Function at 0x140024010
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x600
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov r14, rdx
mov r12, rcx
lea r8, str.CMonitorUninstaller::Delete_MONITOR_INFO_1_monitorInfo1____r_n
mov edx, 2
lea rdi, [0x14010f570]
mov rcx, rdi
call fcn.140001000
mov r8, qword [r14]
lea rdx, str.CMonitorUninstaller::DeleteStub__s_
mov rcx, rdi
call fcn.14004b9f0
mov r9, qword [r14]
lea r8, str.Checking__s__r_n
mov ebp, 0x20
mov edx, ebp
mov rcx, rdi
call fcn.140001000
xor r15d, r15d
mov byte [rsp + 0xe0], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xe1]
call fcn.1400988d0
mov r13, r15
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], r15d
lea rcx, [r12 + 0x98]
mov rax, qword [rcx]
mov rdx, qword [r14]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov ebx, eax
lea esi, [rbp - 0x11]
cmp eax, r15d
jne 0x1400245de
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r15
mov byte [rsp + 0x90], r15b
lea rcx, str.SystemCurrentControlSetControlPrintMonitors_
call fcn.1400980d0
mov r8, rax
lea rdx, str.SystemCurrentControlSetControlPrintMonitors_
lea rcx, [rsp + 0x88]
call fcn.14000352c
nop
mov r8, qword [r14]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xb0]
call fcn.14000e9d8
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x14002414c
mov rcx, qword [rsp + 0x90]
call fcn.14006127c
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r15
mov byte [rsp + 0x90], r15b
lea r8, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0x10
cmovae r8, qword [rsp + 0xb8]
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rsp + 0x70]
call fcn.14000bc38
mov r13, qword [rsp + 0x70]
cmp eax, r15d
jne 0x1400245b2
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Driver
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x1400245b2
lea r9, [rsp + 0xe0]
lea r8, str.Driver_Name___s__r_n
mov edx, ebp
mov rcx, rdi
call fcn.140001000
lea rcx, [rsp + 0xe0]
call fcn.1400980d0
cmp rax, r15
jbe 0x1400245b2
cmp qword [r12 + 0x108], r15
je 0x1400243ed
mov rax, qword [r12 + 0x100]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [r12 + 0xd8]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [r12 + 0x100]
cmp rsi, r15
je 0x140024267
cmp rsi, qword [r12 + 0xd8]
je 0x14002426c
call fcn.14009861c
cmp rbp, rdi
je 0x1400243e4
cmp rsi, r15
jne 0x140024284
call fcn.14009861c
mov r11, r15
jmp 0x140024287
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x140024292
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x14002429f
mov rdx, qword [rbp + 0x18]
jmp 0x1400242a3
lea rdx, [rbp + 0x18]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000c3fc
mov rdi, qword [rsp + 0x40]
cmp rdi, 0xfffffffffffffffc
je 0x1400242e7
cmp rdi, r15
jne 0x1400242c6
call fcn.14009861c
cmp qword [rdi + 0x20], 0x10
jb 0x1400242d3
mov rcx, qword [rdi + 8]
jmp 0x1400242d7
lea rcx, [rdi + 8]
add rcx, qword [rdi + 0x18]
cmp qword [rsp + 0x48], rcx
jb 0x1400242e7
call fcn.14009861c
cmp rsi, r15
jne 0x1400242f6
call fcn.14009861c
mov r11, r15
jmp 0x1400242f9
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x140024304
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x140024311
mov rdx, qword [rbp + 0x18]
jmp 0x140024315
lea rdx, [rbp + 0x18]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c3fc
mov rdi, qword [rsp + 0x30]
cmp rdi, 0xfffffffffffffffc
je 0x14002435d
cmp rdi, r15
jne 0x140024338
call fcn.14009861c
cmp qword [rdi + 0x20], 0x10
jb 0x140024345
mov rcx, qword [rdi + 8]
jmp 0x140024349
lea rcx, [rdi + 8]
mov rax, qword [rdi + 0x18]
lea rdx, [rcx + rax]
cmp qword [rsp + 0x38], rdx
jb 0x14002435d
call fcn.14009861c
mov rcx, qword [rsp + 0x48]
call fcn.1400980d0
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x38]
call fcn.1400990e0
cmp rsi, r15
jne 0x140024384
call fcn.14009861c
mov r11, r15
jmp 0x140024387
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x140024392
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x14002439f
mov rdx, qword [rbp + 0x18]
jmp 0x1400243a3
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0xe0]
call fcn.140099250
mov ebx, r15d
cmp rax, r15
setne bl
cmp ebx, 1
je 0x1400243e4
cmp rsi, r15
jne 0x1400243cd
call fcn.14009861c
mov r11, r15
jmp 0x1400243d0
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x1400243db
call fcn.14009861c
mov rbp, qword [rbp]
jmp 0x140024250
cmp ebx, r15d
jne 0x1400245b2
cmp qword [r12 + 0x68], r15
je 0x1400245b2
mov rax, qword [r12 + 0x60]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [r12 + 0x38]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [r12 + 0x60]
cmp rsi, r15
je 0x140024435
cmp rsi, qword [r12 + 0x38]
je 0x14002443a
call fcn.14009861c
cmp rbp, rdi
je 0x1400245b2
cmp rsi, r15
jne 0x140024452
call fcn.14009861c
mov r11, r15
jmp 0x140024455
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x140024460
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x14002446d
mov rdx, qword [rbp + 0x18]
jmp 0x140024471
lea rdx, [rbp + 0x18]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c3fc
mov rdi, qword [rsp + 0x30]
cmp rdi, 0xfffffffffffffffc
je 0x1400244b5
cmp rdi, r15
jne 0x140024494
call fcn.14009861c
cmp qword [rdi + 0x20], 0x10
jb 0x1400244a1
mov rcx, qword [rdi + 8]
jmp 0x1400244a5
lea rcx, [rdi + 8]
add rcx, qword [rdi + 0x18]
cmp qword [rsp + 0x38], rcx
jb 0x1400244b5
call fcn.14009861c
cmp rsi, r15
jne 0x1400244c4
call fcn.14009861c
mov r11, r15
jmp 0x1400244c7
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x1400244d2
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x1400244df
mov rdx, qword [rbp + 0x18]
jmp 0x1400244e3
lea rdx, [rbp + 0x18]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000c3fc
mov rdi, qword [rsp + 0x40]
cmp rdi, 0xfffffffffffffffc
je 0x14002452b
cmp rdi, r15
jne 0x140024506
call fcn.14009861c
cmp qword [rdi + 0x20], 0x10
jb 0x140024513
mov rcx, qword [rdi + 8]
jmp 0x140024517
lea rcx, [rdi + 8]
mov rax, qword [rdi + 0x18]
lea rdx, [rcx + rax]
cmp qword [rsp + 0x48], rdx
jb 0x14002452b
call fcn.14009861c
mov rcx, qword [rsp + 0x38]
call fcn.1400980d0
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x48]
call fcn.1400990e0
cmp rsi, r15
jne 0x140024552
call fcn.14009861c
mov r11, r15
jmp 0x140024555
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x140024560
call fcn.14009861c
cmp qword [rbp + 0x30], 0x10
jb 0x14002456d
mov rdx, qword [rbp + 0x18]
jmp 0x140024571
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0xe0]
call fcn.140099250
mov ebx, r15d
cmp rax, r15
setne bl
cmp ebx, 1
je 0x1400245b2
cmp rsi, r15
jne 0x14002459b
call fcn.14009861c
mov r11, r15
jmp 0x14002459e
mov r11, qword [rsi]
cmp rbp, qword [r11 + 0x28]
jne 0x1400245a9
call fcn.14009861c
mov rbp, qword [rbp]
jmp 0x140024424
cmp qword [rsp + 0xd0], 0x10
jb 0x1400245ca
mov rcx, qword [rsp + 0xb8]
call fcn.14006127c
cmp ebx, r15d
je 0x14002462b
lea rdi, [0x14010f570]
mov esi, reloc.OLEAUT32.dll_SafeArrayDestroy
lea ebp, [rsi + 0x11]
mov r8, qword [r14]
lea rdx, str.Found_monitor__s__to_delete
mov rcx, rdi
call fcn.14004b9f0
mov r9, qword [r14]
lea r8, str.Found_monitor_to_delete__s__r_n
mov edx, ebp
mov rcx, rdi
call fcn.140001000
mov r8, qword [r14]
xor edx, edx
xor ecx, ecx
call sub.WINSPOOL.DRV_DeleteMonitorA
cmp eax, r15d
je 0x14002465e
mov r9, qword [r14]
lea r8, str.Removed_monitor___s__r_n
mov edx, ebp
mov rcx, rdi
call fcn.140001000
jmp 0x140024632
lea rdi, [0x14010f570]
lea r8, str.CMonitorUninstaller::Delete_MONITOR_INFO_1_monitorInfo1____r_n
mov edx, 4
mov rcx, rdi
call fcn.140001000
nop
cmp r13, r15
je 0x140024654
mov rcx, r13
call fcn.14004e608
mov eax, 1
jmp 0x140024755
mov byte [rsp + 0x1f0], r15b
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x1f1]
call fcn.1400988d0
mov r9, qword [r14]
lea r8, str.Can_not_delete_monitor___s_
mov edx, 0x400
lea rcx, [rsp + 0x1f0]
call fcn.14009841c
mov ecx, 2
call fcn.14003ff90
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r15
mov byte [rsp + 0x90], r15b
lea rcx, [rsp + 0x88]
call fcn.14004d614
lea r11, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae r11, qword [rsp + 0x90]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x1f0]
lea r8, str._s_:__s_n
mov edx, ebp
mov rcx, rdi
call fcn.140001000
lea r8, [rsp + 0x1f0]
lea rdx, str._s_failed_n
mov rcx, rdi
call fcn.14004b7ec
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x14002472e
mov rcx, qword [rsp + 0x90]
call fcn.14006127c
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r15
mov byte [rsp + 0x90], r15b
cmp r13, r15
je 0x140024753
mov rcx, r13
call fcn.14004e608
xor eax, eax
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.140061100
mov rbx, qword [rsp + 0x650]
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret