Function at 0x14002d6c0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x138]
sub rsp, 0x230
mov qword [rax + 0x10], rbx
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x38], r15
movzx r12d, r8b
mov r13, rdx
lea rcx, [rbp + 2]
xor r15d, r15d
xor edx, edx
mov r8d, 0xfe
mov word [rbp], r15w
movzx ebx, r9b
call fcn.140001440
lea r8, str.PDZipVirtualCDBus
lea rdx, str.___sStandardDevice
lea rcx, [rbp]
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, str.RegistryMachineSystemMountedDevices
lea rcx, [rbp + 0x140]
xor r8d, r8d
call fcn.1400223e0
mov esi, r15d
mov qword [rsp + 0x30], r15
mov edi, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
test bl, bl
je 0x14002d8ca
mov ebx, r15d
mov qword [rsp + 0x208], r14
nop dword [rax + rax]
mov rcx, qword [rbp + 0x140]
xor r9d, r9d
lea rax, [rbp + 0x158]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
mov edx, ebx
mov dword [rbp + 0x158], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov eax, dword [rbp + 0x158]
test eax, eax
je 0x14002d8c2
mov r14d, eax
cmp rdi, rax
jae 0x14002d7ed
mov r15d, eax
cmp rax, rdi
mov r8, rdi
cmovb r15, rdi
mov rcx, rsi
mov rdx, r15
call fcn.140022a30
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14002d7e5
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
jmp 0x14002d7ed
mov qword [rsp + 0x38], r15
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.140001f50
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rbp + 0x140]
lea rax, [rbp + 0x158]
mov r9, rsi
mov r8d, 1
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov edx, ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
test eax, eax
js 0x14002d8c2
mov eax, dword [rsi + 0xc]
and eax, 0xfffffffe
cmp eax, 0x100
jb 0x14002d8b6
mov ecx, dword [rsi + 8]
lea rdx, [rbp]
mov r8d, 0xfe
add rcx, rsi
call fcn.1400015b0
test eax, eax
jne 0x14002d8b6
mov eax, dword [rsi + 0x10]
lea rcx, [rsi + 0x14]
shr rax, 1
cmp qword [rbp + 0x140], 0
je 0x14002d8b6
test rcx, rcx
je 0x14002d8b6
cmp rax, 0xffffffffffffffff
jne 0x14002d888
mov rdx, rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x14002d89e
add ax, ax
mov qword [rsp + 0x50], rcx
mov word [rsp + 0x48], ax
add ax, 2
mov word [rsp + 0x4a], ax
mov rcx, qword [rbp + 0x140]
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
test eax, eax
js 0x14002d8b6
dec ebx
mov rdi, qword [rsp + 0x38]
inc ebx
jmp 0x14002d770
mov r14, qword [rsp + 0x208]
cmp qword [r13 + 8], 0
je 0x14002da18
test r12b, r12b
je 0x14002da18
movaps xmm0, xmmword [str.98BD6CC8_2327_432C_A255_B34BE6960802]
movaps xmm1, xmmword [0x140035770]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x78], rax
mov eax, dword [0x1400357a8]
lea rdi, [0x1400359e8]
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x140035780]
movaps xmmword [rbp - 0x40], xmm1
mov dword [rbp - 8], eax
movzx eax, word [0x1400357ac]
mov r9, rdi
movaps xmm1, xmmword [0x140035790]
mov word [rbp - 4], ax
mov rax, qword [r13]
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm1
movsd xmm0, qword [0x1400357a0]
test rax, rax
lea r8, [rbp]
movsd qword [rbp - 0x10], xmm0
cmovne r9, rax
lea rax, [rbp - 0x50]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 1
mov qword [rsp + 0x20], rax
mov word [rbp - 0x70], r15w
call fcn.140003fb0
movups xmm0, xmmword [str.DosDevicesX:]
movsd xmm1, qword [0x1400357d0]
mov eax, dword [0x1400357d8]
mov rbx, qword [rbp - 0x80]
mov ecx, 0xffdf
movsd qword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x70], eax
movzx eax, word [0x1400357dc]
lea rdx, [rsp + 0x58]
mov word [rsp + 0x74], ax
movsx eax, r12b
and ax, cx
lea rcx, [rsp + 0x48]
mov word [rsp + 0x70], ax
mov rax, qword [rsp + 0x78]
test rax, rax
cmovne rdi, rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x140]
lea eax, [rbx + rbx]
lea rdx, [rsp + 0x48]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002da18
lea rax, [rbp - 0x70]
cmp rcx, rax
je 0x14002da18
call fcn.140022b00
mov r15, qword [rsp + 0x200]
mov r13, qword [rsp + 0x210]
mov r12, qword [rsp + 0x218]
mov rdi, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x248]
test rsi, rsi
je 0x14002da4d
mov rcx, rsi
call fcn.140022b00
mov rcx, qword [rbp + 0x140]
mov rsi, qword [rsp + 0x228]
test rcx, rcx
je 0x14002da67
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x230
pop rbp
ret