Function at 0x100019d20
Capabilities:
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x100030180]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov eax, dword [rcx + 0x128]
xor r13d, r13d
mov r12, rcx
and eax, 0xf
mov ebp, r13d
lea r14d, [r13 + 1]
lea r15d, [r13 + 4]
je 0x100019f69
cmp eax, 3
jne 0x100019e7e
lea r9d, [r13 + 0x12]
lea rcx, [0x100012a60]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x48], r13d
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x100019da3
mov rdi, r13
jmp 0x100019e1e
or qword [rsp + 0x50], 0xffffffffffffffff
mov dword [rsp + 0x60], 0x20
mov ebx, r13d
lea rax, [rsp + 0x60]
lea r8, [0x100012a60]
mov r9d, ebx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
cmp eax, r13d
je 0x100019def
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.100017d0c
cmp al, r13b
jne 0x100019e04
add ebx, r14d
cmp ebx, 0x20
jae 0x100019e04
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
jne 0x100019db4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rdi, qword [rsp + 0x50]
cmp rdi, 0xffffffffffffffff
je 0x100019e76
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov r9d, r15d
mov edx, 0x220794
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, r13d
cmp eax, r13d
mov rcx, rdi
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, r13d
je 0x100019e76
mov ebx, 2
cmp dword [rsp + 0x48], r13d
je 0x100019e79
mov ebx, r15d
mov ebp, r15d
jmp 0x100019e84
mov ebp, r14d
mov ebx, r14d
xor edx, edx
mov ecx, ebp
call fcn.100016a40
mov ecx, ebp
call fcn.1000171e8
mov ecx, ebp
call fcn.100017a14
lea r8, [rsp + 0x50]
lea rdx, [0x100013818]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100019f69
lea rax, [rsp + 0x48]
lea rdi, [0x100013850]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100019f5e
mov eax, dword [rsp + 0x40]
test r15b, bl
je 0x100019f18
cmp eax, 2
je 0x100019f18
mov dword [rsp + 0x40], 2
jmp 0x100019f38
test r14b, bl
je 0x100019f29
cmp eax, r14d
je 0x100019f29
mov dword [rsp + 0x40], r14d
jmp 0x100019f38
test bl, 2
je 0x100019f5e
cmp eax, r13d
je 0x100019f5e
mov dword [rsp + 0x40], r13d
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [r12 + 0x128]
mov esi, r13d
and eax, 0xf0
je 0x100019f85
mov esi, r14d
cmp eax, 0x30
cmove esi, r15d
mov dword [rsp + 0x58], r13d
lea rbx, [0x100012640]
mov edi, 0x38
lea r9, [rbx + 0x44]
lea rcx, [rsp + 0x80]
xor r8d, r8d
mov edx, edi
call fcn.1000162d4
cmp eax, r13d
jne 0x100019ff3
cmp dword [rbx], r13d
jne 0x100019fbc
mov dword [rsp + 0x58], ebp
jmp 0x100019fca
mov eax, dword [rsp + 0x58]
cmp dword [rbx], r14d
cmove eax, esi
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x80]
lea rdx, [0x100013c70]
mov r9d, r15d
mov rcx, r12
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.100019bb4
lea rax, [0x1000129e8]
add rbx, 0x1d4
cmp rbx, rax
jne 0x100019f96
mov ebx, 0x80004005
cmp qword [r12 + 0x120], r13
je 0x10001a0fd
mov rcx, qword [r12 + 0x120]
mov qword [rsp + 0x48], r13
lea r9, [rsp + 0x48]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], r13
cmp rcx, r13
je 0x10001a0fd
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x28]
mov rdx, qword [rsp + 0x50]
cmp eax, r13d
jl 0x10001a0a7
lea rax, [rsp + 0x80]
mov r8, rdx
lea rcx, [rsp + 0x80]
sub r8, rax
lea rax, [rdi + 0x7fffffc6]
cmp rax, r13
je 0x10001a097
movzx eax, word [r8 + rcx]
cmp ax, r13w
je 0x10001a097
mov word [rcx], ax
add rcx, 2
sub rdi, r14
jne 0x10001a074
cmp rdi, r13
jne 0x10001a0a0
sub rcx, 2
mov word [rcx], r13w
mov ebx, r13d
cmp rdx, r13
je 0x10001a0ba
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x50], r13
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x10001a0ca
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r13d
jne 0x10001a0fd
lea rax, [rsp + 0x80]
lea r8, [0x100013c28]
lea rdx, [0x100013c50]
mov r9d, r14d
mov rcx, r12
mov dword [rsp + 0x28], 0x70
mov qword [rsp + 0x20], rax
call fcn.100019bb4
mov qword [rsp + 0x30], r13
lea rcx, [0x100013be0]
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [0x100013bb0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x48]
lea rdx, [0x100013bb0]
lea r8d, [rax + rax + 2]
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10001e0c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret