Function at 0x140008090
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r15, r8
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x60], rcx
lea rdx, str.OperateReg::DeleteRegAppointPrinter
lea rcx, [rbp - 0x50]
call fcn.14001abe0
nop
lea rbx, [0x1402a8360]
lea r13, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x140008165
test byte [rcx + 0x1c], 1
je 0x14000812d
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0xa
lea r8, [0x140251f68]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x140008165
test byte [rcx + 0x1c], 1
je 0x140008165
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, VariantTimeToDosDateTime
mov qword [rsp + 0x20], r15
lea r8, [0x140251f68]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rax, vtable.CMap_class_ATL::CStringT_unsigned_short_int__class_StrTraitMFC_unsigned_short_int__class_ATL::ChTraitsCRT_unsigned_short_int_____unsigned_short_int_const____ptr64__unsigned_char____ptr64__unsigned_char____ptr64_.0
mov qword [rsp + 0x58], rax
xor esi, esi
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], reloc.COMCTL32.dll_InitCommonControls
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14026f400]
movdqa xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lfence
lea ecx, [rsi + 0x48]
call fcn.1401baa78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x50], rsi
test r12, r12
je 0x1400084e8
test r15, r15
je 0x1400084e8
mov rcx, qword [rsp + 0x70]
mov rax, rcx
neg rax
sbb rdi, rdi
test rcx, rcx
je 0x140008333
nop dword [rax]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400085d9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r9, qword [rsp + 0x60]
test r9, r9
je 0x1400085e4
mov rsi, rdi
test rdi, rdi
je 0x1400085e4
mov r8d, dword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
jne 0x14000825c
xor ecx, ecx
test r8d, r8d
je 0x14000825c
mov rsi, qword [r9 + rcx*8]
test rsi, rsi
jne 0x14000825c
inc ecx
cmp ecx, r8d
jb 0x140008243
test rsi, rsi
je 0x1400085e4
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x140008284
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x140008284
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x140008284
inc edx
cmp edx, r8d
jb 0x140008274
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r14, [rbx - 0x18]
cmp rcx, r14
je 0x1400082ef
cmp dword [r14 + 0x10], 0
jl 0x1400082dc
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x1400082dc
call fcn.140004d00
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x1400082d1
lfence
mov rcx, qword [r14]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
mov rdx, r14
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x40], rbx
jmp 0x1400082ef
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140004e60
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400082fe
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008324
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
jne 0x1400081f0
mov r14, qword [rbp - 0x60]
xor esi, esi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400083ab
mov edi, esi
mov edx, dword [rsp + 0x68]
test edx, edx
je 0x1400083a1
nop word [rax + rax]
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x14000839b
nop dword [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008389
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008360
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
inc edi
cmp edi, edx
jb 0x140008350
call fcn.1400079c0
mov qword [rsp + 0x60], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov rcx, qword [rbp - 0x80]
call fcn.1401bc020
mov qword [rbp - 0x80], rsi
mov rbx, qword [rbp - 0x70]
mov r8, qword [rbx + 8]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp - 0x68], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400084e8
xor r12d, r12d
mov edi, r12d
lea r15d, [rax + 1]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp]
call fcn.1401e7e40
mov esi, r12d
mov dword [rsp + 0x48], 0x410
mov ebx, r12d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400084d6
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x48]
lea r8, [rbp]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140008484
cmp eax, 0x103
cmove esi, r15d
mov ebx, 0x80010080
inc edi
test ebx, ebx
jne 0x1400084cd
lea r8, [rbp]
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call fcn.140008090
mov esi, eax
test eax, eax
je 0x1400084e8
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400084c0
lea rdx, [rbp]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
je 0x1400084c8
cmp eax, 2
je 0x1400084c8
mov esi, r12d
mov ebx, 0x103
mov edi, r12d
jmp 0x1400084e0
test esi, esi
je 0x1400084dd
mov esi, r15d
jmp 0x1400084e0
mov ebx, 0x80010001
inc edi
mov esi, r12d
test ebx, ebx
je 0x140008420
mov byte [rbp - 0x48], 1
mov rcx, qword [0x1402a8360]
lea rbx, [0x1402a8360]
cmp rcx, rbx
je 0x140008532
test byte [rcx + 0x1c], 1
je 0x140008532
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov dword [rsp + 0x20], esi
lea r8, [0x140251f68]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
lea rcx, [rsp + 0x50]
call fcn.140007a90
nop
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x50], rax
cmp byte [rbp - 0x48], 0
jne 0x14000859b
mov rcx, qword [0x1402a8360]
cmp rcx, rbx
je 0x14000859b
test byte [rcx + 0x1c], 1
je 0x14000859b
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x20]
call fcn.1400048a0
lea rcx, [rbp - 0x40]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1401e2900
mov rbx, qword [rsp + 0x578]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
int3