Function at 0x140008c70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4370]
mov eax, 0x4470
call fcn.140163de0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x44a0], rbx
mov qword [rsp + 0x44a8], rsi
mov qword [rsp + 0x44b0], rdi
mov rax, qword [0x14021ca50]
xor rax, rsp
mov qword [rbp + 0x4360], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009060
mov dword [rsp + 0x30], 0x400
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3f60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009055
lea r12, [fcn.14000a310]
mov qword [rsp + 0x20], r12
lea r9, [0x14000a360]
lea edx, [rax + 8]
mov r8d, 0x200
lea rcx, [rbp + 0xf60]
call fcn.140161c9c
nop
xor r13d, r13d
mov ebx, r13d
mov esi, r13d
mov eax, dword [rsp + 0x30]
dec eax
je 0x140008dd5
lea r12, [rbp + 0xf60]
nop
mov eax, esi
lea rdx, [rbp + rax*2 + 0x3f60]
mov eax, ebx
lea r9, [rbp + rax*8 + 0xf60]
test rdx, rdx
jne 0x140008d8e
mov ecx, r13d
jmp 0x140008da0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.14000a220
mov rdx, qword [r12]
mov eax, dword [rdx - 0x10]
test eax, eax
je 0x140008dce
add esi, eax
test eax, eax
je 0x140008dce
inc ebx
add r12, 8
inc esi
mov eax, dword [rsp + 0x30]
dec eax
cmp esi, eax
jb 0x140008d70
lea r12, [fcn.14000a310]
xor dl, dl
test ebx, ebx
je 0x140009039
lea r8, [rbp + 0xf60]
mov r14d, ebx
mov qword [rsp + 0x48], r14
mov r10d, ebx
mov r11d, 1
nop word [rax + rax]
xor eax, eax
lea rdi, [0x1401dd6c0]
mov rsi, qword [r8]
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
je 0x140008e1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
movzx edx, dl
test al, al
cmovne edx, r11d
add r8, 8
dec r10
jne 0x140008e00
test dl, dl
je 0x140009039
mov qword [rsp + 0x20], r12
lea r9, [0x14000a360]
lea edx, [r10 + 8]
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.140161c9c
nop
mov r15d, r13d
mov r8, r13
mov qword [rsp + 0x38], r13
mov rbx, r13
mov r12, r13
nop dword [rax]
mov rdx, qword [rbp + rbx + 0xf60]
xor eax, eax
lea rdi, [0x1401dd6c0]
mov rsi, rdx
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
je 0x140008e93
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x140008f3e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
add rcx, rcx
mov qword [rsp + 0x50], rcx
mov qword [rbp + rbx + 0x1f60], rcx
add r8, rcx
mov qword [rsp + 0x38], r8
lea rcx, [rdx - 0x18]
lea r14, [rsp + r12 + 0x60]
mov rdi, qword [r14]
sub rdi, 0x18
cmp rcx, rdi
je 0x140008f25
cmp dword [rdi + 0x10], eax
jl 0x140008f14
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140008f14
call fcn.140009f10
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140008f0b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x140008f20
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.14000a220
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rbp + r12 + 0x2f60], rax
inc r15d
add r12, 8
mov r14, qword [rsp + 0x48]
add rbx, 8
dec r14
mov qword [rsp + 0x48], r14
jne 0x140008e70
lea r14, [r8 + 2]
mov rcx, r14
call fcn.140161dac
mov rbx, rax
mov qword [0x140229c38], rax
test rax, rax
je 0x140008fbf
mov esi, r13d
test r15d, r15d
je 0x140008fb4
lea r12, [rbp + 0x2f60]
lea rax, [rsp + 0x60]
sub r12, rax
mov rdi, r13
test esi, esi
je 0x140008f93
lea rax, [r12 + rdi - 8]
add r13, qword [rsp + rax + 0x60]
lea rcx, [rbx + r13]
mov r8, qword [rbp + rdi + 0x2f60]
mov rdx, qword [rsp + rdi + 0x60]
call fcn.140163f20
inc esi
add rdi, 8
cmp esi, r15d
jb 0x140008f85
mov rax, qword [rsp + 0x38]
mov word [rbx + rax], 0
lea r9, [fcn.14000a310]
mov edx, 8
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.140161d4c
test r14, r14
je 0x140009019
mov dword [rsp + 0x28], r14d
mov rax, qword [0x140229c38]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.UpperFilters
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x140229c38]
call fcn.14000a3f8
nop
lea r9, [fcn.14000a310]
mov edx, 8
mov r8d, 0x200
lea rcx, [rbp + 0xf60]
call fcn.140161d4c
jmp 0x140009055
mov r9, r12
mov edx, 8
mov r8d, 0x200
lea rcx, [rbp + 0xf60]
call fcn.140161d4c
jmp 0x140009060
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rbp + 0x4360]
xor rcx, rsp
call fcn.140161940
lea r11, [rsp + 0x4470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret