Function at 0x1400045b0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd8
mov rax, qword [0x1400c87d8]
xor rax, rsp
mov qword [rbp - 9], rax
mov r12, qword [rbp + 0x77]
lea rax, [0x1400c9f10]
xor r13d, r13d
mov qword [rbp - 0x31], rdx
mov dword [rbp - 0x61], r8d
mov r15, r9
mov qword [rbp - 0x59], r13
mov esi, r13d
mov dword [rbp - 0x29], 0x20676572
mov r14d, r13d
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x11], 0x80004005
test rcx, rcx
jne 0x140012374
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r14d, 1
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rsi, rax
test rax, rax
je 0x140012383
mov edi, r13d
test edi, edi
js 0x140004841
mov rcx, qword [rbp - 0x19]
test rcx, rcx
jne 0x14001238f
mov ecx, 0x7e
call fcn.14000df2c
mov rbx, rax
test rax, rax
je 0x1400123cb
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionPrintConnections
mov edx, 0x3f
sub r8, rax
mov edi, r13d
lea rcx, [rdx + 0x7fffffbf]
test rcx, rcx
je 0x1400046b4
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400046ab
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140004683
jmp 0x1400123a1
test rdx, rdx
je 0x1400123a1
mov word [rax], r13w
lea rax, [0x1400c9f10]
mov rcx, qword [rbp - 0x21]
cmp rcx, rax
jne 0x1400123b0
mov qword [rbp - 0x21], rbx
mov rbx, r13
mov rcx, rbx
call fcn.14000df6c
mov dword [rbp - 0x11], edi
test edi, edi
js 0x140004841
mov rdx, qword [rbp - 0x21]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x19]
mov dword [rbp - 0x69], r13d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jg 0x1400123d5
mov dword [rbp - 0x11], eax
test edi, edi
js 0x140004841
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov dword [rbp - 0x39], edi
mov qword [rbp - 0x51], rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400123f0
mov ecx, dword [rbp - 0x3d]
mov eax, 2
inc ecx
mov edx, ecx
mul rdx
mov dword [rbp - 0x3d], ecx
lea rdx, [0x1400c9ef8]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000f4d8
mov qword [rbp - 0x49], rax
mov r8, rax
test rax, rax
je 0x1400123e6
mov ecx, ebx
call fcn.140006a40
mov dword [rbp - 0x39], eax
mov edi, eax
test eax, eax
js 0x1400123f9
mov eax, dword [rbp - 0x3d]
lea r9, [rbp - 0x69]
mov rcx, qword [rbp - 0x51]
xor edx, edx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x69], eax
mov dword [rbp - 0x41], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ecx, eax
call fcn.140006a40
mov dword [rbp - 0x39], eax
mov ebx, 0x80000000
test eax, eax
jns 0x14001240b
mov rcx, qword [rbp - 0x49]
call fcn.14000f4cc
test r14d, r14d
je 0x140004859
lea rcx, [0x1400c9ea8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ebx, r13d
test rsi, rsi
je 0x1400048ef
mov qword [rbp - 0x59], rsi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 4
lea r8, [rbp - 0x61]
mov ebx, eax
mov rcx, rsi
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov ecx, ebx
test eax, eax
jne 0x140012463
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r9d, 8
lea r8, [rbp - 0x59]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
nop dword [rax + rax]
test eax, eax
js 0x14001247f
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ebx, r13d
test edi, edi
js 0x1400124eb
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140004910
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x19], r13
mov rcx, qword [rbp - 0x21]
lea rax, [0x1400c9f10]
cmp rcx, rax
je 0x140004931
lea rax, [0x1400c9f12]
cmp rcx, rax
je 0x140004931
call fcn.14000df6c
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000e2c0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007667c
test eax, eax
mov edi, 0x8007007b
cmovne edi, r13d
test edi, edi
jns 0x140004619
jmp 0x140004841
lea rax, [0x1400c9f10]
cmp rbx, rax
je 0x1400046db
lea rax, [0x1400c9f12]
cmp rbx, rax
jne 0x1400046d3
jmp 0x1400046db
cmp word [rcx], r13w
je 0x140004619
jmp 0x140004954
call fcn.140032c58
mov edi, eax
jmp 0x140004646
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000465b
mov word [rax - 2], r13w
mov edi, 0x8007007a
jmp 0x140004971
lea rax, [0x1400c9f12]
cmp rcx, rax
je 0x1400046cc
call fcn.14000df6c
nop
jmp 0x1400046cc
mov edi, 0x8007000e
jmp 0x140004971
movzx edi, ax
or edi, 0x80070000
mov dword [rbp - 0x11], edi
jmp 0x140004738
mov ebx, 0xe
jmp 0x1400047d9
mov r8, qword [rbp - 0x49]
jmp 0x1400047d9
cmp ax, 0x103
jne 0x1400047ed
mov edi, r13d
jmp 0x1400047ed
lea eax, [rdi + rbx]
test ebx, eax
jne 0x14001241e
cmp edi, 0x8007007a
jne 0x140004838
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.14008205c
mov edi, eax
test eax, eax
js 0x140012452
mov rdx, qword [rbp - 0x59]
lea r9, [rbp - 0x61]
mov rcx, qword [rbp - 0x19]
lea r8, [rbp - 0x31]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.140073fd0
mov edi, eax
lea rcx, [rbp - 0x51]
call fcn.140082704
mov eax, dword [rbp - 0x39]
jmp 0x140004830
cmp dword [rbp - 0x61], 2
je 0x1400048a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x1400048dc
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400c82a8]
lea rcx, [0x1400c82a8]
cmp rax, rcx
je 0x1400124df
test byte [rax + 0x44], 0x20
je 0x1400124df
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c82a8]
lea r8, [0x1400ab970]
mov edx, 0x14
mov r9d, eax
mov rcx, qword [rcx + 0x38]
call fcn.140016c88
call fcn.140032c58
mov ebx, eax
jmp 0x1400048ef
mov ebx, edi
jmp 0x1400048f7