Function at 0x140006af0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r15, r8
xor ebp, ebp
mov qword [rax - 0x50], rbp
mov r12d, 1
mov dword [rax - 0x68], r12d
mov dword [rax + 0x20], ebp
call fcn.1400696cc
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140006b4c
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rbx, [0x1400a4120]
mov r14, rbx
or r13, 0xffffffffffffffff
shr r14, 0x10
jne 0x140006b90
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140006bb0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003a40
jmp 0x140006bb0
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003c40
nop
call fcn.1400696cc
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140006bcf
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x40], rsi
test r14, r14
jne 0x140006c09
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140006c2d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003a40
mov rsi, qword [rsp + 0x40]
jmp 0x140006c2d
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140003c40
mov rsi, qword [rsp + 0x40]
call fcn.1400696cc
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140006c4c
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
test r14, r14
jne 0x140006c8d
lea rdx, [0x1400a4120]
movzx edi, dx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140006cb5
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003a40
mov rbx, qword [rsp + 0x38]
jmp 0x140006cb5
xor eax, eax
mov rcx, r13
lea rdx, [0x1400a4120]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003c40
mov rbx, qword [rsp + 0x38]
mov r9, r15
mov r8, qword [rsp + 0xa8]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x50]
call fcn.1400040b0
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006ee0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006ed3
mov ecx, r12d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
mov edx, dword [rsp + 0xb8]
sub eax, edx
or ecx, eax
jge 0x140006d57
lea rcx, [rsp + 0x40]
call fcn.140003180
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006ed3
test rsi, rsi
jne 0x140006d94
mov ecx, ebp
jmp 0x140006dae
xor eax, eax
mov rcx, r13
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140006ec8
cmp ecx, dword [rsi - 0xc]
jg 0x140006ec8
mov dword [rsi - 0x10], ecx
movsxd rax, ecx
mov word [rsi + rax*2], 0
lea rdx, str.Canon_CNAP2
mov rcx, rsi
call fcn.1400804d0
test rax, rax
je 0x140006ed3
mov r8, rsi
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xa0]
call fcn.140006130
xor eax, eax
mov rcx, r13
mov rbx, qword [rsp + 0x38]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140006e26
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140003180
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e88
test rbx, rbx
je 0x140006e6a
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov ebp, ecx
test ecx, ecx
js 0x140006e7d
cmp ebp, dword [rbx - 0xc]
jg 0x140006e7d
mov dword [rbx - 0x10], ebp
movsxd rax, ebp
mov word [rbx + rax*2], 0
jmp 0x140006ed3
mov ecx, 0x80070057
call fcn.140001000
int3
test rbx, rbx
jne 0x140006e91
mov ecx, ebp
jmp 0x140006ea7
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140006ebd
cmp ecx, dword [rbx - 0xc]
jg 0x140006ebd
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov r12d, ebp
jmp 0x140006ed3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006eed
cmp eax, 2
je 0x140006eed
cmp eax, 3
je 0x140006eed
mov r12d, ebp
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140006f0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140006f2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x140006f4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret