Function at 0x140017f40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x107e0]
mov eax, 0x108e0
call fcn.14019e810
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x10918], rbx
mov qword [rsp + 0x10920], rsi
mov qword [rsp + 0x10928], rdi
mov rax, qword [0x14026fdb0]
xor rax, rsp
mov qword [rbp + 0x107d0], rax
mov r12, rcx
xor r8d, r8d
lea rdx, str.Tool_VDCModuleUninstallCheck
lea rcx, [rsp + 0x78]
call fcn.140001190
nop
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, str.lpszDriver___s__bDebug___d
lea edx, [r13 + 1]
lea rcx, [rsp + 0x78]
call fcn.140001370
mov qword [rsp + 0x58], r13
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x7d0]
call fcn.14019d7c0
call fcn.140056384
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x140018001
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x3c0]
call fcn.14019d7c0
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x48], r13d
mov r14d, r13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1b0]
call fcn.14019d7c0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.14019d7c0
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x4c], r13d
call fcn.140059f20
mov r15, qword [rax + 8]
mov qword [rbp - 0x78], r15
mov rdx, qword [r15 + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
or esi, 0xffffffff
cmp rcx, rdi
je 0x1400180d6
cmp dword [rdi + 0x10], r13d
jl 0x1400180c3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400180c3
call fcn.140006db0
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400180b8
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x50], rbx
jmp 0x1400180d6
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400059f0
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x7d0]
call fcn.14019d7c0
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x7d0]
call fcn.140198d60
mov qword [rsp + 0x70], r13
lea r8, [rsp + 0x70]
lea rdx, [0x14021d23c]
lea rcx, [rbp + 0x7d0]
call fcn.14019a1c0
mov rdi, rax
test rax, rax
je 0x1400185d4
nop dword [rax]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140018160
lea r8, [rsp + 0x70]
lea rdx, [0x14021d23c]
xor ecx, ecx
call fcn.14019a1c0
mov rdi, rax
test rax, rax
jne 0x140018130
jmp 0x1400185d4
test rdi, rdi
je 0x1400185d4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [r9 + 2]
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
test eax, eax
jne 0x1400181e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400181e6
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x78]
call fcn.140001370
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400181d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x78]
call fcn.140001320
xor eax, eax
jmp 0x140018615
mov edx, dword [rsp + 0x44]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400185d4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9, rdi
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [rdx + 2]
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
cmp eax, 1
jne 0x14001838c
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140018380
mov r15d, r13d
lea r12, [rdi + 0x20]
nop
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400182b5
cmp dword [rdi + 0x10], 0
jl 0x1400182a2
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400182a2
call fcn.140006db0
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140018297
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x50], rbx
jmp 0x1400182b5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400059f0
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x7d0]
call fcn.14019d7c0
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x7d0]
call fcn.140198d60
lea r8, [rsp + 0x70]
lea rdx, [0x14021d23c]
lea rcx, [rbp + 0x7d0]
call fcn.14019a1c0
test rax, rax
je 0x140018329
nop dword [rax]
mov rdx, rax
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140018345
lea r8, [rsp + 0x70]
lea rdx, [0x14021d23c]
xor ecx, ecx
call fcn.14019a1c0
test rax, rax
jne 0x140018300
mov r14d, 1
inc r15d
add r12, 0x88
cmp r15d, dword [rsp + 0x48]
jae 0x14001837a
jmp 0x140018250
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140018369
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x78]
call fcn.140001320
xor eax, eax
jmp 0x140018615
mov rdi, qword [rbp - 0x70]
jmp 0x140018388
mov r14d, 1
jmp 0x14001838c
mov r15, qword [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp r14d, 1
jne 0x1400185d4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, str.SOFTWARECanonVDCSETUPVDCUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400183f4
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400183e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x78]
call fcn.140001320
xor eax, eax
jmp 0x140018615
call fcn.140056384
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x140018414
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov rdx, qword [r15 + 0x1b8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140018484
cmp dword [rdi + 0x10], 0
jl 0x140018471
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140018471
call fcn.140006db0
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140018466
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
jmp 0x140018484
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400059f0
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [r15 + 0x1c0]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400184f3
cmp dword [rdi + 0x10], 0
jl 0x1400184e0
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400184e0
call fcn.140006db0
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400184d5
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
jmp 0x1400184f3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400059f0
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, r13d
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x4c], 0x208
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1b0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400185a4
inc edi
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x4c], 0x208
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1b0]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140018553
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete r13b
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400185cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
mov r9d, r13d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x78]
call fcn.140001370
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140018608
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x78]
call fcn.140001320
mov eax, r13d
mov rcx, qword [rbp + 0x107d0]
xor rcx, rsp
call fcn.140198b40
lea r11, [rsp + 0x108e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret