Function at 0x1400071a0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140079258]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r13d, r9d
movzx r12d, r8w
mov r15, rdx
mov r14, rcx
movzx eax, byte [rbp + 0xe0]
mov byte [0x14007bc64], al
test al, al
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, [0x140057270]
mov rcx, rbx
call fcn.140003de0
call fcn.1400069b0
mov rbx, rax
mov r9d, 0x1bb
lea r8, str.c:jaworkspacecommon_ati_cdp4443productinst_suppinst_drvinst_drv.cpp
lea rdx, str._hs__d__:
mov rcx, rax
call fcn.140003db0
xor ecx, ecx
call fcn.140039c58
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.140039904
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rax + 4]
mov r8d, dword [rax + 8]
lea rdx, str.__d:_d:_d_
mov rcx, rbx
call fcn.140003db0
lea rdx, [0x140057270]
mov rcx, rbx
call fcn.140003de0
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea r8, str.InstallDriver
lea rdx, str.Procedure_Started:___s_
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, str.with_next_parameters:
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r9, r14
lea r8, str.InfName
lea rdx, str.___s___ls
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r9, r15
lea r8, str.DeviceDescription
lea rdx, str.___s___s
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
movzx r9d, r12w
lea r8, str.Instance
lea rdx, str.___s___hd
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x1400073cb
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r9d, r13d
lea r8, str.Disposition
lea rdx, str.___s___u
mov rcx, rbx
call fcn.140003de0
mov qword [rbp - 0x50], 7
xor esi, esi
mov qword [rbp - 0x58], rsi
mov word [rbp - 0x68], si
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.140006530
mov edi, eax
test eax, eax
jne 0x140007d35
call fcn.140006a20
mov edi, eax
cmp eax, 1
jne 0x14000783a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test eax, eax
jne 0x140007451
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140007483
cmp byte [0x14007bc64], 0
je 0x140007483
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.RegCreateKeyEx__:_completed_with_error__u.
mov rcx, rbx
call fcn.140003de0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlClass71a27cdd_812a_11d0_bec7_08002be2092f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x14000756e
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x60], 1
jne 0x140007561
mov ecx, dword [rsp + 0x58]
call fcn.140038378
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
lea r9d, [rdi + 7]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.140038370
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400075a0
cmp byte [0x14007bc64], 0
je 0x1400075a0
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.RegOpenKeyEx__:_completed_with_error__u.
mov rcx, rbx
call fcn.140003de0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlClass4d36e967_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x14000768b
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x60], 1
jne 0x14000767e
mov ecx, dword [rsp + 0x58]
call fcn.140038378
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
lea r9d, [rdi + 7]
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.140038370
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400076bd
cmp byte [0x14007bc64], 0
je 0x1400076bd
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.RegOpenKeyEx2__:_completed_with_error__u.
mov rcx, rbx
call fcn.140003de0
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x60]
call fcn.1400082c0
mov edi, eax
mov rsi, qword [rsp + 0x60]
test eax, eax
jne 0x1400077f1
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rdx, [0x140056e50]
mov rcx, rsi
cmp eax, 0x80000000
jb 0x14000778a
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000774a
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x48]
call fcn.14000b090
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000771c
mov rax, qword [rax]
movzx edx, byte [rbp + 0xe0]
mov byte [rsp + 0x20], dl
mov r9d, r13d
movzx r8d, r12w
mov rdx, r15
mov rcx, rax
call rbx
mov edi, eax
cmp qword [rbp - 0x30], 0x10
jb 0x140007752
mov rcx, qword [rbp - 0x48]
call fcn.1400376e4
jmp 0x140007752
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x140007823
cmp byte [0x14007bc64], 0
je 0x140007823
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, str.InstallDriver__:_completed_with_error__u.
jmp 0x140007818
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400077bc
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
movzx edx, byte [rbp + 0xe0]
mov byte [rsp + 0x20], dl
mov r9d, r13d
movzx r8d, r12w
mov rdx, r15
call rax
jmp 0x1400077c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x140007823
cmp byte [0x14007bc64], 0
je 0x140007823
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, str.InstallDriver2__:_completed_with_error__u.
jmp 0x140007818
cmp byte [0x14007bc64], 0
je 0x140007823
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, str.LoadSetupDll__:_completed_with_error__u.
mov r8d, edi
mov rcx, rbx
call fcn.140003de0
test rsi, rsi
je 0x140007d6b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140007d6b
cmp eax, 2
jne 0x140007cfc
mov r8d, esi
lea rax, str._install:
nop dword [rax]
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140007850
lea rdx, str._install:
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rsi
mov word [rsp + 0x78], si
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x14000788f
mov r8, rsi
jmp 0x14000789e
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007893
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140004610
nop
mov rcx, rbx
call fcn.140038370
mov r8d, 1
lea rdx, [0x1400576cc]
lea rcx, [rsp + 0x78]
call fcn.140009c00
mov r8d, esi
lea rax, str._inf_name:
nop word [rax + rax]
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400078e0
lea rdx, str._inf_name:
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x14000790e
mov r8, rsi
jmp 0x14000791d
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007912
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140009c00
mov r8d, 1
lea rdx, [0x14005741c]
mov rcx, rax
call fcn.140009c00
cmp word [r14], 0
jne 0x14000794b
mov r8, rsi
jmp 0x14000795b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [r14 + r8*2], 0
jne 0x140007950
mov rdx, r14
mov rcx, rax
call fcn.140009c00
mov r8d, 2
lea rdx, [0x140057420]
mov rcx, rax
call fcn.140009c00
nop
mov rcx, rbx
call fcn.140038370
test r15, r15
je 0x140007a7e
mov r8d, esi
cmp byte [r15], r8b
je 0x1400079ac
mov rax, r15
nop dword [rax + rax]
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400079a0
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.1400034f0
nop
mov r8d, esi
lea rax, str._descr:
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400079c4
lea rdx, str._descr:
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov rdi, qword [rsp + 0x50]
cmp word [rdi], 0
jne 0x1400079f2
mov r8, rsi
jmp 0x140007a0b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140007a00
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140009c00
mov r8d, 1
lea rdx, [0x14005741c]
mov rcx, rax
call fcn.140009c00
mov rbx, qword [rsp + 0x68]
cmp word [rbx], 0
jne 0x140007a3d
mov r8, rsi
jmp 0x140007a4c
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007a41
mov rdx, rbx
mov rcx, rax
call fcn.140009c00
mov r8d, 2
lea rdx, [0x140057420]
mov rcx, rax
call fcn.140009c00
nop
mov rcx, rdi
call fcn.140038370
nop
mov rcx, rbx
call fcn.140038370
mov r8b, 4
movzx edx, r12w
lea rcx, [rbp - 0x20]
call fcn.140033030
mov r8d, esi
lea rax, str._instance:
nop dword [rax + rax]
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140007aa0
lea rdx, str._instance:
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x140007ace
mov r8, rsi
jmp 0x140007add
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007ad2
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140009c00
cmp word [rbp - 0x20], 0
jne 0x140007af6
mov r8, rsi
jmp 0x140007b0b
lea rcx, [rbp - 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rcx + r8*2], 0
jne 0x140007b00
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140009c00
mov r8d, 1
lea rdx, [0x1400576cc]
mov rcx, rax
call fcn.140009c00
nop
mov rcx, rbx
call fcn.140038370
mov r8b, 4
mov edx, r13d
lea rcx, [rbp - 0x20]
call fcn.1400330d0
mov r8d, esi
lea rax, str._disposition:
nop
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140007b50
lea rdx, str._disposition:
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x140007b7e
mov r8, rsi
jmp 0x140007b8d
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007b82
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140009c00
cmp word [rbp - 0x20], 0
jne 0x140007ba6
mov r8, rsi
jmp 0x140007bbb
lea rcx, [rbp - 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rcx + r8*2], 0
jne 0x140007bb0
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140009c00
nop
mov rcx, rbx
call fcn.140038370
movzx edx, byte [rbp + 0xe0]
test dl, dl
je 0x140007c53
mov r8d, 1
lea rdx, [0x1400576cc]
lea rcx, [rsp + 0x78]
call fcn.140009c00
mov r8d, esi
lea rax, str._log
nop dword [rax]
inc r8d
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140007c00
lea rdx, str._log
lea rcx, [rsp + 0x50]
call fcn.1400034f0
nop
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x140007c2e
mov r8, rsi
jmp 0x140007c3d
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140007c32
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140009c00
nop
mov rcx, rbx
call fcn.140038370
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
cmp word [rdx], 0
je 0x140007c8a
or rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x140007c80
mov r8, rsi
lea rcx, [rbp - 0x48]
call fcn.140004610
nop
lea rcx, [rbp - 0x48]
call fcn.140007e10
mov edi, eax
cmp qword [rbp - 0x30], 8
jb 0x140007cb2
mov rcx, qword [rbp - 0x48]
call fcn.1400376e4
test edi, edi
je 0x140007ce9
cmp byte [0x14007bc64], 0
je 0x140007ce9
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.InvokeSetupApp__:_completed_with_error__u.
mov rcx, rbx
call fcn.140003de0
nop
cmp qword [rbp - 0x70], 8
jb 0x140007d6b
mov rcx, qword [rsp + 0x78]
call fcn.1400376e4
jmp 0x140007d6b
cmp byte [0x14007bc64], 0
je 0x140007d2e
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.GetMode__:_Invalid_mode_parameter__u.
mov rcx, rbx
call fcn.140003de0
mov edi, 0x57
jmp 0x140007d6b
cmp byte [0x14007bc64], 0
je 0x140007dd4
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r8d, edi
lea rdx, str.GetInfName___completed_with_error__u.
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x140007dd4
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
mov r9d, edi
lea r8, str.InstallDriver
lea rdx, str.Procedure___s__was_returned_with_value__u
mov rcx, rbx
call fcn.140003de0
cmp byte [0x14007bc64], 0
je 0x140007dd4
call fcn.1400069b0
mov rbx, rax
lea rdx, [0x140056bcc]
mov rcx, rax
call fcn.140003db0
lea rdx, [0x140057270]
mov rcx, rbx
call fcn.140003de0
nop
cmp qword [rbp - 0x50], 8
jb 0x140007de4
mov rcx, qword [rbp - 0x68]
call fcn.1400376e4
mov eax, edi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140038d80
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret