Function at 0x140017d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x47], 7
xor edi, edi
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
lea rdx, [rbp + 0x2f]
call fcn.140018260
mov qword [rbp + 7], 7
mov qword [rbp - 1], rdi
mov word [rbp - 0x11], di
cmp word [rbx], di
jne 0x140017dd5
mov r8d, edi
jmp 0x140017deb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140017de0
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.14000d3f0
nop
mov qword [rbp - 0x21], rdi
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], rdi
mov word [rbp + 0xf], di
movzx eax, word [str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties]
neg ax
sbb r8, r8
and r8d, 0x38
lea rdx, str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea rcx, [rbp + 0xf]
call fcn.14000d3f0
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
mov byte [rbp - 0x29], 0
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp - 0x2d], eax
mov rcx, qword [rbp - 0x39]
test eax, eax
cmovne rcx, rdi
mov qword [rbp - 0x39], rcx
cmp qword [rbp + 0x27], 8
jb 0x140017eb9
mov rax, qword [rbp + 0xf]
mov qword [rbp - 0x49], rax
test rax, rax
je 0x140017eb9
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x140017ead
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
jne 0x140017ead
mov rcx, qword [rbp - 0x39]
jmp 0x140017ec0
xor edx, edx
lea rcx, [rbp - 0x49]
call rax
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1400575e8]
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140017f0e
mov dword [rbp - 0x41], 8
mov dword [rbp - 0x49], 0xb
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x2d], eax
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1400575e8]
mov rbx, qword [rbp - 0x21]
test rcx, rcx
je 0x140017f27
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x2d], eax
mov rax, qword [0x1400575e8]
cmp qword [rbp + 7], 8
jb 0x140017f60
mov rcx, qword [rbp - 0x11]
mov qword [rbp - 0x49], rcx
test rcx, rcx
je 0x140017f60
test rax, rax
jne 0x140017f51
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x140017f60
xor edx, edx
lea rcx, [rbp - 0x49]
call rax
mov rax, qword [0x1400575e8]
mov qword [rbp + 7], 7
mov qword [rbp - 1], rdi
mov word [rbp - 0x11], di
cmp qword [rbp + 0x47], 8
jb 0x140017fa2
mov rcx, qword [rbp + 0x2f]
mov qword [rbp - 0x49], rcx
test rcx, rcx
je 0x140017fa2
test rax, rax
jne 0x140017f9a
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x140017fa2
xor edx, edx
lea rcx, [rbp - 0x49]
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret