Function at 0x140003f10
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x3368]
mov eax, 0x3468
call fcn.14001b140
sub rsp, rax
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rbp + 0x3340], rax
mov r15d, edx
lea rax, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004395
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x3480], rbx
lea rdx, str.UpperFilters
mov qword [rsp + 0x3490], rsi
xor r9d, r9d
mov qword [rsp + 0x3498], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2f40]
mov qword [rsp + 0x3460], r12
mov qword [rsp + 0x3458], r13
mov qword [rsp + 0x3450], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13d, 1
test eax, eax
jne 0x140004382
xor r12d, r12d
mov r14d, r12d
mov esi, r12d
mov edi, r12d
cmp dword [rsp + 0x30], r13d
je 0x14000407c
nop word [rax + rax]
mov eax, esi
lea rcx, [rbp + 0x2f40]
lea rcx, [rcx + rax*2]
mov eax, r14d
mov qword [rsp + rax*8 + 0x40], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140004020
inc eax
add esi, eax
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140004040
lea ebx, [rax*2 + 2]
test r14d, r14d
je 0x140004061
lea eax, [r14 - 1]
mov rcx, qword [rsp + rax*8 + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x14000407c
mov eax, dword [rsp + 0x30]
inc edi
add edi, ebx
inc r14d
dec eax
cmp edi, eax
jb 0x140004000
cmp r15d, r13d
jne 0x1400041e4
mov r8d, r12d
test r14d, r14d
je 0x14000416a
lea r9, [rsp + 0x40]
lea r10, [0x140025bc0]
nop dword [rax]
mov rdx, qword [r9]
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x140004112
cmp rcx, 4
jne 0x1400040b0
mov rax, r13
mov r13, qword [rsp + 0x3458]
mov r12, qword [rsp + 0x3460]
mov rdi, qword [rsp + 0x3498]
mov rsi, qword [rsp + 0x3490]
mov rbx, qword [rsp + 0x3480]
mov r14, qword [rsp + 0x3450]
mov rcx, qword [rbp + 0x3340]
xor rcx, rsp
call fcn.140006060
add rsp, 0x3468
pop r15
pop rbp
ret
inc r8d
add r9, 8
cmp r8d, r14d
jb 0x1400040a0
mov rdx, r12
mov r8d, r14d
mov r15, r12
nop word [rax + rax]
mov rcx, qword [rsp + rdx + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140004140
lea rax, [rax*2 + 2]
mov qword [rbp + rdx + 0xf40], rax
add r15, rax
add rdx, 8
sub r8, r13
jne 0x140004130
jmp 0x14000416d
mov r15, r12
lea r13, [r15 + 0xa]
mov rcx, r13
call fcn.14000d9cc
mov qword [0x14002d090], rax
mov rdi, rax
test rax, rax
je 0x14000431b
mov rcx, qword [0x140025bc0]
mov esi, 8
mov qword [rax], rcx
test r14d, r14d
je 0x1400041d7
mov rbx, r12
test r12d, r12d
je 0x1400041b5
lea eax, [r12 - 1]
add rsi, qword [rbp + rax*8 + 0xf40]
mov r8, qword [rbp + rbx + 0xf40]
lea rcx, [rdi + rsi]
mov rdx, qword [rsp + rbx + 0x40]
call fcn.140008300
inc r12d
add rbx, 8
cmp r12d, r14d
jb 0x1400041a3
mov word [rdi + r15 + 8], 0
jmp 0x14000431b
xor r9b, r9b
test r14d, r14d
je 0x1400040c5
lea r11, [rsp + 0x40]
mov edi, r14d
mov ebx, r14d
lea r10, [0x140025bc0]
mov r8, qword [r11]
mov rcx, r12
nop dword [rax + rax]
movzx edx, word [r8 + rcx*2]
inc rcx
movzx eax, word [r10 + rcx*2 - 2]
sub edx, eax
jne 0x140004228
cmp rcx, 4
jne 0x140004210
test edx, edx
movzx r9d, r9b
cmove r9d, r13d
add r11, 8
sub rbx, r13
jne 0x140004202
test r9b, r9b
je 0x14000438d
mov r14d, r12d
mov r15, r12
mov r8, r12
nop dword [rax]
mov rdx, qword [rsp + r8 + 0x40]
mov rcx, r12
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x140004277
cmp rcx, 4
jne 0x140004260
jmp 0x1400042b2
mov rcx, 0xffffffffffffffff
nop
cmp word [rdx + rcx*2 + 2], r12w
lea rcx, [rcx + 1]
jne 0x140004280
mov eax, r14d
lea r15, [r15 + rcx*2]
add r15, 2
lea rcx, [rcx*2 + 2]
inc r14d
mov qword [rbp + rax*8 + 0x1f40], rdx
mov qword [rbp + rax*8 + 0xf40], rcx
add r8, 8
sub rdi, r13
jne 0x140004250
lea r13, [r15 + 2]
mov rcx, r13
call fcn.14000d9cc
mov qword [0x14002d090], rax
mov rdi, rax
test rax, rax
je 0x14000431b
mov ebx, r12d
test r14d, r14d
je 0x140004314
mov rsi, r12
test ebx, ebx
je 0x1400042f0
lea eax, [rbx - 1]
add r12, qword [rbp + rax*8 + 0xf40]
mov r8, qword [rbp + rsi + 0xf40]
lea rcx, [rdi + r12]
mov rdx, qword [rbp + rsi + 0x1f40]
call fcn.140008300
inc ebx
add rsi, 8
cmp ebx, r14d
jb 0x1400042e1
mov word [rdi + r15], 0
test r13, r13
je 0x14000437c
mov rdx, rdi
lea rcx, str.TotalData___s_r_n
call fcn.140005be0
mov rcx, qword [rsp + 0x38]
lea rdx, str.UpperFilters
mov dword [rsp + 0x28], r13d
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x14002d090]
mov r13d, 1
mov edx, r13d
call fcn.140006080
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x1400040c8
mov r13d, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x1400040c8
mov eax, 1
jmp 0x1400040f8