Function at 0x140003320
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
lea r8, str.MaintainReg
mov dword [rbp - 0x11], 0x100
lea r15, str.c:users_scddocumentsmyworkproject__dynabooksystemdriverdsd_for_tos6208_v6dsd_branch_dev_6.01.0029.xxcentennial_rs5dynabookecoserviceecoserver_regguard.cpp
mov qword [rbp - 0x21], r8
lea r13, str.__MaintainReg_
mov qword [rbp - 0x19], r15
lea r12, [0x1402a214c]
mov qword [rbp - 9], r13
lea rdx, str.ENTER__s
mov qword [rbp - 1], r12
lea rcx, [rbp - 0x19]
mov dword [rbp + 7], 3
call fcn.140008d50
xor r14d, r14d
mov edi, r14d
mov qword [rbp - 0x59], r14
mov qword [rbp + 0x7f], r14
call fcn.140003060
mov ebx, eax
mov qword [rbp - 0x49], r15
lea rax, str.true
mov dword [rbp - 0x41], 0x10b
lea rsi, str.false
mov qword [rbp - 0x39], r13
test ebx, ebx
mov qword [rbp - 0x31], r12
mov r9, rsi
mov dword [rbp - 0x29], 3
cmovne r9, rax
lea r8, str.bIsPreInstallImage
lea rdx, str._s___s
lea rcx, [rbp - 0x49]
call fcn.140008d50
test ebx, ebx
jne 0x1400036e7
lea rcx, str.SOFTWARETOSHIBAeco_Utility
call fcn.140003200
test eax, eax
mov qword [rbp - 0x49], r15
mov ebx, eax
mov dword [rbp - 0x41], 0x10f
lea rax, str.true
mov qword [rbp - 0x39], r13
mov r9, rsi
mov qword [rbp - 0x31], r12
cmovne r9, rax
mov dword [rbp - 0x29], 3
lea r8, str.bDoesOldRegExist
lea rdx, str._s___s
lea rcx, [rbp - 0x49]
call fcn.140008d50
test ebx, ebx
je 0x1400036e7
lea rax, [rbp - 0x51]
mov qword [rbp - 0x51], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesdynabookSettingService
mov rcx, 0xffffffff80000002
mov ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400034b7
mov rcx, qword [rbp - 0x51]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x77]
lea rax, [rbp + 0x67]
mov dword [rbp + 0x67], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.TransferFlag
mov dword [rbp + 0x6f], 4
mov dword [rbp + 0x77], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400034b7
cmp dword [rbp + 0x67], 1
sete bl
lea rax, str.__GetTransferFlag_
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x39], rax
lea r8, str.bIsRegTransfered
lea rax, str.true
mov dword [rbp - 0x41], 0xbf
test ebx, ebx
mov qword [rbp - 0x31], r12
lea rdx, str._s___s
mov dword [rbp - 0x29], 3
cmovne rsi, rax
lea rcx, [rbp - 0x49]
mov r9, rsi
call fcn.140008d50
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000350e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x49], r15
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r12
mov dword [rbp - 0x29], 3
cmp ebx, 1
jne 0x140003544
lea rdx, str.GetTransferFlag___is_TRUE
mov dword [rbp - 0x41], 0x11f
call fcn.140008d50
mov edi, ebx
jmp 0x140003707
lea rdx, str.GetTransferFlag___is_FALSE
mov dword [rbp - 0x41], 0x124
call fcn.140008d50
lea rax, [rbp - 0x59]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARETOSHIBAeco_Utility
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400035b3
mov dword [rbp - 0x41], 0x127
mov r8d, 0x80004005
mov qword [rbp - 0x49], r15
lea rdx, str.Error_Code:_0x_x
mov qword [rbp - 0x39], r13
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x31], r12
mov dword [rbp - 0x29], r14d
call fcn.140008d50
jmp 0x140003707
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREDynabookeco_Utility
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400035fa
mov dword [rbp - 0x41], pe_nt_image_headers64
jmp 0x140003588
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x59]
call fcn.1400037d0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14000361a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14000362d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x59], r14
lea rax, [rbp - 0x59]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARETOSHIBASystem_Modules_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003663
mov dword [rbp - 0x41], 0x130
jmp 0x140003588
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREDynabookSystem_Modules_
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400036ad
mov dword [rbp - 0x41], 0x131
jmp 0x140003588
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x59]
call fcn.1400037d0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400036cd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1400036e0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x59], r14
call fcn.140003170
jmp 0x140003701
lea rcx, str.SOFTWAREDynabookeco_Utility
call fcn.140003200
cmp eax, 1
jne 0x1400036fc
mov edi, eax
jmp 0x140003707
call fcn.1400048c0
test eax, eax
sete dil
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x6f], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesdynabookSettingService
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003763
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.DynabookRegDeployFlag
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140003772
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140003785
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140003798
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x59], r14
mov r8, qword [rbp - 0x21]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x19]
call fcn.140008d50
mov eax, edi
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret