Function at 0x140019b50
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6e0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
xor r14d, r14d
mov esi, r14d
call fcn.1400696cc
mov rcx, rax
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x140019bb3
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
call fcn.1400696cc
mov rcx, rax
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x140019be2
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
call fcn.140069504
mov r13, qword [rax + 8]
mov qword [rsp + 0x78], r13
mov rdx, qword [r13 + 0x5b0]
lea rcx, [rdx - 0x18]
lea rbp, [rbx - 0x18]
or r12d, 0xffffffff
cmp rcx, rbp
je 0x140019c6d
cmp dword [rbp + 0x10], 0
jl 0x140019c5a
mov rax, qword [rbp]
cmp qword [rcx], rax
jne 0x140019c5a
call fcn.1400031e0
mov rbx, rax
mov eax, r12d
lock xadd dword [rbp + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140019c4a
mov rcx, qword [rbp]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x40], rbx
mov rdi, qword [rsp + 0x58]
jmp 0x140019c6d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c40
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [r9 + 2]
call sub.WINSPOOL.DRV_EnumPrintersW
test eax, eax
jne 0x140019ceb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140019ceb
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019cc3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140019ce4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14001a1de
mov edx, dword [rsp + 0x54]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001a19d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
mov r9, rbp
xor edx, edx
lea ecx, [rdx + 6]
lea r8d, [rdx + 2]
call sub.WINSPOOL.DRV_EnumPrintersW
test eax, eax
je 0x14001a044
mov r15d, r14d
cmp dword [rsp + 0x50], r14d
jbe 0x14001a03f
lea r14, [rbx - 0x10]
lea r13, [rbp + 0x20]
xor ebp, ebp
test ebp, ebp
js 0x140019e9a
cmp ebp, dword [r14]
jge 0x140019e9a
movsxd rax, ebp
lea rcx, [rbx + rax*2]
mov dx, 9
call fcn.1400804a0
mov rsi, rax
test rax, rax
jne 0x140019d89
mov esi, r12d
jmp 0x140019e9d
sub rsi, rbx
sar rsi, 1
test esi, esi
js 0x140019e9d
mov r9d, esi
sub r9d, ebp
mov r8d, ebp
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.140003560
nop
mov rdx, qword [rax]
lea rbx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x140019e6d
cmp dword [rdi + 0x10], 0
jl 0x140019e5e
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x140019e5e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x140019dfb
cmp rax, qword [rbx]
jne 0x140019dfb
mov rbp, rbx
lock add dword [rbx + 0x10], 1
jmp 0x140019e38
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rbp, rax
test rax, rax
je 0x140019fd3
mov eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov eax, dword [rbx + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rbp + 0x18]
call fcn.140080540
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019e53
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x140019e6d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019f91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140019f91
mov esi, r12d
mov r8d, ebp
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140003e50
nop
mov rdx, qword [rax]
lea rbx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x140019f6d
cmp dword [rdi + 0x10], 0
jl 0x140019f5e
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x140019f5e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x140019efb
cmp rax, qword [rbx]
jne 0x140019efb
mov rbp, rbx
lock add dword [rbx + 0x10], 1
jmp 0x140019f38
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rbp, rax
test rax, rax
je 0x140019fd9
mov eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov eax, dword [rbx + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rbp + 0x18]
call fcn.140080540
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019f53
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x140019f6d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019f91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r13]
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400807e0
test eax, eax
je 0x140019fee
lea ebp, [rsi + 1]
test esi, esi
js 0x140019fb7
mov rbx, qword [rsp + 0x40]
jmp 0x140019d58
add r15d, 1
add r13, 0x88
cmp r15d, dword [rsp + 0x50]
jae 0x140019fdf
mov rbx, qword [rsp + 0x40]
jmp 0x140019d56
call fcn.1400019f0
nop
call fcn.1400019f0
nop
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
xor r14d, r14d
jmp 0x14001a03f
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001a017
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14001a038
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14001a1de
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x14001a19d
lea r9, str.DIASUser
lea r8, str.SOFTWARECanonDIASSETUP
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, 0x2011f
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001a0ac
mov esi, r14d
jmp 0x14001a19d
mov rdx, qword [r13 + 0x5b8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, r14d
mov ebp, r14d
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], 0x208
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14001a18c
nop
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x14001a135
add ebx, 1
add ebp, 1
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], 0x208
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0xa0]
mov edx, ebp
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14001a120
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
cmova esi, r14d
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001a1ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14001a1dc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret