Function at 0x14008e2e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1be8]
mov eax, 0x1ce8
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1bd0], rax
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov r13, rcx
lea rdx, str.InstallVitualChannel::VCSetIniFile
lea rcx, [rsp + 0x60]
call fcn.14001abe0
nop
lea r15, [0x1402a8360]
lea rsi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x14008e3c2
test byte [rcx + 0x1c], 1
je 0x14008e380
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x3f
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x14008e3c2
test byte [rcx + 0x1c], 1
je 0x14008e3c2
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x40
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.14001d060
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x5c], 1
mov dword [rsp + 0x58], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.1401e7e40
mov rdx, rbx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140251df8]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008ea26
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.MsiInstallDir
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e547
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x14008e4e4
test byte [rcx + 0x1c], 4
je 0x14008e4e4
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [r14 + 0x41]
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x68], 1
mov rax, qword [0x1402a8360]
cmp rax, r15
je 0x14008eab4
test byte [rax + 0x1c], 1
je 0x14008eab4
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x42
mov dword [rsp + 0x20], r14d
lea r8, [0x140258f30]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
mov rax, qword [0x1402a8360]
jmp 0x14008eab4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Module.ini
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14008eb53
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdi, [0x140251dfc]
mov r15, 0xffffffffffffffff
cmp rdi, 0x10000
jae 0x14008e5b0
movzx edx, di
lea rcx, [rsp + 0x40]
call fcn.1400041d0
jmp 0x14008e5cd
mov rax, r15
inc rax
cmp word [rdi + rax*2], 0
jne 0x14008e5b3
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004e60
movzx ebx, di
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14008eb48
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
cmp rdi, 0x10000
jae 0x14008e60f
movzx edx, bx
lea rcx, [rsp + 0x50]
call fcn.1400041d0
jmp 0x14008e62d
mov rax, r15
inc rax
cmp word [rdi + rax*2], 0
jne 0x14008e612
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xbd0]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0xbd0]
lea rdx, str.MODULENAME_PREFIX
mov rcx, r9
call qword [case.0x1400136d6.0]
lea r8, [rbp + 0xbd0]
lea rdx, str.Canon__s_ERROR
lea rcx, [rsp + 0x50]
call fcn.140018e20
lea r8, [rbp + 0xbd0]
lea rdx, str.Canon__s
lea rcx, [rsp + 0x40]
call fcn.140018e20
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rbp + 0x3d0]
mov rdi, qword [rsp + 0x50]
mov r8, rdi
lea rdx, str.VirtualDriver
lea rcx, str.ICA_3.0
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rdx, rdi
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14008e775
mov rcx, qword [0x1402a8360]
lea r12, [0x1402a8360]
cmp rcx, r12
je 0x14008e753
test byte [rcx + 0x1c], 2
je 0x14008e753
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rsp + 0x60]
call fcn.14001b0b0
mov edx, 0x45
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140258f30]
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rsp + 0x68], 1
cmp rcx, r12
je 0x14008e9c6
test byte [rcx + 0x1c], 1
je 0x14008e9c6
mov edx, 0x46
jmp 0x14008e948
mov rdx, r12
lea rcx, [rbp + 0x3d0]
call fcn.1401e7270
mov rbx, qword [rsp + 0x40]
test rax, rax
jne 0x14008e85e
mov rax, qword [r13]
lea r9, [0x140251dfc]
mov r8, rbx
lea rdx, [rbp + 0x3d0]
mov rcx, r13
mov rax, qword [rax + 0x10]
call qword [case.0x1400136d6.0]
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x3d0]
lea rdx, str.VirtualDriver
lea rcx, str.ICA_3.0
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x14008e85e
mov rcx, qword [0x1402a8360]
lea r12, [0x1402a8360]
cmp rcx, r12
je 0x14008e83c
test byte [rcx + 0x1c], 2
je 0x14008e83c
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rsp + 0x60]
call fcn.14001b0b0
mov edx, 0x47
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140258f30]
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rsp + 0x68], 1
cmp rcx, r12
je 0x14008e9c6
test byte [rcx + 0x1c], 1
je 0x14008e9c6
mov edx, 0x48
jmp 0x14008e948
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x13d0]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x13d0]
lea rdx, str.VIRTUALCHANNEL_NAME
mov rcx, r9
call qword [case.0x1400136d6.0]
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x13d0]
lea rdx, str.DriverNameWin32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x14008e972
mov rcx, qword [0x1402a8360]
lea r12, [0x1402a8360]
cmp rcx, r12
je 0x14008e92b
test byte [rcx + 0x1c], 2
je 0x14008e92b
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rsp + 0x60]
call fcn.14001b0b0
mov edx, 0x49
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140258f30]
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rsp + 0x68], 1
cmp rcx, r12
je 0x14008e9c6
test byte [rcx + 0x1c], 1
je 0x14008e9c6
mov edx, 0x4a
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov dword [rsp + 0x20], r14d
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
jmp 0x14008e9c6
mov byte [rsp + 0x68], 1
mov rcx, qword [0x1402a8360]
lea r12, [0x1402a8360]
cmp rcx, r12
je 0x14008e9c0
test byte [rcx + 0x1c], 1
je 0x14008e9c0
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x4b
mov dword [rsp + 0x20], 1
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
mov r14d, 1
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008e9eb
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14008ea13
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rax, qword [0x1402a8360]
lea r15, [0x1402a8360]
jmp 0x14008eab4
mov rax, qword [0x1402a8360]
cmp rax, r15
je 0x14008ea67
test byte [rax + 0x1c], 4
je 0x14008ea67
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x43
lea r8, [0x140258f30]
mov rcx, qword [rax + 0x10]
call fcn.140001ad0
mov rax, qword [0x1402a8360]
mov byte [rsp + 0x68], 1
cmp rax, r15
je 0x14008eaae
test byte [rax + 0x1c], 1
je 0x14008eaae
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x44
mov dword [rsp + 0x20], 1
lea r8, [0x140258f30]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
mov rax, qword [0x1402a8360]
mov r14d, 1
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0x60], rcx
cmp byte [rsp + 0x68], 0
jne 0x14008eb0f
cmp rax, r15
je 0x14008eb0f
test byte [rax + 0x1c], 1
je 0x14008eb0f
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
cmp qword [0x1402bbdc8], 8
cmovae rsi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rsi
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x70]
call fcn.1400048a0
lea rcx, [rsp + 0x70]
call fcn.1400048a0
mov eax, r14d
mov rcx, qword [rbp + 0x1bd0]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0x1ce8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3