Function at 0x14006530f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14006a140
push rbp
push rdi
sub rsp, 0x7d8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x1f6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140166008]
xor rax, rbp
mov qword [rbp + 0x798], rax
lea rcx, [0x140177005]
call fcn.140065f12
mov qword [rbp + 8], 0
mov byte [rbp + 0x44], 0
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x2b4], 0x104
mov qword [rbp + 0x2d8], 0
mov byte [rbp + 0x2f4], 0
lea rax, [rbp + 0x320]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rbp + 0x548], 0
mov r8d, 0x104
xor edx, edx
lea rcx, [rbp + 0x320]
call fcn.140065328
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14006a221
jmp 0x14006a4ab
lea rax, [rbp + 0x2b4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x64]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14006a272
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x44], 1
jmp 0x14006a4ab
lea rax, [rbp + 0x90]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
movzx eax, word [rax]
test eax, eax
je 0x14006a2e0
lea rdx, str.memctl
mov rcx, qword [rbp + 0x2d8]
call fcn.140065df0
test eax, eax
jne 0x14006a2ae
mov byte [rbp + 0x2f4], 1
jmp 0x14006a2e0
mov rcx, qword [rbp + 0x2d8]
call fcn.140063334
mov rcx, qword [rbp + 0x2d8]
lea rax, [rcx + rax*2]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
add rax, 2
mov qword [rbp + 0x2d8], rax
jmp 0x14006a280
movzx eax, byte [rbp + 0x2f4]
cmp eax, 1
je 0x14006a304
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x44], 1
jmp 0x14006a4ab
lea rax, [rbp + 0x90]
mov qword [rbp + 0x2d8], rax
lea rax, [rbp + 0x320]
mov qword [rbp + 0x548], rax
mov dword [rbp + 0x2b4], 0
mov rax, qword [rbp + 0x2d8]
movzx eax, word [rax]
test eax, eax
je 0x14006a425
lea rdx, str.memctl
mov rcx, qword [rbp + 0x2d8]
call fcn.140065df0
test eax, eax
je 0x14006a3f0
mov rdx, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x548]
call fcn.14006404a
mov rcx, qword [rbp + 0x548]
call fcn.140063334
inc rax
cdqe
mov ecx, dword [rbp + 0x2b4]
lea rax, [rcx + rax*2]
mov dword [rbp + 0x2b4], eax
mov rcx, qword [rbp + 0x548]
call fcn.140063334
mov rcx, qword [rbp + 0x548]
lea rax, [rcx + rax*2]
mov qword [rbp + 0x548], rax
mov rcx, qword [rbp + 0x2d8]
call fcn.140063334
mov rcx, qword [rbp + 0x2d8]
lea rax, [rcx + rax*2]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x548]
add rax, 2
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x2d8]
add rax, 2
mov qword [rbp + 0x2d8], rax
jmp 0x14006a32a
mov rcx, qword [rbp + 0x2d8]
call fcn.140063334
mov rcx, qword [rbp + 0x2d8]
lea rax, [rcx + rax*2]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
add rax, 2
mov qword [rbp + 0x2d8], rax
jmp 0x14006a32a
cmp dword [rbp + 0x2b4], 0
jne 0x14006a451
lea rdx, str.UpperFilters
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x44], 1
jmp 0x14006a4ab
mov eax, dword [rbp + 0x2b4]
inc eax
mov dword [rbp + 0x2b4], eax
mov eax, dword [rbp + 0x2b4]
inc eax
mov dword [rbp + 0x2b4], eax
mov eax, dword [rbp + 0x2b4]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x44], 1
movzx eax, byte [rbp + 0x44]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140135470]
call fcn.1400656e8
mov eax, edi
mov rcx, qword [rbp + 0x798]
xor rcx, rbp
call fcn.14006473e
lea rsp, [rbp + 0x7a8]
pop rdi
pop rbp
ret