Function at 0x1401584a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r15, rdx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
lea rdx, str.CBaseOSSpec::SetNetworkPrinterToDefault
lea rcx, [rsp + 0x60]
call fcn.14001abe0
nop
lea rsi, [0x1402a8360]
lea rdi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140158578
test byte [rcx + 0x1c], 1
je 0x140158540
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rbx + 0x16]
lea r8, [0x1402646c0]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140158578
test byte [rcx + 0x1c], 1
je 0x140158578
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_socket
mov qword [rsp + 0x20], r15
lea r8, [0x1402646c0]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x50]
call fcn.1401e7e40
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140158aa6
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r12, 0xffffffffffffffff
test r15, r15
je 0x1401585ed
cmp r15, 0x10000
jae 0x1401585d5
movzx edx, r15w
lea rcx, [rsp + 0x30]
call fcn.1400041d0
jmp 0x140158600
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x1401585e0
jmp 0x1401585ef
mov eax, ebx
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140004e60
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionDevices
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x140158937
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x48], 0x410
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14015892c
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140158693
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x1401586b7
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x140158ab1
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 1
lea rax, [0x1402572d4]
mov rsi, r12
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401586e0
movsxd r13, dword [rbx - 0x10]
lea r14d, [rsi + r13]
test r14d, r14d
js 0x140158a9b
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140158727
lfence
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140004e00
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add r13, r13
je 0x140158751
test rdi, rdi
jne 0x140158743
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140158751
mov r8, r13
mov rdx, rbx
mov rcx, rdi
call fcn.1401e7770
movsxd r8, esi
add r8, r8
lea rcx, [rdi + r13]
je 0x140158780
test rcx, rcx
jne 0x140158774
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140158780
lea rdx, [0x1402572d4]
call fcn.1401e7770
cmp r14d, dword [rdi - 0xc]
jg 0x140158a9b
mov dword [rdi - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x1401587b5
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x1401587d9
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x140158abc
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x38], 3
lea rax, [rbp - 0x50]
mov rsi, r12
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140158800
movsxd r13, dword [rdi - 0x10]
lea r14d, [rsi + r13]
test r14d, r14d
js 0x140158a90
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140158847
lfence
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.140004e00
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add r13, r13
je 0x140158871
test rbx, rbx
jne 0x140158863
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140158871
mov r8, r13
mov rdx, rdi
mov rcx, rbx
call fcn.1401e7770
movsxd r8, esi
add r8, r8
lea rcx, [rbx + r13]
je 0x14015889d
test rcx, rcx
jne 0x140158894
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x14015889d
lea rdx, [rbp - 0x50]
call fcn.1401e7770
cmp r14d, dword [rbx - 0xc]
jg 0x140158a90
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140004620
mov dword [rsp + 0x38], 1
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401588f0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140158919
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rsp + 0x30]
lea rdi, [0x1402bbdb0]
lea rsi, [0x1402a8360]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140158976
test byte [rcx + 0x1c], 4
je 0x140158976
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x18
mov qword [rsp + 0x20], rbx
lea r8, [0x1402646c0]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [rsp + 0x68], 1
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1401589c7
test byte [rcx + 0x1c], 1
je 0x1401589c7
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x19
mov qword [rsp + 0x20], r15
lea r8, [0x1402646c0]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x1401589eb
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x68], 0
jne 0x140158a4d
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140158a4d
test byte [rcx + 0x1c], 1
je 0x140158a4d
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rax, qword [rsp + 0x70]
cmp qword [0x1402bbdc8], 8
cmovae rdi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x70]
call fcn.1400048a0
lea rcx, [rsp + 0x70]
call fcn.1400048a0
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3