Function at 0x14001f350
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x8a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x890], rax
call fcn.140069504
mov r12, qword [rax + 8]
xor esi, esi
mov rbx, qword [r12 + 0x90]
call fcn.1400696cc
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001f3b8
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
or rbp, 0xffffffffffffffff
test rbx, rbx
je 0x14001f416
test rbx, 0xffffffffffff0000
jne 0x14001f402
movzx ebx, bx
mov ecx, ebx
call fcn.1400696b8
test rax, rax
je 0x14001f42d
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003a40
mov rdi, qword [rsp + 0x30]
jmp 0x14001f42d
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14001f418
mov ecx, esi
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140003c40
mov rdi, qword [rsp + 0x30]
movsxd rbx, dword [rdi - 0x10]
mov r13d, 1
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14001f457
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rdi, qword [rsp + 0x30]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140084240
test ebx, ebx
js 0x14001f6c1
cmp ebx, dword [rdi - 0xc]
jg 0x14001f6c1
mov dword [rdi - 0x10], ebx
mov word [rdi + rbx*2], 0
cmp dword [rdi - 0x10], 0
jl 0x14001f4a8
lea rdx, str._ncopy
mov rcx, rdi
call fcn.1400804d0
test rax, rax
je 0x14001f4a8
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14001f6a4
mov word [rsp + 0x680], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x682]
call fcn.140080d50
mov word [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.140080d50
mov word [rsp + 0x470], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x472]
call fcn.140080d50
mov r9d, 0x104
lea r8, [rsp + 0x470]
lea rdx, [0x1400a4510]
mov rcx, r12
call fcn.140041aa0
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rdx, qword [0x1400e9300]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x680]
lea r8, str.item_not_found__
lea rdx, str.PDL_NAME
lea rcx, str.Profiles
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.item_not_found__
lea rcx, [rsp + 0x680]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001f6a4
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x260], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x262]
call fcn.140080d50
mov dword [rsp + 0x3c], 0x104
mov dword [rsp + 0x38], r13d
lea rdx, str.SOFTWARECanonPrnUninst
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f6a4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001f698
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
cmove esi, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14001f6bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
jmp 0x14001f6cc
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret