Function at 0x140039d40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x330
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rdi, rdx
mov qword [r11 - 0x268], rdx
lea r8, str.CScannerUninstaller::RemoveRegistryScanSettings____r_n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
mov esi, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0xc0], rsi
xor r12d, r12d
mov qword [rsp + 0xb8], r12
mov byte [rsp + 0xa8], r12b
lea rcx, str.SoftwareHewlett_PackardDigitalImagingCUE_Settings
call fcn.1400980d0
mov r8, rax
lea rdx, str.SoftwareHewlett_PackardDigitalImagingCUE_Settings
lea rcx, [rsp + 0xa0]
call fcn.14000352c
nop
mov qword [rsp + 0x68], r12
mov ebx, r12d
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x60], r12d
mov byte [rsp + 0x100], r12b
mov r14d, 0x103
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x101]
call fcn.1400988d0
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x90], r12
mov byte [rsp + 0x80], r12b
lea r15, [0x1400c49dc]
mov rcx, r15
call fcn.1400980d0
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.14000352c
nop
mov byte [rsp + 0x210], r12b
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x211]
call fcn.1400988d0
mov ebp, r12d
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xe0], r12
mov byte [rsp + 0xd0], r12b
mov rcx, r15
call fcn.1400980d0
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0xc8]
call fcn.14000352c
nop
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae rdx, qword [rsp + 0xa8]
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call fcn.14004e070
cmp eax, r12d
jne 0x14003a061
mov r9d, r14d
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
jne 0x140039fd4
cmp qword [rdi + 0x20], 0x10
jb 0x140039f0b
mov rdx, qword [rdi + 8]
jmp 0x140039f0f
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x100]
call fcn.140099250
cmp rax, r12
je 0x140039fb1
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.140002458
lea rcx, [0x1400c55c0]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c55c0]
lea rcx, [rsp + 0x78]
call fcn.14000627c
lea rcx, [rsp + 0x100]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x78]
call fcn.14000627c
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp eax, r12d
jne 0x140039fb1
mov ebx, r12d
jmp 0x140039fb3
inc ebx
mov r9d, r14d
lea r8, [rsp + 0x100]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
je 0x140039efe
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
call fcn.14004e608
cmp dword [rsp + 0x64], r12d
jne 0x14003a061
cmp dword [rsp + 0x60], r12d
jne 0x14003a061
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae rdx, qword [rsp + 0xa8]
mov rcx, 0xffffffff80000001
call fcn.14004da30
mov rcx, r15
call fcn.1400980d0
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.14000352c
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x60], r12d
mov r9d, r14d
lea r8, [rsp + 0x210]
xor edx, edx
mov r15, 0xffffffff80000003
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
jne 0x14003a30e
lea rcx, [rsp + 0x210]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0xc8]
call fcn.14000352c
lea rcx, [0x1400c55c0]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c55c0]
lea rcx, [rsp + 0xc8]
call fcn.14000627c
lea rbx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae rbx, qword [rsp + 0xa8]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.14000627c
mov qword [rsp + 0x68], r12
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r15
call fcn.14004e070
cmp eax, r12d
jne 0x14003a2ed
mov ebx, r12d
mov r9d, r14d
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
jne 0x14003a264
cmp qword [rdi + 0x20], 0x10
jb 0x14003a19f
mov rdx, qword [rdi + 8]
jmp 0x14003a1a3
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x100]
call fcn.140099250
cmp rax, r12
je 0x14003a241
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x78]
call fcn.140002458
lea rcx, [0x1400c55c0]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c55c0]
lea rcx, [rsp + 0x78]
call fcn.14000627c
lea rcx, [rsp + 0x100]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x78]
call fcn.14000627c
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp eax, r12d
jne 0x14003a241
mov ebx, r12d
jmp 0x14003a243
inc ebx
mov r9d, r14d
lea r8, [rsp + 0x100]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
je 0x14003a192
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x68]
call fcn.14004e608
cmp dword [rsp + 0x64], r12d
jne 0x14003a2ed
cmp dword [rsp + 0x60], r12d
jne 0x14003a2ed
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
mov rcx, r15
call fcn.14004da30
inc ebp
mov r9d, r14d
lea r8, [rsp + 0x210]
mov edx, ebp
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, r12d
je 0x14003a0a9
lea r8, str.CScannerUninstaller::RemoveRegistryScanSettings____r_n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
cmp qword [rsp + 0xe8], 0x10
jb 0x14003a33f
mov rcx, qword [rsp + 0xd0]
call fcn.14006127c
mov ebx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], r12
mov byte [rsp + 0xd0], r12b
cmp qword [rsp + 0x98], 0x10
jb 0x14003a374
mov rcx, qword [rsp + 0x80]
call fcn.14006127c
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], r12
mov byte [rsp + 0x80], r12b
cmp qword [rsp + 0xc0], 0x10
jb 0x14003a3a4
mov rcx, qword [rsp + 0xa8]
call fcn.14006127c
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r12
mov byte [rsp + 0xa8], r12b
cmp qword [rdi + 0x20], 0x10
jb 0x14003a3cc
mov rcx, qword [rdi + 8]
call fcn.14006127c
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x18], r12
mov byte [rdi + 8], r12b
mov eax, 1
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret