Function at 0x140002230
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x900]
sub rsp, 0xa00
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rbp + 0x8f0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x10]
call fcn.140002f10
nop
mov rsi, qword [rbp - 8]
mov qword [rsp + 0x48], rsi
mov rbx, qword [rsi]
xor r15d, r15d
cmp rbx, rsi
je 0x14000279d
movabs r14, 0x7fffffffffffffff
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400022c7
mov r8, qword [rdx]
mov r9, r8
add r8, qword [rdx + 0x10]
jmp 0x1400022d1
mov r8, qword [rdx + 0x10]
add r8, rdx
mov r9, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
cmp r9, r8
jne 0x1400022f8
mov qword [rbp - 0x40], r15
mov eax, 0xf
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x50], 0
jmp 0x14000230b
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x50]
call fcn.1400012b0
mov rax, qword [rbp - 0x38]
lea r13, [rbp - 0x50]
cmp rax, 0x10
cmovae r13, qword [rbp - 0x50]
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002757
mov r12d, r15d
mov dword [rsp + 0x60], 0x400
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000274b
nop dword [rax]
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002708
mov dword [rbp - 0x78], 0x400
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400026fd
mov rdx, r13
lea rcx, [rbp + 0x430]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
jne 0x1400026fd
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140001f30
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
lea r15, [rsp + 0x68]
mov r9, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
cmovae r15, r9
mov rdi, qword [rsp + 0x78]
cmp rdi, r14
ja 0x14000283f
cmp rdi, 0x10
jae 0x140002476
mov qword [rbp - 0x20], rdi
mov esi, 0xf
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x30], xmm0
movq r14, xmm0
jmp 0x1400024db
mov rsi, rdi
or rsi, 0xf
cmp rsi, r14
jbe 0x140002487
mov rsi, r14
jmp 0x140002494
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140002d10
mov r14, rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rsi
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov r9, qword [rsp + 0x68]
lea r15, [rsp + 0x68]
cmp rdx, 0x10
setae cl
cmovae r15, r9
add r15, rdi
lea rax, [rsp + 0x68]
test cl, cl
je 0x1400024fc
add rdi, r9
jmp 0x140002504
add rdi, rax
lea r9, [rsp + 0x68]
mov r8b, 0x2d
mov rdx, rdi
mov rcx, r9
call fcn.140003c60
mov r10, rax
cmp rax, rdi
je 0x140002538
inc rax
cmp rax, rdi
je 0x140002538
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x140002530
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140002522
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
setae r8b
cmovae rcx, qword [rsp + 0x68]
mov r9, r10
sub r9, rcx
sub r15, r10
mov rdi, qword [rsp + 0x78]
mov rax, rdi
sub rax, r9
cmp rax, r15
cmovb r15, rax
lea rcx, [rsp + 0x68]
test r8b, r8b
cmovne rcx, qword [rsp + 0x68]
add rcx, r9
sub rdi, r15
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + r15]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rdi
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
setae r8b
cmovae rax, qword [rsp + 0x68]
add rax, rdi
lea rdx, [rsp + 0x68]
test r8b, r8b
cmovne rdx, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor r15d, r15d
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
lea rcx, [rbp - 0x70]
cmp rdx, rax
jne 0x1400025e0
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r15b
jmp 0x1400025f9
sub rax, rdx
mov r8, rax
call fcn.1400012b0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002600
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NetworkAddress
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000266a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027d9
call fcn.140003dac
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r15b
cmp rsi, 0x10
jb 0x1400026b2
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400026a9
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027e0
mov rcx, r14
call fcn.140003dac
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400026ee
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027e7
call fcn.140003dac
movabs r14, 0x7fffffffffffffff
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x60], 0x400
inc r12d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x30]
mov edx, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140002390
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000278e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027ee
call fcn.140003dac
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x1400022b0
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140002806
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140003dac
mov qword [rbp + 8], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp - 8]
call fcn.140001b60
mov rcx, qword [rbp + 0x8f0]
xor rcx, rsp
call fcn.140003e20
lea r11, [rsp + 0xa00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002cf0
nop
int3