Function at 0x1400100b0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x107e0]
mov eax, 0x108e0
call fcn.1401945e0
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x10930], rbx
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rbp + 0x107d0], rax
mov r15d, edx
mov r12, rcx
xor r8d, r8d
lea rdx, str.Tool_VDCModuleUninstallCheck
lea rcx, [rsp + 0x70]
call fcn.140017fc0
nop
mov dword [rsp + 0x20], r15d
mov r9, r12
lea r8, str.lpszDriver___s__bDebug___d
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.140017c80
xor r13d, r13d
call fcn.140051e58
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14001014e
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x40], r13d
mov r14d, r13d
call fcn.140054cb8
mov rdi, qword [rax + 8]
mov qword [rbp - 0x70], rdi
cmp r15d, 1
jne 0x1400101ad
mov r8, r12
lea rdx, str.FREEDOM_Driver_Name_:__s_
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.Tool_VDCModuleUninstallCheck
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rdi + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
or esi, 0xffffffff
cmp rcx, rdi
je 0x140010211
cmp dword [rdi + 0x10], r14d
jl 0x1400101fe
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400101fe
call fcn.140001950
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400101f3
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x140010211
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001c20
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x7d0]
call fcn.140192cb0
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x7d0]
call fcn.1401939a0
mov qword [rsp + 0x68], r13
lea r8, [rsp + 0x68]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
lea rcx, [rbp + 0x7d0]
call fcn.1401944dc
mov rdi, rax
test rax, rax
je 0x140010742
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010294
lea r8, [rsp + 0x68]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
xor ecx, ecx
call fcn.1401944dc
mov rdi, rax
test rax, rax
jne 0x140010264
jmp 0x140010742
test rdi, rdi
je 0x140010742
cmp r15d, 1
jne 0x1400102d3
mov r8, rdi
lea rdx, str.This_Driver__s__is_VDC_Service_Model
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.Tool_VDCModuleUninstallCheck
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [r9 + 2]
call sub.WINSPOOL.DRV_EnumPrintersW
test eax, eax
jne 0x14001034f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14001034f
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x70]
call fcn.140017c80
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14001033e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140010783
mov edx, dword [rsp + 0x44]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140010742
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9, rdi
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [rdx + 2]
call sub.WINSPOOL.DRV_EnumPrintersW
cmp eax, 1
jne 0x1400104f6
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400104f0
mov r15d, r13d
lea r12, [rdi + 0x20]
nop word [rax + rax]
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140010425
cmp dword [rdi + 0x10], 0
jl 0x140010412
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010412
call fcn.140001950
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140010407
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x140010425
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001c20
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x7d0]
call fcn.140192cb0
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x7d0]
call fcn.1401939a0
lea r8, [rsp + 0x68]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
lea rcx, [rbp + 0x7d0]
call fcn.1401944dc
test rax, rax
je 0x140010499
nop dword [rax]
mov rdx, rax
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400104b5
lea r8, [rsp + 0x68]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
xor ecx, ecx
call fcn.1401944dc
test rax, rax
jne 0x140010470
mov r14d, 1
inc r15d
add r12, 0x88
cmp r15d, dword [rsp + 0x40]
jae 0x1400104ea
jmp 0x1400103c0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400104d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140010783
mov rdi, qword [rbp - 0x78]
jmp 0x1400104f6
mov r14d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp r14d, 1
jne 0x140010742
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, str.SOFTWARECanonVDCSETUPVDCUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001055e
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14001054d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140010783
call fcn.140051e58
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14001057e
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov r12, qword [rbp - 0x70]
mov rdx, qword [r12 + 0x1b8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400105f3
cmp dword [rdi + 0x10], 0
jl 0x1400105e0
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400105e0
call fcn.140001950
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400105d5
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x58], rbx
jmp 0x1400105f3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001c20
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [r12 + 0x1c0]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140010663
cmp dword [rdi + 0x10], 0
jl 0x140010650
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010650
call fcn.140001950
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140010645
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x58], rbx
jmp 0x140010663
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001c20
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, r13d
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x54], 0x208
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x5c0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140010712
inc edi
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x54], 0x208
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x5c0]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400106c2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete r13b
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001073d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov r9d, r13d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.140017c80
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140010776
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x70]
call fcn.140018150
mov eax, r13d
mov rcx, qword [rbp + 0x107d0]
xor rcx, rsp
call fcn.1401945b0
mov rbx, qword [rsp + 0x10930]
add rsp, 0x108e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret