Function at 0x14006fedc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov rsi, rcx
xor r15d, r15d
lea rcx, [rsp + 0x62]
mov word [rsp + 0x60], r15w
xor edx, edx
mov r8d, 0x206
mov ebx, r15d
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], 0x208
mov edi, r15d
test rsi, rsi
je 0x14006ff45
cmp word [rsi], r15w
jne 0x14006ff51
mov ebx, 0x57
lea rdi, str.Invalid_Printer_Name
mov ecx, r15d
mov r12d, 0x2c
test ebx, ebx
jne 0x14006ff7a
movzx edx, r12w
mov rcx, rsi
call sub.msvcrt.dll_wcschr
test rax, rax
lea rdi, str.Created_Append_Suffix
mov ecx, r15d
sete cl
mov dword [rsp + 0x50], 0x67727473
lea r14, [0x1400ab2c0]
mov qword [rsp + 0x58], r14
test ecx, ecx
je 0x140070029
xor edx, edx
mov word [rbp + 0x170], r15w
mov r8d, 0x40e
lea rcx, [rbp + 0x172]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x4c], 0x410
test ebx, ebx
jne 0x140070049
lea rax, [rsp + 0x4c]
mov r8, rsi
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 2]
lea rax, [rbp + 0x170]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
lea rdi, str.Read_value_from_Devices_Path
mov ebx, eax
test eax, eax
jne 0x140070049
lea r9, [rbp + 0x170]
mov r8, rsi
lea rdx, str._s__s
lea rcx, [rsp + 0x50]
call fcn.1400167e4
lea rdi, str.Formatted_full_printer_name
jmp 0x140070041
test ebx, ebx
jne 0x140070049
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400169a0
lea rdi, str.Set_full_printer_name_to_pszPrinter
mov r14, qword [rsp + 0x58]
movzx ebx, ax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r15
call fcn.140020930
mov qword [rsp + 0x40], r15
test ebx, ebx
jne 0x140070165
lea rax, [rsp + 0x40]
xor r8d, r8d
lea r9d, [rbx + 3]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
lea rdi, str.Opened_Windows_reg_key
mov ebx, eax
test eax, eax
jne 0x140070163
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.Device
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400700e3
mov edx, r12d
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400700e3
mov word [rax], r15w
lea rdi, str.Queried_Device_value
test ebx, ebx
jne 0x140070165
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r15w
jne 0x1400700f2
mov rcx, qword [rsp + 0x40]
lea rdx, str.Device
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
lea rdi, str.Set_Device_value
mov ebx, eax
test eax, eax
jne 0x140070163
lea r9, str.Windows
xor r8d, r8d
lea edx, [rax + 0x1a]
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
test eax, eax
jne 0x14007015c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
lea rdi, str.Failed_SendNotifyMessage
jmp 0x140070163
lea rdi, str.Successful_SendNotifyMessage
test ebx, ebx
jg 0x14007016b
mov eax, ebx
jmp 0x140070173
movzx eax, bx
or eax, 0x80070000
mov r9, rdi
mov dword [rsp + 0x20], eax
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14006f428
test ebx, ebx
jne 0x1400701b6
test rsi, rsi
je 0x1400701b1
cmp word [rsi], r15w
je 0x1400701b1
mov rcx, rsi
call fcn.1400701fc
movzx ebx, ax
test ebx, ebx
jne 0x1400701b6
lea ecx, [rbx + 1]
call fcn.1400705e4
mov ebx, eax
jmp 0x1400701b6
mov ebx, 0x57
lea rcx, [rsp + 0x40]
call fcn.140020930
mov rdx, r14
call fcn.140016834
mov eax, ebx
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140024ca0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret