rbp - 0x69]
mov rdx, rax
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400037b0
lea rcx, [r13 - 2]
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1400037d0
movsd xmm0, qword [str..tmp]
mov r9d, 1
movsd qword [rcx], xmm0
mov r8d, r9d
movzx eax, word [0x140015588]
mov rdx, r13
mov word [rcx + 8], ax
mov rcx, qword [rbp - 0x69]
call fcn.140004530
test eax, eax
je 0x1400038a6
mov rdx, qword [rbp - 0x69]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call fcn.140003ca0
test eax, eax
je 0x1400038a6
xor edx, edx
mov rcx, r13
lea r9d, [rdx + 1]
lea r8d, [rdx + 4]
call fcn.140004530
cmp dword [r15], esi
jne 0x14000386e
mov rcx, rbx
call fcn.140004a10
test eax, eax
je 0x140003867
lea r8, [rbp - 0x31]
mov dword [rbp - 0x6d], esi
lea rdx, [rbp - 0x71]
mov rcx, rbx
call fcn.140004200
test eax, eax
je 0x140003867
cmp dword [rbp - 0x2d], 4
je 0x14000386e
mov dword [r15], 1
mov edx, 3
mov rcx, rbx
call fcn.140003170
mov r12, rax
test rax, rax
jne 0x14000392f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x1ca
jmp 0x14000359f
mov rdx, qword [rbp - 0x69]
mov r9d, 1
mov r8d, r9d
mov rcx, r13
call fcn.140004530
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call fcn.140003ca0
test eax, eax
jne 0x1400038f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x199
jmp 0x14000359f
mov rdx, qword [rbp - 0x69]
mov r9d, 1
mov rcx, r13
lea r8d, [r9 + 4]
call fcn.140004530
test eax, eax
jne 0x140003839
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x1a2
jmp 0x14000359f
lea rax, [rbp - 0x59]
mov dword [rbp - 0x59], 4
mov qword [rsp + 0x28], rax
lea rdx, str.DeleteFlag
lea rax, [rbp - 0x55]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003a3a
cmp dword [rbp - 0x55], esi
je 0x140003a3a
lea rdx, str.DeleteFlag
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400039aa
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x1db
jmp 0x14000359f
lea rax, [rbp - 0x59]
mov dword [rbp - 0x59], 4
mov qword [rsp + 0x28], rax
lea rdx, str.Start
lea rax, [rbp - 0x55]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003a3a
mov eax, dword [rbp + 0x7f]
cmp dword [rbp - 0x55], eax
je 0x140003a3a
lea rax, [rbp + 0x7f]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Start
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140003a3a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x1f1
jmp 0x14000359f
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, rsi
jmp 0x140003af2
mov dword [rbp - 0x71], esi
mov dword [rbp - 0x6d], esi
mov rax, qword [rbp - 0x49]
mov rdx, rbx
mov r9d, dword [rbp + 0x7f]
mov rcx, rbx
mov r8d, dword [rbp + 0x77]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x41]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x51]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x87]
mov dword [rsp + 0x20], eax
call fcn.1400045c0
test eax, eax
jne 0x140003aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x208
jmp 0x14000359f
test r14, r14
je 0x140003adf
mov rdx, r14
mov rcx, rbx
call fcn.1400033e0
test eax, eax
jne 0x140003adf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140015538]
call fcn.140004cf0
mov r9d, 0x215
jmp 0x14000359f
mov rcx, rbx
call fcn.140004a10
test eax, eax
jne 0x140003af2
mov dword [r15], 1
mov r9, qword [rbp - 0x39]
test r9, r9
je 0x140003b39
mov r8, qword [str.82B5234F_DF61_4638_95D5_341CAD244D19]
mov rax, r9
sub r8, r9
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003b23
inc rax
test ecx, ecx
jne 0x140003b10
mov rcx, rbx
test edx, edx
jne 0x140003b31
call fcn.140002fe0
jmp 0x140003b39
mov rdx, r9
call fcn.140003210
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test r12, r12
je 0x140003b54
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x69]
call fcn.1400086fc
mov rcx, r13
call fcn.1400086fc
cmp dword [rbp - 0x6d], 0
je 0x140003b7e
mov rcx, rbx
call fcn.140004a10
test eax, eax
jne 0x140003b7e
mov dword [r15], 1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140005250
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret