Function at 0x140126fe0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov r12, r8
mov r14, rdx
mov qword [rsp + 0x68], rdx
lea rdx, str.CBaseInfoCustomDrv::DeleteUserDataFromPrinterReg
lea rcx, [rbp]
call fcn.14001abe0
nop
lea rdi, [0x1402a8360]
lea r13, [0x1402bbdb0]
mov rbx, qword [0x1402a8360]
cmp rbx, rdi
je 0x1401270ba
test byte [rbx + 0x1c], 1
je 0x14012707b
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x24
lea r8, [0x140261908]
mov rcx, qword [rbx + 0x10]
call fcn.140001ad0
mov rbx, qword [0x1402a8360]
cmp rbx, rdi
je 0x1401270ba
test byte [rbx + 0x1c], 1
je 0x1401270ba
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x25
mov qword [rsp + 0x20], r12
lea r8, [0x140261908]
mov rcx, qword [rbx + 0x10]
call fcn.140006c90
mov rbx, qword [0x1402a8360]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x50]
call fcn.1401e7e40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x50], rsi
test r12, r12
je 0x1401276fb
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x68]
lea rdx, [rbp - 0x40]
mov rcx, r8
call qword [case.0x1400136d6.0]
lea rcx, [rsp + 0x40]
cmp rcx, rax
je 0x140127156
mov r15, qword [rax]
mov qword [rsp + 0x40], r15
mov rdi, qword [rax + 8]
mov qword [rsp + 0x48], rdi
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x50], rsi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x140127160
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x1401271d4
mov r14, qword [rbp - 0x38]
cmp rbx, r14
je 0x140127187
mov rcx, rbx
call fcn.1400048a0
add rbx, 0x20
cmp rbx, r14
jne 0x140127172
mov rbx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1401271b7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140127892
mov rcx, rbx
call fcn.1400079c0
mov qword [rbp - 0x40], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov r14, qword [rsp + 0x68]
cmp r15, rdi
je 0x1401276ab
xor esi, esi
movabs rdx, 0x7fffffffffffffff
movabs rax, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov rsi, r15
cmp qword [r15 + 0x18], 8
jb 0x14012720f
mov rsi, qword [r15]
mov rdi, qword [r15 + 0x10]
cmp rdi, rax
ja 0x1401278b5
mov qword [rbp - 8], 7
cmp rdi, 8
jae 0x140127242
mov qword [rbp - 0x10], rdi
mov r8d, reloc.WSOCK32.dll_recv
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.1401e7770
jmp 0x14012729b
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x140127256
mov rbx, rax
mov rcx, rdx
jmp 0x140127270
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, rdx
ja 0x1401278af
lfence
add rcx, rcx
call fcn.140006010
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1401e7770
nop
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.SOFTWARECANON_
mov qword [rsp + 0x20], rax
lea r9, [0x1402528f8]
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x260]
call fcn.140051530
lea rax, vtable.CMap_class_ATL::CStringT_unsigned_short_int__class_StrTraitMFC_unsigned_short_int__class_ATL::ChTraitsCRT_unsigned_short_int_____unsigned_short_int_const____ptr64__unsigned_char____ptr64__unsigned_char____ptr64_.0
mov qword [rsp + 0x78], rax
xor esi, esi
mov qword [rbp - 0x80], rsi
mov dword [rbp - 0x78], reloc.COMCTL32.dll_InitCommonControls
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14026f400]
movdqa xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
lfence
lea ecx, [rsi + 0x48]
call fcn.1401baa78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x70], rsi
test r14, r14
je 0x140127634
mov rcx, qword [rbp - 0x70]
mov rax, rcx
neg rax
sbb rdi, rdi
test rcx, rcx
je 0x140127495
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14012789e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140127898
mov rsi, rdi
test rdi, rdi
je 0x140127898
mov r8d, dword [rbp - 0x78]
cmp rdi, 0xffffffffffffffff
jne 0x1401273bd
xor ecx, ecx
test r8d, r8d
je 0x1401273bd
mov rsi, qword [r9 + rcx*8]
test rsi, rsi
jne 0x1401273bd
inc ecx
cmp ecx, r8d
jb 0x1401273a4
test rsi, rsi
je 0x140127898
mov rdi, qword [rsi + 0x10]
test rdi, rdi
jne 0x1401273e5
xor edx, edx
mov eax, dword [rsi + 0x18]
div r8d
inc edx
cmp edx, r8d
jae 0x1401273e5
mov rdi, qword [r9 + rdx*8]
test rdi, rdi
jne 0x1401273e5
inc edx
cmp edx, r8d
jb 0x1401273d5
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea r14, [rbx - 0x18]
cmp rcx, r14
je 0x140127450
cmp dword [r14 + 0x10], 0
jl 0x14012743d
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x14012743d
call fcn.140004d00
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x140127432
lfence
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
jmp 0x140127450
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140004e60
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14012745f
call fcn.1400079c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140127485
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
test rdi, rdi
jne 0x140127353
mov r14, qword [rsp + 0x68]
xor esi, esi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140127508
mov edi, esi
mov edx, dword [rbp - 0x78]
test edx, edx
je 0x1401274ff
nop word [rax + rax]
mov eax, edi
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1401274f9
nop dword [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401274e9
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401274c0
mov edx, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
inc edi
cmp edi, edx
jb 0x1401274b0
call fcn.1400079c0
mov qword [rbp - 0x80], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov rcx, qword [rbp - 0x60]
call fcn.1401bc020
mov qword [rbp - 0x60], rsi
mov rbx, qword [rbp - 0x50]
mov r8, qword [rbx + 8]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140008f00
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rbp - 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x260]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x140127634
mov ebx, esi
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x58], 0x208
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140127637
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x50]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140127637
lea rdx, [rbp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1401275d4
inc ebx
jmp 0x140127580
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1401275e8
lea rdx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp rcx, rax
je 0x140127637
test byte [rcx + 0x1c], 4
je 0x140127637
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x26
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [0x140261908]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
jmp 0x140127637
mov r14d, esi
lea rcx, [rsp + 0x70]
call fcn.140007a90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140127682
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012767d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401278a9
call fcn.1400079c0
add r15, 0x20
mov rdi, qword [rsp + 0x48]
cmp r15, rdi
je 0x14012769a
mov r14, qword [rsp + 0x68]
jmp 0x1401271df
mov rsi, qword [rsp + 0x50]
mov rbx, qword [0x1402a8360]
jmp 0x140127740
mov rbx, qword [0x1402a8360]
lea rax, [0x1402a8360]
cmp rbx, rax
je 0x1401276f3
test byte [rbx + 0x1c], 4
je 0x1401276f3
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x27
lea r8, [0x140261908]
mov rcx, qword [rbx + 0x10]
call fcn.140001ad0
mov rbx, qword [0x1402a8360]
mov r14d, MsiOpenDatabaseW
jmp 0x140127745
cmp rbx, rdi
je 0x140127735
test byte [rbx + 0x1c], 4
je 0x140127735
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x28
lea r8, [0x140261908]
mov rcx, qword [rbx + 0x10]
call fcn.140001ad0
mov rbx, qword [0x1402a8360]
mov r14d, MsiOpenDatabaseW
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov byte [rbp + 8], 1
lea rax, [0x1402a8360]
cmp rbx, rax
je 0x14012778f
test byte [rbx + 0x1c], 1
je 0x14012778f
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x29
mov dword [rsp + 0x20], r14d
lea r8, [0x140261908]
mov rcx, qword [rbx + 0x10]
call fcn.140001b40
mov rbx, qword [0x1402a8360]
test r15, r15
je 0x1401277ef
mov rbx, r15
cmp r15, rdi
je 0x1401277b1
nop dword [rax]
mov rcx, rbx
call fcn.1400048a0
add rbx, 0x20
cmp rbx, rdi
jne 0x1401277a0
sub rsi, r15
and rsi, 0xffffffffffffffe0
mov rax, r15
cmp rsi, 0x1000
jb 0x1401277dd
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012788c
mov rdx, rsi
mov rcx, r15
call fcn.1400079c0
mov rbx, qword [0x1402a8360]
lea rax, vtable.WppTrace.0
mov qword [rbp], rax
cmp byte [rbp + 8], 0
jne 0x14012784d
lea rax, [0x1402a8360]
cmp rbx, rax
je 0x14012784d
test byte [rbx + 0x1c], 1
je 0x14012784d
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rbx + 0x10]
call fcn.140006c90
lea rcx, [rbp + 0x30]
call fcn.1400048a0
lea rcx, [rbp + 0x10]
call fcn.1400048a0
mov eax, r14d
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.1401e2900
mov rbx, qword [rsp + 0x5c0]
add rsp, 0x580
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401ec41c
nop
call fcn.1401ec41c
nop
call fcn.1401bb848
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401ec41c
int3
call fcn.1400019f0
int3
call fcn.140001a90
int3