Function at 0x14000e7b0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x9d8]
sub rsp, 0xac0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov esi, edx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.Tool_GetMFNPuninstallDirPath
lea rcx, [rsp + 0x30]
call fcn.140017fc0
nop
mov r9d, esi
lea r8, str.dwMaxLength___d
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.140017c80
call fcn.140054cb8
mov rbx, qword [rax + 8]
xor r12d, r12d
mov word [rbp + 0x380], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x382]
call fcn.140192cb0
mov word [rbp + 0x590], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x592]
call fcn.140192cb0
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.140192cb0
mov word [rbp + 0x7a0], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x7a2]
call fcn.140192cb0
test rbx, rbx
je 0x14000ec37
test rdi, rdi
je 0x14000ec37
test esi, esi
je 0x14000ec37
mov r8d, esi
add r8, r8
xor edx, edx
mov rcx, rdi
call fcn.140192cb0
mov r9d, 0x104
lea r8, [rbp + 0x7a0]
lea rdx, [0x1401c6ea8]
mov rcx, rbx
call fcn.140031ac0
mov r8d, 0x104
lea rdx, [rbp + 0x7a0]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, str.Uninst.ini
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea rcx, [0x1401c7444]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
cmp eax, 0x104
jae 0x14000ec1c
lea rcx, [rbp + 0x380]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.Uninst.ini
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rbp + 0x380]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x590]
lea r8, str.item_not_found__
lea rdx, str.PDL_NAME
lea rcx, str.Profiles
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.item_not_found__
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14000e9b6
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
mov qword [rsp + 0x40], r12
mov word [rbp + 0x170], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x172]
call fcn.140192cb0
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x48], 0x104
mov r8d, 0x104
lea rdx, str.SOFTWARECanonPrnUninst
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [0x1401c7444]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
cmp eax, 0x104
jae 0x14000ec01
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x170]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000eaa3
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000eb08
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000eaea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
lea rcx, str.PMON
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea rcx, [0x1401c7444]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
lea rcx, [0x1401c7444]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
cmp eax, 0x104
jae 0x14000ebd1
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.PMON
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8d, esi
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000eb9b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 1
mov r9, rdi
lea r8, str.lpMFNPuninstPath___s__return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
lea rcx, [rsp + 0x30]
call fcn.140018150
mov eax, 1
jmp 0x14000ec5c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000ebe6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
jmp 0x14000ec50
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
lea rcx, [rsp + 0x30]
call fcn.140018150
xor eax, eax
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.1401945b0
lea r11, [rsp + 0xac0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret