Function at 0x140011ae0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcc0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400666f0]
xor rax, rsp
mov qword [rsp + 0xcb0], rax
mov rbp, rcx
cmp qword [rcx + 0x10], 0
jne 0x140011b2c
mov rax, qword [rcx]
call qword [rax]
call fcn.140018084
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140011b4f
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
call fcn.140018084
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140011b81
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140018084
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140011bb3
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x98], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 8
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPrintMonitors
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011c5d
lea rdx, [rdi - 0x18]
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011c13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011c34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140012671
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140012671
mov r14d, r13d
or r12, 0xffffffffffffffff
nop word [rax + rax]
mov dword [rsp + 0x4c], 0x100
mov dword [rsp + 0x48], 0x100
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0xb0]
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r15d, eax
test eax, eax
jne 0x140011e49
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140011d45
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140011ddd
cmp dword [rdx + 0x10], eax
jge 0x140011d17
cmp dword [rbx - 0xc], eax
jl 0x140011e56
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140011ddd
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011d2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x140011ddd
mov r13d, dword [rbx - 0x10]
lea rsi, [rsp + 0xb0]
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011d79
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140008c30
mov rbx, qword [rsp + 0x40]
cmp rsi, r13
ja 0x140011d9d
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + rsi*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
mov rcx, rbx
call fcn.140029c4c
jmp 0x140011dbe
movsxd rax, edi
lea r13, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.140029bb4
test edi, edi
js 0x140011e61
cmp edi, dword [rbx - 0xc]
jg 0x140011e61
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r13 + rbx], ax
xor r13d, r13d
cmp dword [rbp + 0x18], 0
jle 0x140011e3e
xor ecx, ecx
mov rsi, rcx
nop dword [rax + rax]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rsi + rax]
test rdx, rdx
je 0x140011e0e
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140008b00
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call fcn.14002b5dc
test eax, eax
je 0x140011e46
inc r13d
add rsi, 0x18
cmp r13d, dword [rbp + 0x18]
mov ecx, 0
jl 0x140011df0
inc dword [rbp + 0x1c]
xor r13d, r13d
jmp 0x140011e49
xor r13d, r13d
inc r14d
test r15d, r15d
jne 0x140011e6c
jmp 0x140011c70
mov ecx, 0x80070057
call fcn.1400065f0
int3
mov ecx, 0x80070057
call fcn.1400065f0
int3
mov r15d, r13d
mov edx, dword [rbp + 0x1c]
add edx, dword [rbp + 0x18]
mov dword [rbp + 0x20], edx
movsxd rsi, edx
mov eax, 0x20
mul rsi
cmovo rax, r12
add rax, 8
cmovb rax, r12
mov rcx, rax
call fcn.140015f00
test rax, rax
je 0x140011ec7
mov dword [rax], esi
lea rdi, [rax + 8]
lea rax, [0x140011800]
mov qword [rsp + 0x20], rax
lea r9, [0x140011890]
mov r8d, esi
mov edx, 0x20
mov rcx, rdi
call fcn.14002b460
jmp 0x140011eca
mov rdi, r13
mov qword [rbp + 8], rdi
mov eax, r13d
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], r13
nop word [rax + rax]
mov dword [rsp + 0x4c], 0x100
mov dword [rsp + 0x48], 0x100
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0xb0]
mov edx, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r14d, eax
test eax, eax
jne 0x14001249f
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140011fb4
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001204c
cmp dword [rdx + 0x10], eax
jge 0x140011f86
cmp dword [rbx - 0xc], eax
jl 0x1400124b3
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14001204c
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011f9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x14001204c
mov r13d, dword [rbx - 0x10]
lea rsi, [rsp + 0xb0]
sub rsi, rbx
sar rsi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011fe8
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140008c30
mov rbx, qword [rsp + 0x40]
cmp rsi, r13
ja 0x14001200c
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + rsi*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
mov rcx, rbx
call fcn.140029c4c
jmp 0x14001202d
movsxd rax, edi
lea r13, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.140029bb4
test edi, edi
js 0x1400124f5
cmp edi, dword [rbx - 0xc]
jg 0x1400124f5
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r13 + rbx], ax
xor r13d, r13d
cmp dword [rbp + 0x18], 0
jle 0x1400120b2
xor ecx, ecx
mov rsi, rcx
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rsi + rax]
test rdx, rdx
je 0x14001207e
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140008b00
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call fcn.14002b5dc
test eax, eax
je 0x14001249c
inc r13d
add rsi, 0x18
cmp r13d, dword [rbp + 0x18]
mov ecx, 0
jl 0x140012060
call fcn.140018084
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x1400124ea
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
lea r8, str.SYSTEMCurrentControlSetControlPrintMonitors_
test r8, 0xffffffffffff0000
jne 0x140012116
movzx edi, r8w
mov ecx, edi
call fcn.140018070
test rax, rax
je 0x14001221a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400079d0
jmp 0x14001221a
xor eax, eax
mov rcx, r12
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14001218c
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001221a
cmp dword [rdx + 0x10], eax
jge 0x140012159
cmp dword [rsi - 0xc], eax
jl 0x1400124be
mov dword [rsi - 0x10], r13d
mov word [rsi], r13w
jmp 0x14001221a
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012170
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x40]
jmp 0x14001221a
mov r14d, dword [rsi - 0x10]
mov r13, r8
sub r13, rsi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400121c2
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140008c30
mov rsi, qword [rsp + 0x50]
lea r8, str.SYSTEMCurrentControlSetControlPrintMonitors_
cmp r13, r14
ja 0x1400121e6
movsxd rax, edi
lea r14, [rax + rax]
lea r8, [rsi + r13*2]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r14
mov rcx, rsi
call fcn.140029c4c
jmp 0x1400121ff
movsxd rax, edi
lea r14, [rax + rax]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r14
mov rcx, rsi
call fcn.140029bb4
test edi, edi
js 0x1400124df
cmp edi, dword [rsi - 0xc]
jg 0x1400124df
mov dword [rsi - 0x10], edi
xor eax, eax
mov word [r14 + rsi], ax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140006480
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
mov dword [rsp + 0x78], 0x800
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.Driver
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r13, r15d
shl r13, 5
mov rax, qword [rbp + 8]
lea r9, [r13 + rax]
xor eax, eax
mov rcx, r12
lea rdi, str.Language
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.Language
mov rcx, r9
call fcn.140008b00
mov rdx, qword [rbp + 8]
mov rax, qword [rsp + 0x68]
lea rsi, [rdx + rax + 0x10]
lea rcx, [rbx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x140012330
cmp dword [rdi + 0x10], 0
jl 0x140012321
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012321
call fcn.140008d20
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012318
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
jmp 0x140012330
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, rsi
call fcn.140008b00
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 8]
lea r9, [r13 + rax + 8]
test rdx, rdx
jne 0x14001234e
xor r13d, r13d
mov ecx, r13d
jmp 0x140012362
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor r13d, r13d
mov r8d, ecx
mov rcx, r9
call fcn.140008b00
mov rdx, qword [rbp + 8]
mov rsi, qword [rsp + 0x68]
lea rbx, [rdx + rsi + 0x18]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, r12d
lea r8, [rsp + 0x4b0]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [rax - 1]
test edi, edi
jle 0x140012400
mov rcx, qword [rbx]
mov edx, 1
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400123c0
mov edx, edi
mov rcx, rbx
call fcn.140008c30
mov rax, qword [rbx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x4b0]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r11, qword [rbx]
cmp edi, dword [r11 - 0xc]
jg 0x1400124c9
mov dword [r11 - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov word [rax + rcx*2], r13w
jmp 0x140012454
mov rax, qword [rbx]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140012454
cmp dword [rdx + 0x10], 0
jge 0x14001242d
cmp dword [rax - 0xc], 0
jl 0x1400124d4
mov dword [rax - 0x10], r13d
mov rax, qword [rbx]
mov word [rax], r13w
jmp 0x140012454
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012444
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
add rsi, 0x20
mov qword [rsp + 0x68], rsi
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012495
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
jmp 0x14001249f
mov rbx, qword [rsp + 0x40]
jmp 0x14001249f
xor r13d, r13d
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
test r14d, r14d
jne 0x140012500
jmp 0x140011ee0
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80070057
call fcn.1400065f0
int3
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80070057
call fcn.1400065f0
nop
mov ecx, 0x80004005
call fcn.1400065f0
int3
mov ecx, 0x80070057
call fcn.1400065f0
int3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r15d, dword [rbp + 0x20]
jge 0x14001260c
mov rsi, r13
nop dword [rax + rax]
movsxd rbx, r15d
shl rbx, 5
mov rax, qword [rbp + 8]
lea r9, [rbx + rax]
xor eax, eax
mov rcx, r12
lea rdi, str.Port
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.Port
mov rcx, r9
call fcn.140008b00
mov rdx, qword [rbp + 0x10]
mov rdx, qword [rsi + rdx]
mov rax, qword [rbp + 8]
lea r9, [rbx + rax + 0x10]
test rdx, rdx
jne 0x14001256f
mov ecx, r13d
jmp 0x140012580
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.140008b00
mov rdx, qword [rbp + 0x10]
mov rdx, qword [rsi + rdx + 8]
mov rax, qword [rbp + 8]
lea r9, [rbx + rax + 8]
test rdx, rdx
jne 0x1400125a7
mov ecx, r13d
jmp 0x1400125b8
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.140008b00
mov rdx, qword [rbp + 0x10]
mov rdx, qword [rsi + rdx + 0x10]
mov rax, qword [rbp + 8]
lea r9, [rbx + rax + 0x18]
test rdx, rdx
jne 0x1400125df
mov ecx, r13d
jmp 0x1400125f0
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.140008b00
add rsi, 0x18
inc r15d
cmp r15d, dword [rbp + 0x20]
jl 0x140012520
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012630
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012651
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140012671
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xcb0]
xor rcx, rsp
call fcn.140029b10
lea r11, [rsp + 0xcc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret