Function at 0x1400323c0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r15
sub rsp, 0x230
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x200], rax
xor eax, eax
xor edi, edi
test rcx, rcx
mov r15d, edi
mov qword [r11 - 0x108], rax
mov qword [r11 - 0x100], rax
mov qword [r11 - 0xf8], rax
mov qword [r11 - 0xf0], rax
mov qword [r11 - 0xe8], rax
mov qword [r11 - 0xe0], rax
mov qword [r11 - 0xd8], rax
mov qword [r11 - 0xd0], rax
mov qword [r11 - 0x188], rax
mov qword [r11 - 0x180], rax
mov qword [r11 - 0x178], rax
mov qword [r11 - 0x170], rax
mov qword [r11 - 0x168], rax
mov qword [r11 - 0x160], rax
mov qword [r11 - 0x158], rax
mov qword [r11 - 0x150], rax
mov qword [r11 - 0xc8], rax
mov qword [r11 - 0xc0], rax
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xb0], rax
mov qword [r11 - 0xa8], rax
mov qword [r11 - 0xa0], rax
mov qword [r11 - 0x98], rax
mov qword [r11 - 0x90], rax
mov qword [r11 - 0x148], rax
mov qword [r11 - 0x140], rax
mov qword [r11 - 0x138], rax
mov qword [r11 - 0x130], rax
mov qword [r11 - 0x128], rax
mov qword [r11 - 0x120], rax
mov qword [r11 - 0x118], rax
mov qword [r11 - 0x110], rax
mov qword [r11 - 0x1c8], rax
mov qword [r11 - 0x1c0], rax
mov qword [r11 - 0x1b8], rax
mov qword [r11 - 0x1b0], rax
mov qword [r11 - 0x1a8], rax
mov qword [r11 - 0x1a0], rax
mov qword [r11 - 0x198], rax
mov qword [r11 - 0x190], rax
mov qword [r11 - 0x88], rax
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov rsi, rcx
je 0x140032b19
test rdx, rdx
je 0x140032b19
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140032562
xor eax, eax
jmp 0x140032b19
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x140]
xor edx, edx
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov dword [rsp + 0x40], 0x20
mov r14d, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140032af9
mov qword [rsp + 0x228], rbp
mov qword [rsp + 0x220], r12
mov qword [rsp + 0x218], r13
nop
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x140]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140032a9e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1c0]
lea rdx, str.ManufacturerTag
xor r8d, r8d
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140032a5d
lea rdx, str.Canon_Inc.
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140032a5d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xc0]
xor edx, edx
mov qword [rsp + 0x28], rdi
lea r15d, [rax + 1]
mov dword [rsp + 0x40], 0x20
mov r13d, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140032a5d
nop
nop
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xc0]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400329ea
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.14002ae00
test eax, eax
mov ebx, eax
jne 0x1400329d8
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x180]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov r12d, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400329d8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x180]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140032965
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x100]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov ebp, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140032953
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x100]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400328e1
mov rcx, qword [rsp + 0x68]
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x20
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400328cf
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x78]
lea rdx, [rsp + 0x80]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003285b
mov rcx, qword [rsp + 0x78]
mov rdx, rsi
call fcn.14002ae00
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
je 0x1400328a5
cmp ebx, r15d
jae 0x1400328cf
mov rcx, qword [rsp + 0x68]
xor eax, eax
add edi, r15d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x20
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140032812
jmp 0x1400328cf
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x80]
call fcn.1400223e0
cmp eax, r15d
jne 0x1400328cf
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
je 0x140032929
xor edi, edi
cmp ebx, r15d
jae 0x140032953
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
add ebp, r15d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov edx, ebp
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400327a4
jmp 0x140032953
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x100]
call fcn.1400223e0
cmp eax, r15d
jne 0x140032953
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
je 0x1400329ae
xor edi, edi
cmp ebx, r15d
jae 0x1400329d8
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
add r12d, r15d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x180]
mov edx, r12d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140032736
jmp 0x1400329d8
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x180]
call fcn.1400223e0
cmp eax, r15d
jne 0x1400329d8
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
je 0x140032a33
xor edi, edi
cmp ebx, r15d
jae 0x140032a5d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
add r13d, r15d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xc0]
mov edx, r13d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400326b0
jmp 0x140032a5d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xc0]
call fcn.1400223e0
cmp eax, r15d
jne 0x140032a5d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
jne 0x140032a97
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x140]
call fcn.1400223e0
cmp eax, 1
jne 0x140032a97
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x140]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test r15d, r15d
jne 0x140032ae1
xor edi, edi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
add r14d, 1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x140]
mov edx, r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400325d0
mov r12, qword [rsp + 0x220]
mov rbp, qword [rsp + 0x228]
mov r13, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x260]
mov eax, 1
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140081050
add rsp, 0x230
pop r15
pop rdi
pop rsi
ret