Function at 0x140001e70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov r14, rdx
mov edx, 0xf003f
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov qword [rbp + 0x17], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001eae
xor al, al
add rsp, 0xc0
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0xe0], rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0xb8], rdi
lea r9, [rbp + 0x7f]
xor edi, edi
mov qword [rsp + 0xb0], r12
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xa8], r13
lea rdx, str.LowerFilters
mov qword [rsp + 0xa0], r15
xor r8d, r8d
mov rcx, rsi
mov qword [rbp - 0x39], rdi
mov r15d, edi
mov qword [rsp + 0x20], rdi
movdqu xmmword [rbp - 0x49], xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400024b3
mov ebx, dword [rbp + 0x77]
mov r13d, edi
shr rbx, 1
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 0x19], rdi
je 0x140001f5a
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.1400025d0
mov r13, rax
mov qword [rbp - 0x11], rax
lea r8, [rbx + rbx]
xor edx, edx
add rax, r8
mov rcx, r13
mov qword [rbp - 9], rax
call fcn.140031120
mov rdi, r13
mov qword [rbp - 0x19], r13
lea rax, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x7f]
lea rdx, str.LowerFilters
mov qword [rsp + 0x20], r13
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140001f9e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor dil, dil
jmp 0x140002468
xor eax, eax
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x21], rax
nop dword [rax + rax]
inc rsi
cmp word [rdi + rsi*2], ax
jne 0x140001fb0
mov r13, qword [rbp - 0x49]
mov r11, rax
movabs r12, 0x7ffffffffffffff
test rsi, rsi
je 0x14000221e
mov rbx, rdi
mov rdi, qword [rbp - 0x41]
nop word [rax + rax]
cmp rdi, r15
je 0x140002026
mov qword [rdi], rax
mov r8, 0xffffffffffffffff
mov word [rdi], ax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140002000
mov rdx, rbx
mov rcx, rdi
call fcn.1400026b0
add rdi, 0x20
mov qword [rbp - 0x41], rdi
mov r11, rdi
jmp 0x1400021e0
mov r14, rdi
sub r14, r13
sar r14, 5
cmp r14, r12
je 0x1400025c0
sub r15, r13
lea rdx, [r14 + 1]
sar r15, 5
mov r12, r15
mov qword [rbp - 0x31], rdx
mov rcx, r15
movabs r15, 0x7ffffffffffffff
shr rcx, 1
mov rax, r15
sub rax, rcx
cmp r12, rax
ja 0x140002071
lea r15, [rcx + r12]
cmp r15, rdx
cmovb r15, rdx
mov rdx, r15
lea rcx, [rbp - 0x49]
call fcn.140002640
shl r14, 5
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x29], rax
lea rcx, [r14 + rax]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
inc r8
cmp word [rbx + r8*2], ax
jne 0x1400020a1
mov rdx, rbx
call fcn.1400026b0
mov r14, qword [rbp - 0x29]
cmp r13, rdi
je 0x14000210f
mov rdx, r13
mov rcx, r14
sub rdx, r14
xor r8d, r8d
nop dword [rax + rax]
mov qword [rcx], r8
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], r8
movups xmm0, xmmword [rdx + rcx]
lea rcx, [rcx + 0x20]
lea rax, [rdx + rcx]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + rcx - 0x10]
movups xmmword [rcx - 0x10], xmm1
mov qword [rdx + rcx - 0x10], r8
mov qword [rdx + rcx - 8], 7
mov word [rdx + rcx - 0x20], r8w
cmp rax, rdi
jne 0x1400020d0
jmp 0x140002112
xor r8d, r8d
test r13, r13
je 0x1400021b2
mov rbx, r13
cmp r13, rdi
je 0x14000217e
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002165
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000215d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400025ba
mov rcx, r8
call fcn.14002fbac
xor r8d, r8d
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 7
mov word [rbx], r8w
add rbx, 0x20
cmp rbx, rdi
jne 0x140002123
shl r12, 5
mov rax, r13
cmp r12, 0x1000
jb 0x1400021a7
mov r13, qword [r13 - 8]
add r12, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025ba
mov rdx, r12
mov rcx, r13
call fcn.14002fbac
mov r11, qword [rbp - 0x31]
mov r13, r14
shl r11, 5
movabs r12, 0x7ffffffffffffff
add r11, r14
shl r15, 5
add r15, r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x39], r15
mov rdi, r11
mov qword [rbp - 0x41], r11
mov rcx, qword [rbp - 0x21]
mov rax, qword [rbp - 0x19]
inc rcx
add rcx, rsi
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x21], rcx
lea rbx, [rax + rcx*2]
nop dword [rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x140002200
mov eax, 0
test rsi, rsi
jne 0x140001fe0
mov r14, qword [rbp + 0x6f]
jmp 0x140002222
mov rdi, qword [rbp - 0x41]
mov r10, r13
cmp r13, r11
je 0x140002296
mov rbx, qword [r14 + 0x18]
mov rsi, qword [r14 + 0x10]
mov rax, r14
cmp rbx, 8
jb 0x14000223e
mov rax, qword [r14]
cmp qword [r10 + 0x18], 8
mov r9, r10
mov rcx, qword [r10 + 0x10]
jb 0x14000224f
mov r9, qword [r10]
cmp rcx, rsi
jne 0x14000228d
test rcx, rcx
je 0x140002296
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x14000228d
sub r9, rax
cmp dx, r8w
ja 0x14000228d
cmp rcx, 1
je 0x140002296
movzx edx, word [rax + r9 + 2]
add rax, 2
dec rcx
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14000226e
add r10, 0x20
cmp r10, r11
jne 0x140002232
cmp r10, rdi
jne 0x1400023ef
cmp rdi, r15
je 0x1400022c0
mov r8, r14
lea rcx, [rbp - 0x49]
mov rdx, rdi
call fcn.1400013b0
add rdi, 0x20
mov qword [rbp - 0x41], rdi
jmp 0x1400023ef
mov rbx, rdi
sub rbx, r13
sar rbx, 5
cmp rbx, r12
je 0x1400025c0
sub r15, r13
lea rsi, [rbx + 1]
sar r15, 5
mov rax, r12
mov rcx, r15
mov qword [rbp - 0x31], rsi
shr rcx, 1
sub rax, rcx
cmp r15, rax
ja 0x1400022fe
lea r12, [r15 + rcx]
cmp r12, rsi
cmovb r12, rsi
mov rdx, r12
lea rcx, [rbp - 0x49]
call fcn.140002640
mov r8, qword [rbp + 0x6f]
lea rcx, [rbp - 0x49]
shl rbx, 5
mov r14, rax
lea rdx, [rax + rbx]
call fcn.1400013b0
cmp r13, rdi
je 0x140002380
mov rdx, r13
mov rcx, r14
sub rdx, r14
xor esi, esi
nop dword [rax]
nop word [rax + rax]
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
movups xmm0, xmmword [rdx + rcx]
lea rcx, [rcx + 0x20]
lea rax, [rdx + rcx]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + rcx - 0x10]
movups xmmword [rcx - 0x10], xmm1
mov qword [rdx + rcx - 0x10], rsi
mov qword [rdx + rcx - 8], 7
mov word [rdx + rcx - 0x20], si
cmp rax, rdi
jne 0x140002340
mov rsi, qword [rbp - 0x31]
test r13, r13
je 0x1400023d5
mov rbx, r13
cmp r13, rdi
je 0x1400023a1
nop dword [rax]
mov rcx, rbx
call fcn.140001730
add rbx, 0x20
cmp rbx, rdi
jne 0x140002390
shl r15, 5
mov rax, r13
cmp r15, 0x1000
jb 0x1400023ca
mov r13, qword [r13 - 8]
add r15, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025ba
mov rdx, r15
mov rcx, r13
call fcn.14002fbac
shl rsi, 5
add rsi, r14
shl r12, 5
add r12, r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x41], rsi
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 1]
call fcn.140001830
mov rax, qword [rbp - 1]
lea rdx, str.LowerFilters
mov rcx, qword [rbp + 7]
mov r9d, 7
mov rdi, qword [rbp + 0x17]
sub rcx, rax
sar rcx, 1
xor r8d, r8d
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
test eax, eax
je 0x14000244e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor dil, dil
jmp 0x140002457
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dil, 1
lea rcx, [rbp - 1]
call fcn.1400017a0
mov r15, qword [rbp - 0x39]
mov r13, qword [rbp - 0x11]
test r13, r13
je 0x140002536
mov rcx, qword [rbp - 9]
mov rax, r13
sub rcx, r13
sar rcx, 1
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400024a3
mov r13, qword [r13 - 8]
add rcx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025ba
mov rdx, rcx
mov rcx, r13
call fcn.14002fbac
jmp 0x140002536
cmp eax, 2
jne 0x140002579
mov rdx, r14
lea rcx, [rbp - 0x49]
call fcn.140001470
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 1]
call fcn.140001830
mov rax, qword [rbp - 1]
lea rdx, str.LowerFilters
mov rcx, qword [rbp + 7]
mov r9d, 7
sub rcx, rax
xor r8d, r8d
sar rcx, 1
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rsi
test eax, eax
je 0x140002520
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002529
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dil, 1
lea rcx, [rbp - 1]
call fcn.1400017a0
mov r15, qword [rbp - 0x39]
mov r14, qword [rbp - 0x49]
test r14, r14
je 0x140002582
mov rsi, qword [rbp - 0x41]
mov rbx, r14
cmp r14, rsi
je 0x140002561
nop dword [rax + rax]
mov rcx, rbx
call fcn.140001730
add rbx, 0x20
cmp rbx, rsi
jne 0x140002550
sub r15, r14
lea rcx, [rbp - 0x49]
sar r15, 5
mov rdx, r14
mov r8, r15
call fcn.1400028d0
jmp 0x140002582
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0xa8]
movzx eax, dil
mov rdi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xa0]
add rsp, 0xc0
pop r14
pop rsi
pop rbp
ret
call fcn.140035ebc
int3
call fcn.140001e50
int3