Function at 0x10003bf44
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r14d, r14d
mov rbx, r8
mov r12d, r14d
mov rdi, r14
mov rbp, r14
mov qword [rsp + 0x58], r14
mov r13d, r14d
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
lea rcx, [0x1000834b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp rbx, r14
je 0x10003c16f
cmp word [rbx], r14w
je 0x10003c16f
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x58]
lea rdx, str.SystemCurrentControlSetControlPrintProviders
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x3001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
je 0x10003bfdd
mov ecx, eax
jmp 0x10003c174
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call fcn.10003bc9c
mov rsi, rax
cmp rax, r14
je 0x10003c17a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0xa0]
lea rdx, str.Order
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0xa0], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x10003bfd6
mov ecx, dword [rsp + 0xa0]
cmp ecx, r14d
je 0x10003c17a
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
cmp rax, r14
je 0x10003c17a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0xa0]
lea rdx, str.Order
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x10003bfd6
mov edx, dword [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov r8, rbx
mov rcx, rdi
call fcn.100037be8
mov rbp, rax
cmp rax, r14
je 0x10003c17a
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x58]
lea rdx, str.Order
mov dword [rsp + 0x28], eax
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
cmp eax, r14d
jne 0x10003bfd6
lea rcx, str.LanMan_Print_Services
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x10003c114
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea r8, str.AddPrinterDrivers
lea rdx, str.LanMan_Print_ServicesServers
call fcn.100037898
cmp eax, r14d
sete r13b
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call fcn.100037424
cmp r13d, r14d
je 0x10003c143
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea r8, str.AddPrinterDrivers
lea rdx, str.LanMan_Print_ServicesServers
call fcn.100037980
mov rcx, qword [0x1000832b0]
cmp qword [rcx], r14
je 0x10003c167
mov rax, qword [rcx]
cmp rax, rsi
je 0x10003c161
mov rcx, rax
cmp qword [rax], r14
jne 0x10003c14f
jmp 0x10003c167
mov rax, qword [rsi]
mov qword [rcx], rax
mov r12d, 1
jmp 0x10003c190
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r14d
jne 0x10003c190
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, r14
je 0x10003c19d
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp rbp, r14
je 0x10003c1aa
mov rcx, rbp
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x58]
cmp rcx, r14
je 0x10003c1ba
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea rcx, [0x1000834b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x60]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret