Function at 0x140001c80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140080020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, r8d
mov r14, rdx
mov edx, 0xf003f
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001ccd
xor al, al
jmp 0x140002053
lea rax, str.LowerFilters
lea r15, str.UpperFilters
cmp ebx, 1
cmove r15, rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
xor r12d, r12d
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 7]
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001fef
xorps xmm0, xmm0
mov edi, dword [rbp - 0x31]
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r12
cmp rdi, 2
jb 0x140001d97
and rdi, 0xfffffffffffffffe
cmp rdi, 0x1000
jb 0x140001d68
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140002081
call fcn.1400398f0
mov rcx, rax
test rax, rax
je 0x14000208d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001d7a
test rdi, rdi
je 0x140001d77
mov rcx, rdi
call fcn.1400398f0
jmp 0x140001d7a
mov rax, r12
mov qword [rbp - 0x11], rax
lea rbx, [rdi + rax]
mov qword [rbp - 1], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14003c150
mov qword [rbp - 9], rbx
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140001dda
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x140001fac
mov rdi, r12
mov r11, qword [rbp - 0x11]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [r11 + rbx*2], r12w
jne 0x140001df0
test rbx, rbx
je 0x140001ef4
mov rcx, r12
mov r10, qword [rbp - 0x21]
nop word [rax + rax]
lea r9, [rcx + r11]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], 0
jne 0x140001e20
mov r8, r14
cmp qword [r14 + 0x18], 8
jb 0x140001e38
mov r8, qword [r14]
mov rdx, qword [r14 + 0x10]
cmp rdx, rax
jne 0x140001e66
mov rcx, r9
test rdx, rdx
je 0x140001ecc
sub r8, r9
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140001e66
add rcx, 2
sub rdx, 1
jne 0x140001e50
jmp 0x140001ecc
mov qword [rbp - 0x39], r9
cmp r10, qword [rbp - 0x19]
je 0x140001eb4
mov qword [r10], r12
mov qword [r10 + 0x10], r12
mov qword [r10 + 0x18], 7
mov word [r10], r12w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r9 + r8*2], 0
jne 0x140001e90
mov rdx, r9
mov rcx, r10
call fcn.140002800
mov r10, qword [rbp - 0x21]
add r10, 0x20
mov qword [rbp - 0x21], r10
jmp 0x140001ec8
lea r8, [rbp - 0x39]
mov rdx, r10
lea rcx, [rbp - 0x29]
call fcn.1400029e0
mov r10, qword [rbp - 0x21]
mov r11, qword [rbp - 0x11]
inc rbx
add rdi, rbx
lea rcx, [rdi + rdi]
lea rax, [rcx + r11]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140001ee1
test rbx, rbx
jne 0x140001e10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0xf]
call fcn.1400012d0
mov rax, qword [rbp + 0x17]
mov rcx, qword [rbp + 0xf]
sub rax, rcx
sar rax, 1
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rsi
test eax, eax
je 0x140001f57
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x140001f5f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140001fac
mov rax, qword [rbp + 0x1f]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002087
call fcn.14003992c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r12
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140002009
mov rax, qword [rbp - 1]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000208d
call fcn.14003992c
jmp 0x140002009
mov rcx, rsi
cmp eax, 2
jne 0x140002001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x140002009
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140002050
mov rdx, qword [rbp - 0x21]
call fcn.140003120
mov rdx, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x29]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000204b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000207b
call fcn.14003992c
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400398d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400402c0
nop
call fcn.140001210
nop
call fcn.1400402c0
nop
call fcn.1400402c0
int3