Function at 0x140003f80
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4368]
mov eax, 0x4468
call fcn.14001a660
sub rsp, rax
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rbp + 0x4340], rax
mov r15d, edx
lea rax, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004414
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x4480], rbx
lea rdx, str.UpperFilters
mov qword [rsp + 0x4490], rsi
xor r9d, r9d
mov qword [rsp + 0x4498], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3f40]
mov qword [rsp + 0x4460], r12
mov qword [rsp + 0x4458], r13
mov qword [rsp + 0x4450], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13d, 1
test eax, eax
jne 0x140004401
xor r12d, r12d
mov r14d, r12d
mov esi, r12d
mov edi, r12d
cmp dword [rsp + 0x30], r13d
je 0x1400040f7
nop word [rax + rax]
mov eax, esi
lea rcx, [rbp + 0x3f40]
lea rcx, [rcx + rax*2]
mov eax, r14d
mov qword [rsp + rax*8 + 0x40], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140004090
inc eax
add esi, eax
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400040b0
lea ebx, [rax*2 + 2]
test r14d, r14d
je 0x1400040d1
lea eax, [r14 - 1]
mov rcx, qword [rsp + rax*8 + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x1400040f7
inc r14d
lea eax, [rdi + rbx]
test ebx, ebx
cmove eax, edi
lea edi, [rax + 1]
mov eax, dword [rsp + 0x30]
dec eax
cmp edi, eax
jb 0x140004070
cmp r15d, r13d
jne 0x140004261
mov r8d, r12d
test r14d, r14d
je 0x14000419e
lea r9, [rsp + 0x40]
lea r10, [0x140025810]
nop dword [rax + rax]
mov rdx, qword [r9]
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x140004192
cmp rcx, 4
jne 0x140004130
mov rax, r13
mov r13, qword [rsp + 0x4458]
mov r12, qword [rsp + 0x4460]
mov rdi, qword [rsp + 0x4498]
mov rsi, qword [rsp + 0x4490]
mov rbx, qword [rsp + 0x4480]
mov r14, qword [rsp + 0x4450]
mov rcx, qword [rbp + 0x4340]
xor rcx, rsp
call fcn.140006180
add rsp, 0x4468
pop r15
pop rbp
ret
inc r8d
add r9, 8
cmp r8d, r14d
jb 0x140004120
mov r15, r12
test r14d, r14d
je 0x1400041e8
mov rdx, r12
mov r8d, r14d
nop dword [rax]
mov rcx, qword [rsp + rdx + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400041c0
lea rax, [rax*2 + 2]
mov qword [rbp + rdx + 0xf40], rax
add r15, rax
add rdx, 8
sub r8, r13
jne 0x1400041b0
lea r13, [r15 + 0xa]
mov rcx, r13
call fcn.14000cf7c
mov qword [0x14002d0a0], rax
mov rdi, rax
test rax, rax
je 0x14000439a
movsd xmm0, qword [0x140025810]
mov esi, 8
movsd qword [rax], xmm0
test r14d, r14d
je 0x140004254
mov rbx, r12
test r12d, r12d
je 0x140004232
lea eax, [r12 - 1]
add rsi, qword [rbp + rax*8 + 0xf40]
mov r8, qword [rbp + rbx + 0xf40]
lea rcx, [rdi + rsi]
mov rdx, qword [rsp + rbx + 0x40]
call fcn.140008350
inc r12d
add rbx, 8
cmp r12d, r14d
jb 0x140004220
mov word [rdi + r15 + 8], 0
jmp 0x14000439a
xor r9b, r9b
test r14d, r14d
je 0x140004145
lea r11, [rsp + 0x40]
mov edi, r14d
mov ebx, r14d
lea r10, [0x140025810]
nop
mov r8, qword [r11]
mov rcx, r12
nop word [rax + rax]
movzx edx, word [r8 + rcx*2]
inc rcx
movzx eax, word [r10 + rcx*2 - 2]
sub edx, eax
jne 0x1400042a8
cmp rcx, 4
jne 0x140004290
test edx, edx
movzx r9d, r9b
cmove r9d, r13d
add r11, 8
sub rbx, r13
jne 0x140004280
test r9b, r9b
je 0x14000440c
mov r14d, r12d
mov r15, r12
mov r8, r12
nop dword [rax]
mov rdx, qword [rsp + r8 + 0x40]
mov rcx, r12
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x1400042f7
cmp rcx, 4
jne 0x1400042e0
jmp 0x14000432d
mov rcx, 0xffffffffffffffff
nop
cmp word [rdx + rcx*2 + 2], r12w
lea rcx, [rcx + 1]
jne 0x140004300
mov eax, r14d
lea rcx, [rcx*2 + 2]
add r15, rcx
inc r14d
mov qword [rbp + rax*8 + 0x2f40], rdx
mov qword [rbp + rax*8 + 0x1f40], rcx
add r8, 8
sub rdi, r13
jne 0x1400042d0
lea r13, [r15 + 2]
mov rcx, r13
call fcn.14000cf7c
mov qword [0x14002d0a0], rax
mov rdi, rax
test rax, rax
je 0x14000439a
mov ebx, r12d
test r14d, r14d
je 0x140004393
mov rsi, r12
nop dword [rax]
test ebx, ebx
je 0x14000436f
lea eax, [rbx - 1]
add r12, qword [rbp + rax*8 + 0x1f40]
mov r8, qword [rbp + rsi + 0x1f40]
lea rcx, [rdi + r12]
mov rdx, qword [rbp + rsi + 0x2f40]
call fcn.140008350
inc ebx
add rsi, 8
cmp ebx, r14d
jb 0x140004360
mov word [rdi + r15], 0
test r13, r13
je 0x1400043fb
mov rdx, rdi
lea rcx, str.TotalData___s_r_n
call fcn.140005cd0
mov rcx, qword [rsp + 0x38]
lea rdx, str.UpperFilters
mov dword [rsp + 0x28], r13d
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x14002d0a0]
mov r13d, 1
mov edx, r13d
call fcn.1400061a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x140004148
mov r13d, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x140004148
mov eax, 1
jmp 0x140004178