Function at 0x140051280
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rbx, r9
mov r12, r8
mov qword [rsp + 0x80], r8
mov r13, rdx
mov qword [rsp + 0x60], rdx
mov r15, rcx
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x130], 7
xor edi, edi
mov qword [rsp + 0x128], rdi
mov word [rsp + 0x118], di
lea r8d, [rdi + 0x1e]
lea rdx, str.RemoveRegistries_DeviceControl
lea rcx, [rsp + 0x110]
call fcn.140001870
nop
mov esi, edi
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [rdi + 0x32]
lea r8d, [rdi + 1]
mov rcx, r15
call fcn.1400144a0
test r13, r13
je 0x140051c7e
test rbx, rbx
je 0x140051c7e
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], rdi
mov word [rsp + 0x168], di
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x160]
call fcn.140001870
mov r8d, 0xe
lea rdx, str.ControlClass_
lea rcx, [rsp + 0x160]
call fcn.14000a130
lea rcx, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae rcx, qword [rsp + 0x168]
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, str.MainKey
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, r15
call fcn.1400144a0
mov r8, qword [r12 + 0x20]
mov rdi, qword [r12 + 0x18]
mov rcx, r8
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1400517ee
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae rdx, qword [rsp + 0x168]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400517a2
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14005174b
mov edi, ebx
cmp dword [rsp + 0x68], ebx
jbe 0x140051792
lea r14, str.DelStringToMultiStringRegistry___UpperFilters
lea rbp, str.Error___i__return_by_function___s_
lea r12, str.DelStringToMultiStringRegistry___LowerFilters
nop word [rax + rax]
mov word [rsp + 0x190], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x192]
call fcn.1400719a0
mov dword [rsp + 0x6c], 0x104
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x190]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400516ed
mov rdx, r13
lea rcx, [rsp + 0xe8]
call fcn.140001390
mov byte [rsp + 0x20], 1
mov r9, rax
lea r8, str.UpperFilters
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x60]
call fcn.140033ba0
mov ebx, eax
cmp eax, 2
je 0x140051622
test eax, eax
je 0x140051622
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
mov esi, ebx
mov rdx, r13
lea rcx, [rsp + 0x98]
call fcn.140001390
mov byte [rsp + 0x20], 1
mov r9, rax
lea r8, str.LowerFilters
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x60]
call fcn.140033ba0
mov ebx, eax
cmp eax, 2
je 0x14005172f
test eax, eax
je 0x140051733
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
mov esi, ebx
xor ebx, ebx
jmp 0x140051735
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rcx, str.RegEnumKeyEx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
jmp 0x140051735
xor ebx, ebx
jmp 0x140051735
xor ebx, ebx
inc edi
cmp edi, dword [rsp + 0x68]
jb 0x140051500
mov r12, qword [rsp + 0x80]
jmp 0x140051792
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rcx, str.RegQueryInfoKey
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140051c46
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rcx, str.RegOpenKeyEx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
jmp 0x140051c46
cmp rdi, r8
jbe 0x1400517f8
call fcn.1400679f0
mov rax, qword [r12]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r13, [rdi + 8]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
xor ebx, ebx
mov rdi, qword [r12 + 0x20]
cmp qword [r12 + 0x18], rdi
jbe 0x140051832
call fcn.1400679f0
test rbp, rbp
je 0x14005183d
cmp rbp, qword [r12]
je 0x140051842
call fcn.1400679f0
cmp r14, rdi
je 0x140051c46
test esi, esi
jne 0x140051c46
mov qword [rsp + 0x158], 7
mov qword [rsp + 0x150], rbx
mov word [rsp + 0x140], bx
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae rdx, qword [rsp + 0x168]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x138]
call fcn.140001870
mov rbx, qword [rsp + 0x150]
test rbx, rbx
je 0x140051976
test rbx, rbx
je 0x14005195c
cmp rbx, 0xffffffffffffffff
jbe 0x1400518cf
or rcx, 0xffffffffffffffff
jmp 0x1400518d3
lea rcx, [rbx - 1]
lea rax, [rsp + 0x140]
mov rsi, qword [rsp + 0x140]
mov r12, qword [rsp + 0x158]
cmp r12, 8
cmovae rax, rsi
lea rdi, [rax + rcx*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x140051937
add rax, 2
sub rcx, 1
jne 0x140051910
lea rcx, [rsp + 0x138]
call fcn.1400016d0
cmp rdi, rax
je 0x14005195c
sub rdi, 2
jmp 0x140051900
lea rax, [rsp + 0x140]
cmp r12, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14005195c
lea rax, [rdi + 1]
cmp rbx, rax
je 0x140051976
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x138]
call fcn.14000a130
test rbp, rbp
jne 0x140051984
call fcn.1400679f0
xor edx, edx
jmp 0x140051988
mov rdx, qword [rbp]
cmp r14, qword [rdx + 0x20]
jb 0x140051993
call fcn.1400679f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x138]
call fcn.140001720
mov r12, qword [rsp + 0x60]
mov rdx, r12
lea rcx, [rsp + 0x98]
call fcn.140001390
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae rdx, qword [rsp + 0x140]
mov byte [rsp + 0x20], 1
mov r9, rax
lea r8, str.UpperFilters
mov rcx, 0xffffffff80000002
call fcn.140033ba0
mov edi, eax
cmp eax, 2
je 0x140051abe
test eax, eax
je 0x140051ac7
test rbp, rbp
jne 0x140051a15
call fcn.1400679f0
xor edx, edx
jmp 0x140051a19
mov rdx, qword [rbp]
cmp r14, qword [rdx + 0x20]
jb 0x140051a24
call fcn.1400679f0
cmp qword [r13 + 0x18], 8
jb 0x140051a31
mov rax, qword [r13]
jmp 0x140051a34
mov rax, r13
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, str.DelStringToMultiStringRegistry___UpperFilters
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rbx, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rbx
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
jmp 0x140051ace
lea rbx, str.Error___i__return_by_function___s_
jmp 0x140051ace
lea rbx, str.Error___i__return_by_function___s_
mov rdx, r12
lea rcx, [rsp + 0xc0]
call fcn.140001390
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae rdx, qword [rsp + 0x140]
mov byte [rsp + 0x20], 1
mov r9, rax
lea r8, str.LowerFilters
mov rcx, 0xffffffff80000002
call fcn.140033ba0
mov esi, eax
cmp eax, 2
jne 0x140051b23
xor ebx, ebx
mov esi, ebx
jmp 0x140051bdf
test eax, eax
je 0x140051bdd
test rbp, rbp
jne 0x140051b39
call fcn.1400679f0
xor edx, edx
jmp 0x140051b3d
mov rdx, qword [rbp]
cmp r14, qword [rdx + 0x20]
jb 0x140051b48
call fcn.1400679f0
cmp qword [r13 + 0x18], 8
jb 0x140051b55
mov rax, qword [r13]
jmp 0x140051b58
mov rax, r13
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, str.DelStringToMultiStringRegistry___LowerFilters
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, r15
call fcn.1400144a0
xor ebx, ebx
jmp 0x140051bdf
xor ebx, ebx
cmp qword [rsp + 0x158], 8
jb 0x140051bf7
mov rcx, qword [rsp + 0x140]
call fcn.140065920
mov qword [rsp + 0x158], 7
mov qword [rsp + 0x150], rbx
mov word [rsp + 0x140], bx
test rbp, rbp
jne 0x140051c22
call fcn.1400679f0
mov rdx, rbx
jmp 0x140051c26
mov rdx, qword [rbp]
cmp r14, qword [rdx + 0x20]
jb 0x140051c31
call fcn.1400679f0
add r14, 0x28
add r13, 0x28
mov r12, qword [rsp + 0x80]
jmp 0x140051821
cmp qword [rsp + 0x180], 8
jb 0x140051c5e
mov rcx, qword [rsp + 0x168]
call fcn.140065920
mov qword [rsp + 0x180], 7
xor edi, edi
mov qword [rsp + 0x178], rdi
mov word [rsp + 0x168], di
jmp 0x140051cb7
mov esi, 1
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, str.Wrong_parameter
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x13]
mov r8d, esi
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
mov dword [rsp + 0x28], esi
lea rax, str.Return_code__0x_x_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, r15
call fcn.1400144a0
lea r9, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r9, qword [rsp + 0x118]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, r15
call fcn.1400144a0
nop
cmp qword [rsp + 0x130], 8
jb 0x140051d42
mov rcx, qword [rsp + 0x118]
call fcn.140065920
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rdi
mov word [rsp + 0x118], di
mov rcx, r12
call fcn.140026d60
nop
mov rcx, qword [r12]
call fcn.140065920
mov eax, esi
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.140064b70
add rsp, 0x3b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret