Function at 0x140014020
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp + 0x37], 7
xor esi, esi
mov qword [rbp + 0x2f], rsi
mov word [rbp + 0x1f], si
lea rdx, [rbp + 0x1f]
call fcn.1400144a0
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.14000b2e0
nop
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], rsi
mov word [rbp - 0x31], si
lea r8d, [rsi + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea rcx, [rbp - 0x31]
call fcn.14000b2e0
mov qword [rbp - 0x71], rsi
mov dword [rbp - 0x69], esi
mov byte [rbp - 0x61], sil
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rdx, qword [rbp - 0x31]
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp - 0x65], eax
mov rcx, qword [rbp - 0x71]
test eax, eax
cmovne rcx, rsi
mov qword [rbp - 0x71], rcx
cmp qword [rbp - 0x19], 8
jb 0x140014156
mov rax, qword [rbp - 0x31]
mov qword [rbp - 0x41], rax
test rax, rax
je 0x140014156
mov rdi, qword [0x140044d10]
test rdi, rdi
jne 0x14001414a
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
jne 0x14001414a
mov rcx, qword [rbp - 0x71]
jmp 0x14001415d
xor edx, edx
lea rcx, [rbp - 0x41]
call rdi
mov rcx, qword [rbp - 0x71]
mov rdi, qword [0x140044d10]
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], rsi
mov word [rbp - 0x31], si
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
test rcx, rcx
je 0x1400141bb
mov dword [rbp - 0x75], 8
mov dword [rbp - 0x79], 0xb
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x65], eax
mov rcx, qword [rbp - 0x71]
mov rdi, qword [0x140044d10]
mov rbx, qword [rbp - 0x59]
test rcx, rcx
je 0x1400141d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x65], eax
mov rdi, qword [0x140044d10]
cmp qword [rbp + 0xf], 8
jb 0x140014210
mov rax, qword [rbp - 9]
mov qword [rbp - 0x49], rax
test rax, rax
je 0x140014210
test rdi, rdi
jne 0x140014201
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x140014210
xor edx, edx
lea rcx, [rbp - 0x49]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
cmp qword [rbp + 0x37], 8
jb 0x140014255
mov rcx, qword [rbp + 0x1f]
mov qword [rbp - 0x51], rcx
test rcx, rcx
je 0x140014255
test rdi, rdi
jne 0x14001424d
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x140014255
xor edx, edx
lea rcx, [rbp - 0x51]
call rdi
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret