Function at 0x14000e470
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x103d0]
mov eax, 0x104d0
call fcn.140193d30
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x10508], rbx
mov qword [rsp + 0x10510], rsi
mov qword [rsp + 0x10518], rdi
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rbp + 0x103c0], rax
mov r12, rcx
xor r8d, r8d
lea rdx, str.Tool_VDCModuleUninstallCheck
lea rcx, [rbp - 0x80]
call fcn.14000b870
nop
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, str.lpszDriver___s__bDebug___d
lea edx, [r13 + 1]
lea rcx, [rbp - 0x80]
call fcn.14000ba50
call fcn.14004cde4
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14000e516
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x40], r13d
mov r14d, r13d
call fcn.140050920
mov r15, qword [rax + 8]
mov qword [rsp + 0x70], r15
mov rdx, qword [r15 + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
or esi, 0xffffffff
cmp rcx, rdi
je 0x14000e5a4
cmp dword [rdi + 0x10], r13d
jl 0x14000e591
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000e591
call fcn.140001620
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000e586
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x14000e5a4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400014d0
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x3c0]
call fcn.140193010
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x3c0]
call fcn.14018eca0
mov qword [rsp + 0x68], r13
lea r8, [rsp + 0x68]
lea rdx, [0x14021122c]
lea rcx, [rbp + 0x3c0]
call fcn.14018f918
mov rdi, rax
test rax, rax
je 0x14000eaa3
nop word [rax + rax]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000e630
lea r8, [rsp + 0x68]
lea rdx, [0x14021122c]
xor ecx, ecx
call fcn.14018f918
mov rdi, rax
test rax, rax
jne 0x14000e600
jmp 0x14000eaa3
test rdi, rdi
je 0x14000eaa3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [r9 + 2]
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
test eax, eax
jne 0x14000e6b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000e6b4
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x80]
call fcn.14000ba50
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000e6a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x80]
call fcn.14000ba00
xor eax, eax
jmp 0x14000eae2
mov edx, dword [rsp + 0x44]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14000eaa3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9, rdi
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [rdx + 2]
call qword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
cmp eax, 1
jne 0x14000e85c
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000e84f
mov r15d, r13d
lea r12, [rdi + 0x20]
nop dword [rax]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x1a8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x14000e786
cmp dword [rdi + 0x10], 0
jl 0x14000e773
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000e773
call fcn.140001620
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000e768
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x14000e786
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400014d0
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x3c0]
call fcn.140193010
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x3c0]
call fcn.14018eca0
lea r8, [rsp + 0x68]
lea rdx, [0x14021122c]
lea rcx, [rbp + 0x3c0]
call fcn.14018f918
test rax, rax
je 0x14000e7f9
nop dword [rax]
mov rdx, rax
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000e815
lea r8, [rsp + 0x68]
lea rdx, [0x14021122c]
xor ecx, ecx
call fcn.14018f918
test rax, rax
jne 0x14000e7d0
mov r14d, 1
inc r15d
add r12, 0x88
cmp r15d, dword [rsp + 0x40]
jae 0x14000e849
jmp 0x14000e720
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000e839
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x80]
call fcn.14000ba00
xor eax, eax
jmp 0x14000eae2
mov rdi, qword [rbp - 0x70]
jmp 0x14000e857
mov r14d, 1
jmp 0x14000e85c
mov r15, qword [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp r14d, 1
jne 0x14000eaa3
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, str.SOFTWARECanonVDCSETUPVDCUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000e8c3
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000e8b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x80]
call fcn.14000ba00
xor eax, eax
jmp 0x14000eae2
call fcn.14004cde4
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14000e8e3
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rdx, qword [r15 + 0x1b8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x14000e953
cmp dword [rdi + 0x10], 0
jl 0x14000e940
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000e940
call fcn.140001620
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000e935
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x58], rbx
jmp 0x14000e953
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400014d0
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [r15 + 0x1c0]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x14000e9c2
cmp dword [rdi + 0x10], 0
jl 0x14000e9af
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000e9af
call fcn.140001620
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000e9a4
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x58], rbx
jmp 0x14000e9c2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400014d0
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, r13d
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 0x208
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x54]
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14000ea73
inc edi
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 0x208
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x54]
lea r8, [rbp - 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14000ea22
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete r13b
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ea9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov r9d, r13d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.14000ba50
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000ead6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp - 0x80]
call fcn.14000ba00
mov eax, r13d
mov rcx, qword [rbp + 0x103c0]
xor rcx, rsp
call fcn.14018e5d0
lea r11, [rsp + 0x104d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret