Function at 0x140008e70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor r14d, r14d
lea rcx, str.AviraFirewall
mov r15, rdx
mov qword [rbp - 0x28], r14
mov dword [rbp + 0x38], r14d
call fcn.14001e1ec
mov rsi, rax
test rax, rax
jne 0x140008ec9
lea rdx, str.SpawnIMINFFile
lea rcx, str.Installation__ws_FAILED_memory_allocation___low_memory_______line__d___n
mov r8d, 0x5ac
call fcn.140008040
mov eax, 0x10000002
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x50], rdi
lea r8, [rbp - 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlNetwork
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov rbx, r14
mov qword [rbp - 0x28], r14
mov dword [rbp + 0x38], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test eax, eax
jne 0x140008ff6
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x38]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, dword [rbp + 0x38]
mov edx, r12d
xor ecx, ecx
call fcn.14001d2d4
mov r13, rax
test rax, rax
je 0x14000901d
mov rcx, qword [rbp - 0x28]
mov rbx, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140008ff6
lea r8, [rbp - 0x28]
lea rdx, str.SYSTEMCurrentControlSetControlNetwork
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test eax, eax
jne 0x140008ff6
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x38]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp + 0x38]
mov rcx, rbx
call fcn.14001d2d4
mov rcx, qword [rbp - 0x28]
lea r9, [rbp + 0x40]
mov rbx, rax
lea rax, [rbp + 0x38]
lea rdx, str.FilterClasses
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jns 0x140009019
test rbx, rbx
je 0x140009007
mov rcx, rbx
call fcn.14001ccf0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140009109
jmp 0x140009103
mov r12d, dword [rbp + 0x38]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
mov edx, r12d
not rcx
mov eax, ecx
lea r13, [rcx - 1]
mov rcx, rbx
lea r14, [rax + rax]
add rdx, r14
call fcn.14001d2d4
mov r12, rax
test rax, rax
jne 0x140009056
mov eax, 0x10000002
jmp 0x14000910b
or rcx, 0xffffffffffffffff
mov rbx, rax
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14000908d
nop
lea eax, [rcx + 1]
or rcx, 0xffffffffffffffff
lea rbx, [rbx + rax*2]
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
jne 0x140009070
lea rcx, str.IMDriver:_FilterClass___s
mov rdx, rsi
call fcn.140008040
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rsi + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x1400090b0
xor eax, eax
lea rdx, str.FilterClasses
xor r8d, r8d
mov word [r14 + rbx], ax
mov eax, dword [rbp + 0x38]
mov r9d, dword [rbp + 0x40]
lea ecx, [rax + r13*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov edi, eax
call fcn.14001ccf0
mov rcx, qword [rbp - 0x28]
mov qword [r15], rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret