Function at 0x14008d6b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbe8]
sub rsp, 0xce8
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0xbd0], rax
mov rbx, r9
mov r15, r8
mov r14, rdx
mov r12, rcx
lea rdx, str.InstallVitualChannel::SetRegKeyICA
lea rcx, [rsp + 0x60]
call fcn.14001abe0
nop
lea r13, [0x1402a8360]
lea rdi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r13
je 0x14008d78c
test byte [rcx + 0x1c], 1
je 0x14008d74a
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x30
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, r13
je 0x14008d78c
test byte [rcx + 0x1c], 1
je 0x14008d78c
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x31
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.14001d060
xor eax, eax
mov qword [rsp + 0x48], rax
mov esi, 1
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.1401e7e40
mov rdx, r14
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140251df8]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, r15
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008daf3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008dadf
mov ecx, dword [rsp + 0x40]
shr ecx, 1
add ecx, 0xc
mov eax, 2
mul rcx
mov r15, 0xffffffffffffffff
cmovo rax, r15
mov rcx, rax
call fcn.140064a50
mov r14, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008da9b
mov rdx, rbx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x1c0]
mov rcx, r14
call fcn.1401e7270
test rax, rax
je 0x14008d912
mov rcx, qword [0x1402a8360]
cmp rcx, r13
je 0x14008dad7
test byte [rcx + 0x1c], 4
je 0x14008dad7
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rsi + 0x31]
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
jmp 0x14008dad7
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14008dc0e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rbx, [0x140251dfc]
cmp rbx, 0x10000
jae 0x14008d958
movzx edx, bx
lea rcx, [rsp + 0x50]
call fcn.1400041d0
jmp 0x14008d97b
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14008d960
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140004e60
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
lea r8, [rbp + 0x3d0]
lea rdx, str.MODULENAME_PREFIX
mov rcx, r10
call qword [case.0x1400136d6.0]
lea r8, [rbp + 0x3d0]
lea rdx, str.Canon__s
lea rcx, [rsp + 0x50]
call fcn.140018e20
mov rax, qword [r12]
mov r9, rbx
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov rdx, r14
mov rcx, r12
mov rax, qword [rax + 0x10]
call qword [case.0x1400136d6.0]
mov rax, r15
nop
lea rax, [rax + 1]
cmp word [r14 + rax*2], 0
jne 0x14008da00
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x44]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14008da76
mov rcx, qword [0x1402a8360]
cmp rcx, r13
je 0x14008da74
test byte [rcx + 0x1c], 4
je 0x14008da74
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x33
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor esi, esi
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14008dad7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
jmp 0x14008dad7
mov rcx, qword [0x1402a8360]
cmp rcx, r13
je 0x14008dad5
test byte [rcx + 0x1c], 4
je 0x14008dad5
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x34
lea r8, [0x140258f30]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor esi, esi
mov rcx, r14
call fcn.1400079c0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1402a8360]
jmp 0x14008db36
mov rax, qword [0x1402a8360]
cmp rax, r13
je 0x14008db34
test byte [rax + 0x1c], 4
je 0x14008db34
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x35
lea r8, [0x140258f30]
mov rcx, qword [rax + 0x10]
call fcn.140001ad0
mov rax, qword [0x1402a8360]
xor esi, esi
mov cl, 1
mov byte [rsp + 0x68], cl
cmp rax, r13
je 0x14008db7e
test byte [rax + 0x1c], cl
je 0x14008db7e
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x36
mov dword [rsp + 0x20], esi
lea r8, [0x140258f30]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
movzx ecx, byte [rsp + 0x68]
mov rax, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x60], rdx
test cl, cl
jne 0x14008dbd6
cmp rax, r13
je 0x14008dbd6
test byte [rax + 0x1c], 1
je 0x14008dbd6
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
cmp qword [0x1402bbdc8], 8
cmovae rdi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x70]
call fcn.1400048a0
lea rcx, [rsp + 0x70]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rbp + 0xbd0]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0xce8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001470
int3