Function at 0x140007060
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xdd0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xe28], rbx
mov rax, qword [0x140074c00]
xor rax, rsp
mov qword [rsp + 0xdc0], rax
mov r14, r8
mov r15, rdx
mov r13, rcx
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140007818
lea rcx, [rsp + 0x330]
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionPrintPrinters
mov r8d, 0x90
call fcn.14003f7f0
lea rcx, [rsp + 0x2b0]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters
mov r8d, 0x78
call fcn.14003f7f0
xor esi, esi
mov word [rsp + 0x3c0], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x3c2]
call fcn.14003ea70
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000714f
lea r8, [rsp + 0x330]
lea rdx, [0x140060998]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000716c
lea r8, [rsp + 0x2b0]
lea rdx, [0x140060998]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x3c0]
lea rcx, str.in_GetWSDUrlAddressB_function__subreg___s
call fcn.140005be0
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x3c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400071c4
lea rcx, str.GetWSDUrlAddressB_not_found_subreg__exit
call fcn.140005be0
xor eax, eax
jmp 0x140007818
mov word [rsp + 0x5c0], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x5c2]
call fcn.14003ea70
mov ebx, esi
mov word [rsp + 0xb0], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xb2]
call fcn.14003ea70
mov dword [rsp + 0x38], pe_nt_image_headers64
mov dword [rsp + 0x3c], esi
mov r9d, 0x400
lea r8, [rsp + 0x5c0]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140007385
nop
inc ebx
mov rdx, r14
lea rcx, [rsp + 0x5c0]
call fcn.14003e0b4
test rax, rax
je 0x140007304
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x5c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007304
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.14003ea70
mov dword [rsp + 0x38], pe_nt_image_headers64
mov dword [rsp + 0x3c], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.Port
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400072f9
lea rax, [rsp + 0xb0]
mov rdi, r13
sub rdi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400072f5
add rax, 2
test ecx, ecx
jne 0x1400072e2
test edx, edx
je 0x140007328
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x400
lea r8, [rsp + 0x5c0]
mov edx, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140007385
jmp 0x140007230
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xb0]
call fcn.14003ea70
mov dword [rsp + 0x38], pe_nt_image_headers64
mov dword [rsp + 0x3c], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.Location
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140015e30
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400073a4
mov ecx, 0x80004005
call fcn.140003b20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0xb0]
lea rax, [rsp + 0xb0]
test rax, 0xffffffffffff0000
jne 0x1400073fb
movzx edi, cx
mov ecx, edi
call fcn.140016780
test rax, rax
je 0x140007508
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400039d0
mov rbx, qword [rsp + 0x30]
jmp 0x140007508
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140007476
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140007508
cmp dword [rdx + 0x10], eax
jge 0x140007448
cmp dword [rbx - 0xc], eax
jge 0x14000743d
mov ecx, 0x80070057
call fcn.140003b20
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x140007508
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000745f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x140007508
mov ebp, dword [rbx - 0x10]
lea rsi, [rsp + 0xb0]
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400074a9
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003970
mov rbx, qword [rsp + 0x30]
cmp rsi, rbp
ja 0x1400074cd
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + rsi*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rbp
mov rcx, rbx
call fcn.14003dc80
jmp 0x1400074ee
movsxd rax, edi
lea rbp, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.14003d6f0
test edi, edi
js 0x14000780d
cmp edi, dword [rbx - 0xc]
jg 0x14000780d
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [rbx + rbp], ax
mov edx, 0x3a
mov rcx, rbx
call fcn.14003e11c
test rax, rax
je 0x1400075c6
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1400075c6
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140008780
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
cmp ecx, ebx
mov ecx, 0x80070057
call fcn.140003b20
nop