Function at 0x140005b80
Capabilities:
Delete registry value
Print debug messages

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor esi, esi
xor r14d, r14d
mov r15d, r9d
cmp dword [0x14001da70], esi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov r12d, ecx
mov qword [rsp + 0x30], rsi
je 0x140005fdb
mov eax, dword [0x14001dac0]
mov qword [rsp + 0x288], rbx
dec eax
je 0x140005c04
dec eax
je 0x140005bfb
dec eax
je 0x140005bf2
lea rbx, str.Unknown
jmp 0x140005c0b
lea rbx, str.KM_WOW64
jmp 0x140005c0b
lea rbx, str.DDModule
jmp 0x140005c0b
lea rbx, str.CmnI_F
cmp dword [0x14001da74], 1
jne 0x140005ccc
cmp r12d, 0x10
je 0x140005c32
cmp r12d, 0x20
jne 0x140005ccc
call fcn.140005910
jmp 0x140005ce0
call fcn.1400058c0
mov esi, dword [0x14001da78]
mov r14d, dword [0x14001da7c]
mov rax, qword [0x14001da80]
mov qword [rsp + 0x30], rax
test r15d, r15d
je 0x140005fd3
mov qword [rsp + 0x278], r13
mov r13d, esi
and r13d, 0xf
cmp r15d, r13d
jbe 0x140005c7c
mov eax, r14d
and eax, 0xf
cmp r15d, eax
ja 0x140005fcb
mov edx, 0x800
mov ecx, 0x40
mov qword [rsp + 0x280], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x140005fc3
mov rdx, qword [rbp + 0x1e0]
lea r8, [rbp + 0x1e8]
mov rcx, rax
call qword [sym.imp.USER32.dll_wvsprintfW]
and esi, 0xfffffff0
jne 0x140005cf9
mov r8, qword [rsp + 0x40]
jmp 0x140005d0a
cmp r12d, 0x10
je 0x140005c37
cmp r12d, 0x20
jne 0x140005c50
mov esi, dword [0x14001da88]
mov r14d, dword [0x14001da8c]
mov rax, qword [0x14001da90]
jmp 0x140005c4b
cmp esi, 0x7000
jne 0x140005dd7
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
or r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.1400064f8
cmp r15d, r13d
ja 0x140005dda
mov edx, 0x800
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x140005dda
mov eax, r15d
mov qword [rsp + 0x28], rdi
lea r9, [0x140018b30]
mov r8, rbx
mov rcx, rsi
dec eax
je 0x140005d91
dec eax
je 0x140005d88
dec eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
je 0x140005d7f
lea rdx, str.__s__s____s____s_r_n
jmp 0x140005da2
lea rdx, str.__s__s____WARNING___s____s_r_n
jmp 0x140005da2
lea rdx, str.__s__s____ERROR___s____s_r_n
jmp 0x140005d98
lea rdx, str.__s__s____RIP___s____s_r_n
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140005dda
xor r15d, r15d
mov eax, r14d
and eax, 0xfffffff0
cmp eax, 0xf000
jne 0x140005f9f
and r14d, 0xf
cmp r15d, r14d
ja 0x140005f9f
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140005f30
lea r9, [0x140018b30]
lea rdx, str._s__s_
lea rcx, [rbp + 0x60]
mov r8, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0xb0c
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x140005f9f
mov dword [rax], 1
mov dword [rax + 4], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rbx + 0xc]
lea r8, [rbp + 0x60]
or r9, 0xffffffffffffffff
mov edx, 0x80
mov dword [rbx + 8], eax
call fcn.1400064f8
mov r8, qword [rsp + 0x40]
lea rcx, [rbx + 0x10c]
or r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.1400064f8
mov r8, qword [rsp + 0x38]
lea rcx, [rbx + 0x20c]
or r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.1400064f8
lea rcx, [rbx + 0x30c]
or r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x400
call fcn.1400064f8
mov edx, dword [0x14001dac0]
xor eax, eax
or rdx, r12
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
or rdx, 0x1100
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x48], rdx
lea edx, [rax + 0x4a]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x50], 0xb0c
mov qword [rsp + 0x58], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140005f9f
cmp r12d, 0x10
je 0x140005f45
cmp r12d, 0x20
jne 0x140005f9f
lea rdx, str.SoftwareKONICA_MINOLTADriverAPIFax
jmp 0x140005f4c
lea rdx, str.SoftwareKONICA_MINOLTADriverAPI
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005f9f
mov rcx, qword [rsp + 0x30]
lea rdx, str.Msg_Level
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
lea rdx, str.Msg_hWnd
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x280]
mov r13, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140006370
add rsp, 0x290
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret