Function at 0x14000c6a0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov dword [rcx + 0x30], 0xa
mov qword [rcx + 0x38], rdi
xor edx, edx
mov r8d, 0x100
add rcx, 0x40
call fcn.14001cd80
mov qword [rbx + 0x140], rdi
lea rcx, [rbx + 0x148]
xor edx, edx
mov r8d, 0x100
call fcn.14001cd80
mov eax, 0x13
mov word [rbx + 0x248], ax
mov dword [rbx + 0x24c], edi
mov dword [rbx + 0x250], 0x1f402454
mov word [rbx + 0x254], di
mov dword [rbx + 0x258], 0xffffffff
mov qword [rbx + 0x25c], 1
mov dword [rbx + 0x264], edi
mov r13d, 0x80
mov word [rbx + 0x268], r13w
mov qword [rbx + 0x26c], rdi
mov qword [rbx + 0x274], rdi
mov qword [rbx + 0x27c], rdi
mov dword [rbx + 0x284], edi
mov dword [rbx + 0x288], 1
mov dword [rbx + 0x28c], 1
lea r12, [rbx + 0x290]
mov dword [r12], edi
mov dword [rbx + 0x294], 0x1f4
mov qword [rbx + 0x298], rdi
lea rax, vtable.RpcServer::CM_MMEndpointNotify.0
mov qword [rbx + 0x2a0], rax
mov qword [rbx + 0x2a8], rdi
mov qword [rbx + 0x2b0], rdi
mov qword [rbx + 0x2b8], rdi
mov qword [rbx + 0x2c0], rdi
mov qword [rbx + 0x2c8], rdi
mov dword [rbx + 0x2d0], 0xa
mov qword [rbx + 0x2e0], rdi
mov qword [rbx + 0x2e8], rdi
mov qword [rbx + 0x2f0], rdi
mov qword [rbx + 0x2f8], rdi
mov qword [rbx + 0x300], rdi
mov byte [rbx + 0x318], dil
mov qword [rbx + 0x374], 0xffffffffffffffff
mov dword [rbx + 0x380], 0xffffffff
lea rsi, [rbx + 0x384]
mov dword [rsi], 0xff
mov dword [rbx + 0x388], edi
mov qword [rbx + 0x390], rdi
mov dword [rbx + 0x398], 0xffffffff
mov qword [rbx + 0x3a0], rdi
mov qword [rbx + 0x3a8], rdi
mov qword [rbx + 0x3b0], rdi
mov dword [rbx + 0x3b9], edi
mov word [rbx + 0x3bd], di
mov dword [rbx + 0x3c0], 0xffffffff
mov byte [rbx + 0x3c4], dil
mov dword [rbx + 0x3c8], 0xffffffff
mov byte [rbx + 0x3cc], dil
mov dword [rbx + 0x3d0], edi
mov qword [rbx + 0x3d4], 1
mov dword [rbx + 0x3dc], 0xa
mov dword [rbx + 0x3e0], 0xa
lea rdx, str.FMService_EventLog
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rbx], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREFortemedia
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c948
mov dword [rbp - 0x58], 4
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ServiceTraceFlag
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [r12], 4
je 0x14000c95c
lea rcx, [0x14005df10]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [rbp + 0x410], 0
jne 0x14000ca4a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x308], rax
lea r8, str.FMAPOCTL3
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x310], rax
test rax, rax
jne 0x14000c9b4
test byte [r12], 1
je 0x14000c9b4
lea rcx, str.Open_ChangeMode_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, str.FMAPOCTL_OnDeviceAdded_event
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x2f0], rax
test rax, rax
jne 0x14000c9e8
test byte [r12], 1
je 0x14000c9e8
lea rcx, str.Open_m_hDevAddEvent_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, str.FMAPOService_APO_Running_event
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x2f8], rax
test rax, rax
jne 0x14000ca1c
test byte [r12], 1
je 0x14000ca1c
lea rcx, str.Open_m_hDevAddEvent_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x300], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x2e0], rax
mov dword [rbx + 0x374], 0xffffffff
lea rcx, [rbx + 0x320]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x348]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0x370], edi
mov dword [rbx + 0x37c], edi
mov byte [rbx + 0x3b8], 0
mov word [rbx + 0x260], r13w
mov r8, rsi
lea rdx, str.samsfpacx.dat
mov rcx, rbx
call fcn.140011990
test al, al
jne 0x14000cabd
mov r8, rsi
lea rdx, str.samsfpa.dat
mov rcx, rbx
call fcn.140011990
test al, al
jne 0x14000cabd
mov dword [rsi], 0xff
jmp 0x14000cac5
mov eax, dword [rsi]
mov dword [0x14006ef24], eax
movzx eax, word [rbx + 0x260]
mov word [rbx + 0x268], ax
lea r8, [rbx + 0x388]
lea rdx, str.samsfpaspk.dat
mov rcx, rbx
call fcn.140011990
test al, al
jne 0x14000caf3
mov dword [rbx + 0x388], edi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbx + 0x40]
call fcn.14001cd80
mov qword [rbp - 0x68], rdi
mov qword [rsp + 0x68], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x78], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x14006ccd8]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x14006ccc8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14000d00f
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
lea r9, [rsp + 0x68]
mov edx, 1
lea r8d, [rdx + 0xe]
call qword [rax + 0x18]
test eax, eax
jne 0x14000cdae
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x18]
test eax, eax
jne 0x14000cda3
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000cda3
imul rdx, rax, 0x124
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov qword [rbx + 0x3a0], rax
test rax, rax
je 0x14000cda3
mov r14d, edi
cmp dword [rsp + 0x60], edi
jbe 0x14000cda3
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
mov edx, r14d
call qword [rax + 0x20]
test eax, eax
jne 0x14000cd86
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
lea r8, [rbp - 0x78]
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x14000cd77
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x14005b0b8]
call qword [rax + 0x28]
test eax, eax
jne 0x14000cd6c
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140010c40
cmp al, 1
jne 0x14000cd6c
xor r9d, r9d
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400111e0
cmp al, 1
jne 0x14000cd6c
mov r9, qword [rsp + 0x78]
lea r8, [0x14005b1b8]
mov edx, 0x100
mov rcx, rsi
call fcn.140002050
mov ecx, dword [rsp + 0x30]
mov dword [rsi + 0x100], ecx
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x104], eax
mov dword [rsi + 0x110], ecx
mov dword [rsi + 0x114], eax
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140010d40
mov ecx, 3
cmp al, 1
cmove ecx, dword [rsp + 0x30]
mov dword [rsi + 0x108], ecx
xor r9d, r9d
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400112e0
mov ecx, 0x800000
cmp al, 1
cmove ecx, dword [rsp + 0x34]
mov dword [rsi + 0x10c], ecx
movups xmm0, xmmword [0x14005b018]
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x384
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400105f0
mov eax, dword [rsp + 0x38]
mov dword [rsi + 0x120], eax
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140010300
test al, al
jne 0x14000cd4f
mov qword [rsi + 0x118], rdi
jmp 0x14000cd5f
mov eax, dword [rsp + 0x38]
mov dword [rsi + 0x118], eax
mov dword [rsi + 0x11c], eax
add rsi, 0x124
inc dword [rbx + 0x3b0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ole32.dll_PropVariantClear]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000cd86
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000cd95
mov rax, qword [rcx]
call qword [rax + 0x10]
inc r14d
cmp r14d, dword [rsp + 0x60]
jb 0x14000cbd0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
lea r9, [rsp + 0x68]
xor edx, edx
lea r8d, [rdx + 0xf]
call qword [rax + 0x18]
test eax, eax
jne 0x14000d005
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x18]
test eax, eax
jne 0x14000cffa
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000cffa
imul rdx, rax, 0x124
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov qword [rbx + 0x3a8], rax
test rax, rax
je 0x14000cffa
cmp dword [rsp + 0x60], 0
jbe 0x14000cffa
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
mov edx, edi
call qword [rax + 0x20]
test eax, eax
jne 0x14000cfdf
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
lea r8, [rbp - 0x78]
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x14000cfd0
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x14005b0b8]
call qword [rax + 0x28]
test eax, eax
jne 0x14000cfc5
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14000cef1
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x50]
call fcn.14001cd80
lea r8, [rbp - 0x50]
mov rdx, r14
mov rcx, rbx
call fcn.140012390
test al, al
je 0x14000ceec
lea rdx, str.2A6CD79F_47E8_4ABC_822B_3D301078976A
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x14000ceec
mov r9d, 1
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140010c40
test al, al
jne 0x14000ceec
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400146d0
mov r14, qword [rsp + 0x78]
mov r9d, 1
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, rbx
call fcn.140010c40
cmp al, 1
jne 0x14000cfc5
mov r9d, 1
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400111e0
cmp al, 1
jne 0x14000cfc5
mov r9, qword [rsp + 0x78]
lea r8, [0x14005b1b8]
mov edx, 0x100
mov rcx, rsi
call fcn.140002050
mov ecx, dword [rsp + 0x30]
mov dword [rsi + 0x100], ecx
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x104], eax
mov dword [rsi + 0x110], ecx
mov dword [rsi + 0x114], eax
mov r9d, 1
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140010d40
cmp al, 1
jne 0x14000cf8e
mov eax, dword [rsp + 0x30]
mov dword [rsi + 0x108], eax
mov r9d, 1
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400112e0
mov ecx, 0x40860000
cmp al, 1
cmove ecx, dword [rsp + 0x34]
mov dword [rsi + 0x10c], ecx
add rsi, 0x124
inc dword [rbx + 0x3b4]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ole32.dll_PropVariantClear]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000cfdf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000cfee
mov rax, qword [rcx]
call qword [rax + 0x10]
inc edi
cmp edi, dword [rsp + 0x60]
jb 0x14000ce20
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test byte [r12], 4
je 0x14000d029
lea rcx, [0x14005e030]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x14006f530]
mov dword [rbx + 0x258], ecx
mov rax, rbx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140019840
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret