Function at 0x1400034e0
Capabilities:
Access the windows event log
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
xor eax, eax
mov qword [rbp - 9], rax
mov ebx, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
cmp ecx, 1
jne 0x140003516
or ebx, ecx
mov dword [rbp - 9], ebx
call fcn.1400015c0
xor r15d, r15d
mov dword [rbp + 0x7f], 4
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
mov edi, 7
mov dword [rbp + 0x77], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000359c
mov rcx, qword [rbp - 0x19]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rdx, [0x140036cd8]
lea rax, [rbp + 0x77]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000359c
mov edi, dword [rbp + 0x77]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
jne 0x1400035b0
or ebx, 2
jmp 0x1400035c5
cmp edi, 7
jne 0x1400035ba
or ebx, 4
jmp 0x1400035c5
cmp edi, 0xfe
jne 0x1400035c8
or ebx, 8
mov dword [rbp - 9], ebx
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
mov dword [rbp + 0x67], r15d
mov ebx, r15d
mov dword [rbp + 0x7f], 4
mov dword [rbp + 0x77], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000364f
mov rcx, qword [rbp - 0x19]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rdx, str.FailedFWUpgradeCount
lea rax, [rbp + 0x77]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140003653
mov ecx, dword [rbp + 0x77]
mov dword [rbp + 0x67], ecx
jmp 0x140003653
mov dword [rbp + 0x67], r15d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, 1
test ebx, ebx
je 0x14000368c
mov ecx, r14d
cmp ebx, 2
jne 0x14000367d
lea rdx, str.There_is_no_FW_upgrade_count_reg_key_n
call fcn.1400016a0
jmp 0x14000368c
mov r8d, ebx
lea rdx, str.Error_reading_FW_upgrade_count_reg_key_rc_d_n
call fcn.1400016a0
cmp dword [rbp + 0x67], 0x14
jb 0x1400036d9
lea rdx, str.Failed._Too_many_failed_FW_upgrades._n_n
mov ecx, r14d
call fcn.1400016a0
mov rcx, qword [0x140041880]
test rcx, rcx
je 0x1400036b9
call fcn.14000e44c
mov qword [0x140041880], r15
mov edx, r14d
lea rcx, str.Will_not_attempt_to_upgrade_CV_firmware_because_there_were_too_many_failed_firmware_upgrades.
call fcn.140006900
xor eax, eax
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 0x98], rsi
call fcn.1400064f0
test al, al
jne 0x1400036fe
lea rdx, str.Stopping_the_service:_WbioSrvc__n
mov ecx, r14d
call fcn.1400016a0
call fcn.140003360
call fcn.140006230
mov ebx, eax
test eax, eax
je 0x14000371b
mov r8d, eax
lea rdx, str.Failed_creating_FW_Upgrade_events._Return_code:__d
mov ecx, r14d
call fcn.1400016a0
mov r8d, ebx
lea rdx, str.Event:_SUCCESS_creating_FW_Upgrade_events._Return_code:__d__n
mov ecx, r14d
call fcn.1400016a0
mov ebx, r15d
lea rdi, [0x140042310]
nop word [rax + rax]
mov r9, qword [rdi]
lea rdx, str.Event:_eventIndx:__d__Handle:__x__n
mov r8d, ebx
mov ecx, r14d
call fcn.1400016a0
inc ebx
lea rdi, [rdi + 8]
cmp ebx, 5
jl 0x140003740
lea r8, [rbp + 0x7f]
mov dword [rbp + 0x6f], r15d
lea rdx, [rbp + 0x6f]
mov dword [rbp + 0x7f], r15d
lea rcx, [rbp - 9]
call fcn.140001830
mov qword [rsp + 0x40], r15
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
xor r9d, r9d
xor r8d, r8d
test eax, eax
mov esi, eax
lea rax, [rbp + 0x77]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
je 0x1400038b6
inc dword [rbp + 0x67]
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400037f4
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.FailedFWUpgradeCount
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, dword [rbp + 0x67]
mov r8d, esi
mov ecx, r14d
test ebx, ebx
je 0x14000381e
lea rdx, str.Failed._Return_code:__d_Failed_setting_number_of_FW_upgrades_to__d_rc_d_n
mov dword [rsp + 0x20], ebx
call fcn.1400016a0
jmp 0x14000382a
lea rdx, str.Failed._Return_code:__d_Set_number_of_failed_FW_upgrades_to__d_n_n
call fcn.1400016a0
lea rdx, str.USHUpgradeService
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rbx, rax
test rax, rax
je 0x140003888
mov qword [rsp + 0x40], r15
lea rax, str.CV_firmware_upgrade_failed
mov qword [rbp + 0x77], rax
xor r8d, r8d
lea rax, [rbp + 0x77]
mov edx, r14d
mov qword [rsp + 0x38], rax
mov r9d, 0xe0000002
mov dword [rsp + 0x30], r15d
mov rcx, rbx
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov r9, qword [0x140042330]
lea rdx, str.Event:_FwUpgradeError:__d__Handle:__x__n
mov r8d, 4
mov ecx, r14d
call fcn.1400016a0
mov rcx, qword [0x140042330]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140003c4e
mov dword [rbp + 0x67], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400038ef
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.FailedFWUpgradeCount
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x6f], r15d
je 0x140003987
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000396c
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], 4
lea rdx, [0x140036cd8]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 4
lea rcx, str.CV_firmware_upgrade_succeeded
call fcn.140006900
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
mov edi, r15d
mov dword [rbp - 0x19], 4
mov dword [rbp + 0x77], r15d
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140003a08
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rdx, str.FirmwareUpgardeStatus
lea rax, [rbp + 0x77]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140003a08
mov edi, dword [rbp + 0x77]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140003a3b
mov ecx, r14d
cmp ebx, 2
jne 0x140003a2c
lea rdx, str.There_is_no_FirmwareUpgardeStatus_reg_key_n
call fcn.1400016a0
jmp 0x140003a3b
mov r8d, ebx
lea rdx, str.Error_reading_FirmwareUpgardeStatus_reg_key_rc_d_n
call fcn.1400016a0
cmp edi, r14d
jne 0x140003bcd
mov r9, qword [0x140042320]
lea rdx, str.Event:_FwUpgradeInProgress:__d__Handle:__x__n
mov r8d, 2
mov ecx, r14d
call fcn.1400016a0
mov rcx, qword [0x140042320]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.FirmwareUpgardeStatus_value_is_SET._USH_Might_got_FW_upgraded__RE_STARTED._Need_to_do_cvRemainingFwUpgardeSteps_n
mov ecx, r14d
call fcn.1400016a0
cmp dword [rbp + 0x7f], r14d
jne 0x140003a96
lea rdx, str.Firmware_is_already_up_to_date_but_need_to_do_the_remaining_steps__so_will_start_Upgrade_progress_UI_again_n
mov ecx, r14d
call fcn.1400016a0
call fcn.1400069c0
call fcn.140001ff0
mov r8d, eax
lea rdx, str.Remaining_FW_UpgardeSteps_execution_Status_0x_x_n
mov ecx, r14d
call fcn.1400016a0
lea rax, [rbp + 0x77]
mov qword [rbp + 0x77], r15
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinPE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003aec
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140003b1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003b1a
lea rdx, str.Re_Install_Drivers_as_PIDs_change_could_cause_issue_due_to_the_new_FW_upgrade__n
mov ecx, r14d
call fcn.1400016a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003cd0
lea rdx, str.Re_Install_Drivers_COMPLETED__n
mov ecx, r14d
call fcn.1400016a0
lea rax, [rbp + 0x77]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov rcx, 0xffffffff80000002
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003b7a
mov rcx, qword [rbp + 0x77]
lea rdx, str.FirmwareUpgardeStatus
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
je 0x140003b88
cmp eax, 2
jne 0x140003b71
lea rcx, str.DeleteRegKey_Key_didnt_exist_n
call fcn.1400013e0
jmp 0x140003b88
lea rcx, str.DeleteRegKey_RegDeleteValue_failed__nError___d_n
jmp 0x140003b81
lea rcx, str.DeleteRegKey_RegOpenKeyEx_failed__lRes___d_n
mov edx, eax
call fcn.1400013e0
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.Deleting_FirmwareUpgardeStatus_reg_key._Status_0x_x_n
mov ecx, r14d
call fcn.1400016a0
mov r9, qword [0x140042328]
lea rdx, str.Event:_FwUpgradeFinished:__d__Handle:__x__n
mov r8d, 3
mov ecx, r14d
call fcn.1400016a0
mov rcx, qword [0x140042328]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.USH_related_Registry_entries_setup._n
mov ecx, r14d
call fcn.1400016a0
call fcn.140004160
lea rdx, str.Files_cleanup__Folders_creation_related_setup._n
mov ecx, r14d
call fcn.1400016a0
call fcn.1400044d0
lea rdx, str.Non_DCH_Binaries_cleanup_._n
mov ecx, r14d
call fcn.1400016a0
call fcn.1400046c0
lea rdx, str.Deleting_Legacy_Service__If_exists_:_Credential_Vault_Host_Control_Service_n
mov ecx, r14d
call fcn.1400016a0
lea rcx, str.Credential_Vault_Host_Control_Service
call fcn.140004990
lea rdx, str.Deleting_Legacy_Service__If_exists_:_Credential_Vault_Host_Storage_n
mov ecx, r14d
call fcn.1400016a0
lea rcx, str.Credential_Vault_Host_Storage
call fcn.140004990
lea rdx, str.Finished_n_n
mov ecx, r14d
call fcn.1400016a0
lea rcx, str.FirmwareUpgradeStoppedRunning_n
call fcn.1400013e0
mov rcx, qword [0x140042338]
test rcx, rcx
jne 0x140003c74
lea rcx, str.ERROR_event_for_checking_if_FW_upgrade_is_running_is_not_available
call fcn.1400013e0
jmp 0x140003c92
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x140003c92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ResetEvent_failed__gle___d_n
call fcn.1400013e0
mov rcx, qword [0x140041880]
test rcx, rcx
je 0x140003caa
call fcn.14000e44c
mov qword [0x140041880], r15
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret