Function at 0x1401b1fb0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x820]
sub rsp, 0x920
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x810], rax
mov ebx, r8d
mov dword [rsp + 0x44], ebx
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x60], rcx
xor edx, edx
mov r8d, 0x618
lea rcx, [rbp + 0x1f0]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.1401e7e40
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov r9, r13
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters_sPrinterDriverData
mov edx, 0x30c
lea rcx, [rbp + 0x1f0]
call fcn.14002fb20
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x1f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x1401b20d8
lea rdx, str.UIProfileStructSize
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, 1
lea rdi, [0x140260ff8]
nop word [rax + rax]
lea r8, str._s0_d
cmp ebx, 0xa
cmovae r8, rdi
mov dword [rsp + 0x20], ebx
lea r9, str.DeviceOption
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.14002fb20
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r14d, eax
test eax, eax
jne 0x1401b20d4
inc ebx
cmp ebx, 0x63
jbe 0x1401b2090
mov ebx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1401b270a
test ebx, ebx
je 0x1401b270a
mov dword [rsp + 0x50], r12d
add r15, 0x24
mov eax, dword [rsp + 0x44]
mov ebx, 0x5c
mov rdx, qword [r15 - 0x24]
test rdx, rdx
je 0x1401b2687
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401b2130
lea rcx, [rbp - 0x48]
call fcn.140005520
nop
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x30]
cmp rcx, 8
setae r8b
mov rdx, qword [rbp - 0x48]
cmovae rax, rdx
mov rsi, qword [rbp - 0x38]
cmp bx, word [rax + rsi*2 - 2]
je 0x1401b21b6
sub rcx, rsi
cmp rcx, 1
jb 0x1401b218d
lea rax, [rsi + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
test r8b, r8b
cmovne rax, rdx
mov dword [rax + rsi*2], 0x5c
jmp 0x1401b21ae
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x140251df8]
mov edx, 1
lea rcx, [rbp - 0x48]
call fcn.14001f950
mov rsi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [r13 + rdi*2], 0
jne 0x1401b21c0
sub rcx, rsi
lfence
cmp rdi, rcx
ja 0x1401b2204
add qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r13
call fcn.1401e7770
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401b2218
mov qword [rsp + 0x20], rdi
mov r9, r13
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.14001f950
cmp qword [r15 - 0x1c], 0
je 0x1401b22dd
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401b2255
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 8
cmovae rax, qword [rbp - 0x48]
mov dword [rax + rcx*2], 0x5c
jmp 0x1401b2276
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x140251df8]
mov edx, 1
lea rcx, [rbp - 0x48]
call fcn.14001f950
mov r9, qword [r15 - 0x1c]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [r9 + rdi*2], 0
jne 0x1401b2281
mov rsi, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
sub rax, rsi
lfence
cmp rdi, rax
ja 0x1401b22cc
add qword [rbp - 0x38], rdi
lea rbx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rbx, qword [rbp - 0x48]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.1401e7770
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401b22dd
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.14001f950
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x1401b262c
mov rdx, qword [r15 - 0x14]
mov rax, r12
lea r8, str.Default_DevMode
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
jne 0x1401b2607
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x1401b2607
add rax, 2
cmp rax, 0x10
jne 0x1401b2330
mov rbx, r12
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xf000c
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], r12
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x68], r12
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x68]
mov rcx, r13
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterW]
test eax, eax
je 0x1401b23ac
mov rbx, qword [rbp - 0x68]
mov qword [rsp + 0x58], rbx
jmp 0x1401b23ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401b255c
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, r13
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_DocumentPropertiesW]
mov r12d, eax
test eax, eax
je 0x1401b2514
cmp r12d, dword [r15]
jb 0x1401b2514
lfence
mov byte [rsp + 0x41], 0
mov ebx, r12d
test eax, eax
je 0x1401b2426
lfence
lea r8, [rsp + 0x41]
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.140084d20
mov byte [rsp + 0x40], 0
lfence
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140084d20
jmp 0x1401b242b
mov byte [rsp + 0x40], 0
mov edi, dword [r15]
mov r14, qword [r15 - 0xc]
mov rsi, qword [rbp - 0x80]
test rdi, rdi
je 0x1401b249b
test rsi, rsi
jne 0x1401b244d
call fcn.1401ec568
mov dword [rax], socket
jmp 0x1401b2496
test r14, r14
je 0x1401b2467
cmp rbx, rdi
jb 0x1401b2467
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.1401e7770
jmp 0x1401b249b
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1401e7e40
test r14, r14
jne 0x1401b2486
call fcn.1401ec568
mov dword [rax], socket
jmp 0x1401b2496
cmp rbx, rdi
jae 0x1401b249b
call fcn.1401ec568
mov dword [rax], 0x22
call fcn.1401ec3fc
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x68]
mov r9, rdi
mov r8, r13
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_DocumentPropertiesW]
cmp eax, 1
jne 0x1401b251d
lfence
mov rdi, qword [rsp + 0x68]
movzx eax, word [rdi + 0x46]
mov rsi, qword [rbp - 0x80]
mov word [rsi + 0x46], ax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, r13
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_DocumentPropertiesW]
cmp eax, 1
jne 0x1401b251d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
jmp 0x1401b252d
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x68]
mov eax, dword [r15]
mov dword [rsp + 0x28], eax
mov rax, qword [r15 - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, dword [r15 - 4]
xor r8d, r8d
mov rdx, qword [r15 - 0x14]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
test rbx, rbx
je 0x1401b2567
mov rcx, rbx
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
xor r12d, r12d
mov ebx, r12d
jmp 0x1401b256a
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x68]
jmp 0x1401b256a
xor r12d, r12d
test rdi, rdi
je 0x1401b25b2
mov rdx, qword [rsp + 0x78]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1401b259c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b273d
mov rcx, rdi
call fcn.1400079c0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
test rsi, rsi
je 0x1401b25f7
mov rdx, qword [rbp - 0x70]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1401b25e3
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b2743
mov rcx, rsi
call fcn.1400079c0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
test rbx, rbx
je 0x1401b262c
mov rcx, rbx
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
jmp 0x1401b262c
mov eax, dword [r15]
mov dword [rsp + 0x28], eax
mov rax, qword [r15 - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, dword [r15 - 4]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r14d, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401b2641
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1401b26ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401b2680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b2737
call fcn.1400079c0
jmp 0x1401b26ec
mov ebx, dword [r15 + 4]
mov edi, dword [r15]
mov rsi, qword [r15 - 0xc]
mov r14d, dword [r15 - 4]
mov r12, qword [r15 - 0x14]
mov r13, qword [r15 - 0x1c]
cmp qword [rsp + 0x60], 0
jne 0x1401b26b3
mov r14d, MsiOpenDatabaseW
mov r13, qword [rsp + 0x60]
jmp 0x1401b26f0
call fcn.1401b65c0
mov ecx, dword [rax]
lea rax, [0x1402467d0]
mov rax, qword [rax + rcx*8]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, r14d
mov r8, r12
mov rdx, r13
mov r13, qword [rsp + 0x60]
mov rcx, r13
call qword [case.0x1400136d6.0]
mov r14d, eax
mov eax, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x50]
inc ebx
mov dword [rsp + 0x50], ebx
add r15, 0x30
cmp ebx, eax
jae 0x1401b270a
xor r12d, r12d
jmp 0x1401b2101
mov eax, r14d
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.1401e2900
mov rbx, qword [rsp + 0x970]
add rsp, 0x920
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401ec41c
nop
call fcn.1401ec41c
nop
call fcn.1401ec41c
int3