Function at 0x140015b50
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], 0xa
mov qword [rcx + 0x38], r15
xor edx, edx
mov r8d, 0x100
add rcx, 0x40
call fcn.140028230
mov qword [rbx + 0x140], r15
lea rcx, [rbx + 0x148]
xor edx, edx
mov r8d, 0x100
call fcn.140028230
mov eax, 0x13
mov word [rbx + 0x248], ax
mov dword [rbx + 0x24c], r15d
mov dword [rbx + 0x250], 0x1f402454
mov word [rbx + 0x254], r15w
mov dword [rbx + 0x258], 0xffffffff
mov qword [rbx + 0x25c], 1
mov dword [rbx + 0x264], r15d
mov r12d, 0x80
mov word [rbx + 0x268], r12w
mov qword [rbx + 0x26c], r15
mov qword [rbx + 0x274], r15
mov qword [rbx + 0x27c], r15
mov qword [rbx + 0x284], r15
mov dword [rbx + 0x28c], r15d
mov dword [rbx + 0x290], 1
mov dword [rbx + 0x294], 1
lea rdi, [rbx + 0x298]
mov dword [rdi], r15d
mov dword [rbx + 0x29c], 0x1f4
mov byte [rbx + 0x2a0], r15b
mov qword [rbx + 0x2a8], r15
lea rax, vtable.RpcServer::CM_MMEndpointNotify.0
mov qword [rbx + 0x2b0], rax
mov qword [rbx + 0x2b8], r15
mov qword [rbx + 0x2c0], r15
mov qword [rbx + 0x2c8], r15
mov qword [rbx + 0x2d0], r15
mov qword [rbx + 0x2d8], r15
mov dword [rbx + 0x2e0], 0xa
mov qword [rbx + 0x2f0], r15
mov qword [rbx + 0x2f8], r15
mov qword [rbx + 0x300], r15
mov qword [rbx + 0x308], r15
mov qword [rbx + 0x310], r15
mov byte [rbx + 0x328], r15b
mov qword [rbx + 0x384], 0xffffffffffffffff
mov dword [rbx + 0x390], 0xffffffff
lea rsi, [rbx + 0x394]
mov dword [rsi], 0xff
mov dword [rbx + 0x398], r15d
mov qword [rbx + 0x3a0], r15
mov dword [rbx + 0x3a8], 0xffffffff
mov qword [rbx + 0x3b0], r15
mov qword [rbx + 0x3b8], r15
mov qword [rbx + 0x3c0], r15
mov dword [rbx + 0x3c9], r15d
mov byte [rbx + 0x3cd], r15b
mov dword [rbx + 0x3d0], 0xffffffff
mov byte [rbx + 0x3d4], r15b
mov dword [rbx + 0x3d8], 0xffffffff
mov byte [rbx + 0x3dc], r15b
mov dword [rbx + 0x3e0], r15d
mov qword [rbx + 0x3e4], 1
mov dword [rbx + 0x3ec], 0xa
mov dword [rbx + 0x3f0], 0xa
lea rdx, str.FMService_EventLog
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rbx], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREFortemedia
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140015e07
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ServiceTraceFlag
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.140028230
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x150]
call fcn.140028230
lea r9, [rsp + 0x150]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001c080
test eax, eax
je 0x140015e65
lea rdx, str.103c
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140015e65
mov byte [rbx + 0x2a0], 1
test byte [rdi], 4
je 0x140015e77
lea rcx, [0x14006b670]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [rsp + 0x3b0], 0
jne 0x140015f60
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x318], rax
lea r8, str.FMAPOCTL3
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x320], rax
test rax, rax
jne 0x140015ece
test byte [rdi], 1
je 0x140015ece
lea rcx, str.Open_ChangeMode_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, str.FMAPOCTL_OnDeviceAdded_event
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x300], rax
test rax, rax
jne 0x140015f00
test byte [rdi], 1
je 0x140015f00
lea rcx, str.Open_m_hDevAddEvent_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, str.FMAPOService_APO_Running_event
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x308], rax
test rax, rax
jne 0x140015f32
test byte [rdi], 1
je 0x140015f32
lea rcx, str.Open_m_hDevAddEvent_Event_Fail_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x310], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x2f0], rax
mov dword [rbx + 0x384], 0xffffffff
lea rcx, [rbx + 0x330]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x358]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0x380], r15d
mov dword [rbx + 0x38c], r15d
mov byte [rbx + 0x3c8], 0
mov word [rbx + 0x260], r12w
mov r8, rsi
lea rdx, str.samsfpacx.dat
mov rcx, rbx
call fcn.14001b3e0
test al, al
jne 0x140015fd5
mov r8, rsi
lea rdx, str.samsfpa.dat
mov rcx, rbx
call fcn.14001b3e0
test al, al
jne 0x140015fd5
mov dword [rsi], 0xff
jmp 0x140015fdd
mov eax, dword [rsi]
mov dword [0x14007ff24], eax
movzx eax, word [rbx + 0x260]
mov word [rbx + 0x268], ax
lea r8, [rbx + 0x398]
lea rdx, str.samsfpaspk.dat
mov rcx, rbx
call fcn.14001b3e0
test al, al
jne 0x14001600c
mov dword [rbx + 0x398], r15d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbx + 0x40]
call fcn.140028230
mov rcx, rbx
call fcn.14001e8a0
mov rcx, rbx
call fcn.14001ec90
test byte [rdi], 4
je 0x14001603f
lea rcx, [0x14006b738]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x140080430]
mov dword [rbx + 0x258], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret