Function at 0x140005e70
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x730
mov rax, qword [0x140074c00]
xor rax, rsp
mov qword [rsp + 0x720], rax
xor edi, edi
mov r15, rcx
mov r12, rdx
mov qword [rsp + 0x48], rdx
lea rcx, [0x140060310]
lea r9d, [rdi + 0x12]
xor r8d, r8d
xor edx, edx
mov r13d, edi
mov esi, edi
call qword [0x140055738]
lea r8, [0x140060310]
mov r14, rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
xor edx, edx
mov rcx, r14
mov dword [rsp + 0x58], 0x20
mov qword [rsp + 0x20], rax
call qword [0x140055730]
test eax, eax
je 0x1400061d3
nop dword [rax]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [0x140055728]
mov ebx, dword [rsp + 0x30]
mov rcx, rbx
call fcn.14003dfbc
lea rdx, [rsp + 0x58]
mov r9d, ebx
mov rbp, rax
mov dword [rax], 8
lea rax, [rsp + 0x30]
mov rcx, r14
mov r8, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [0x140055728]
test eax, eax
je 0x1400061e9
lea rdi, [rbp + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [0x1400605e8]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140006197
lea rdx, str.mi_00
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140006197
lea rax, [rsp + 0x110]
mov r8, rdi
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x110]
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140005ff5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140005ff5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140005fd0
jmp 0x140005ffa
test rdx, rdx
jne 0x140005ffe
sub rcx, 2
xor eax, eax
mov word [rcx], ax
lea rcx, [rsp + 0x110]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140006041
lea r12d, [rbx + 0x23]
nop
cmp word [rsp + rbx*2 + 0x110], 0x5c
jne 0x140006034
mov word [rsp + rbx*2 + 0x110], r12w
inc rbx
cmp rbx, rcx
jl 0x140006020
mov r12, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
lea rcx, [0x140060310]
mov r8d, 0x3c
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea r11, [rsp + 0x110]
lea r9, [rsp + 0x90]
lea r8, [0x140060320]
lea rcx, [rsp + 0x320]
mov edx, 0x400
mov qword [rsp + 0x20], r11
call fcn.140004960
lea rdx, str.dot4
lea rcx, [rsp + 0x110]
call fcn.14003e0b4
test rax, rax
jne 0x14000618d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x320]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000618d
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.Port_Number
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006182
mov r9d, dword [rsp + 0x38]
lea r8, str.USB_03d
lea edx, [rax + 0x14]
lea rcx, [rsp + 0x78]
call fcn.140004960
lea rcx, [rsp + 0x78]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140006182
mov edx, 0x104
mov rcx, r12
sub rdi, r12
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006164
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140006164
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140006140
jmp 0x140006169
test rdx, rdx
jne 0x14000616d
sub rcx, 2
xor eax, eax
mov word [rcx], ax
lea rcx, str.GetPrinterDeviceName_IPP_bIPPFalg_is_TRUE
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.14003e074
jmp 0x1400061a4
lea rcx, str.functionClassDeviceData__DevicePath_PI__Or_Not_Find_MI_00_continue
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rax, [rsp + 0x58]
inc r13d
lea r8, [0x140060310]
xor edx, edx
mov rcx, r14
mov r9d, r13d
mov qword [rsp + 0x20], rax
call qword [0x140055730]
mov edi, 0
test eax, eax
jne 0x140005f10
mov rcx, r14
call qword [0x140055720]
test esi, esi
jne 0x1400061f5
mov word [r12], di
xor eax, eax
jmp 0x140006202
mov rcx, rbp
call fcn.14003e074
xor eax, eax
jmp 0x140006202
cmp word [r12], 0
je 0x1400061f1
mov eax, 1
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.14003d6d0
mov rbx, qword [rsp + 0x780]
add rsp, 0x730
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret