Function at 0x1400066c0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd8
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp - 1], rax
mov r15, qword [rbp + 0x77]
lea rax, [0x1400c8f30]
xor r13d, r13d
mov qword [rbp - 0x29], rdx
mov dword [rbp - 0x61], r8d
mov r14, r9
mov qword [rbp - 0x59], r13
mov esi, r13d
mov dword [rbp - 0x21], 0x20676572
mov r12d, r13d
mov qword [rbp - 0x19], rax
lea rbx, [r13 - 1]
mov qword [rbp - 0x11], r13
lea rdi, [0x1400c72a8]
mov dword [rbp - 9], 0x80004005
test rcx, rcx
je 0x140006752
cmp word [rcx], r13w
je 0x140006752
call fcn.140075aac
test eax, eax
mov ebx, 0x8007007b
cmovne ebx, r13d
test ebx, ebx
js 0x140006abe
lea rbx, [r13 - 1]
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r12d, 1
mov qword [rbp - 0x31], r13
lea r9, [rbp - 0x69]
mov qword [rbp - 0x69], r13
movzx r8d, r12b
lea edx, [r12 + 3]
lea rcx, [r12 - 3]
call qword [sym.imp.ntdll.dll_NtOpenThreadToken]
nop dword [rax + rax]
test eax, eax
js 0x1400067b6
lea r9d, [r12 + 7]
lea r8, [rbp - 0x31]
lea edx, [r12 + 4]
lea rcx, [r12 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
nop dword [rax + rax]
jmp 0x1400067d5
cmp eax, 0xc000007c
jne 0x1400067e7
lea r8, [rbp - 0x69]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
nop dword [rax + rax]
test eax, eax
js 0x1400067e7
mov rsi, qword [rbp - 0x69]
test rsi, rsi
je 0x140006855
mov ebx, r13d
jmp 0x14000685c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400c72a8]
cmp rax, rdi
je 0x140006840
test byte [rax + 0x44], 0x20
je 0x140006840
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea r8, [0x1400aa820]
mov edx, 0x13
mov r9d, eax
mov rcx, qword [rcx + 0x38]
call fcn.14001c1f8
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x140006855
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
call fcn.1400320a8
mov ebx, eax
test ebx, ebx
js 0x140006abe
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140006879
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, 0x7e
call fcn.14000ecd8
mov rdi, rax
test rax, rax
je 0x1400068cf
lea r9, str.SoftwareMicrosoftWindows_NTCurrentVersionPrintConnections
mov edx, 0x3f
mov rcx, rax
call fcn.1400109d0
mov ebx, eax
test eax, eax
js 0x1400068d4
mov rcx, qword [rbp - 0x19]
lea rax, [0x1400c8f30]
cmp rcx, rax
je 0x1400068c6
lea rax, [0x1400c8f32]
cmp rcx, rax
je 0x1400068c6
call fcn.14000eccc
mov qword [rbp - 0x19], rdi
mov rdi, r13
jmp 0x1400068ec
mov ebx, 0x8007000e
lea rax, [0x1400c8f30]
cmp rdi, rax
je 0x1400068f4
lea rax, [0x1400c8f32]
cmp rdi, rax
je 0x1400068f4
mov rcx, rdi
call fcn.14000eccc
mov dword [rbp - 9], ebx
test ebx, ebx
js 0x140006abe
mov rdx, qword [rbp - 0x19]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x11]
mov dword [rbp - 0x69], r13d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x14000694f
mov dword [rbp - 9], eax
jmp 0x14000695b
movzx ebx, ax
or ebx, 0x80070000
mov dword [rbp - 9], ebx
test ebx, ebx
js 0x140006abe
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov dword [rbp - 0x39], ebx
mov qword [rbp - 0x51], rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400069fc
mov ecx, dword [rbp - 0x3d]
mov eax, 2
inc ecx
mov edx, ecx
mul rdx
mov dword [rbp - 0x3d], ecx
lea rdx, [0x1400c8f28]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140010278
mov r8, rax
mov qword [rbp - 0x49], rax
test r8, r8
mov eax, 0xe
cmove ebx, eax
jmp 0x140006a00
mov r8, qword [rbp - 0x49]
mov ecx, ebx
call fcn.1400083f0
mov dword [rbp - 0x39], eax
mov ebx, eax
test eax, eax
jns 0x140006a19
cmp ax, 0x103
jne 0x140006a19
mov ebx, r13d
mov eax, dword [rbp - 0x3d]
lea r9, [rbp - 0x69]
mov rcx, qword [rbp - 0x51]
xor edx, edx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x69], eax
mov dword [rbp - 0x41], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400083f0
mov dword [rbp - 0x39], eax
mov edi, 0x80000000
nop dword [rax]
test eax, eax
js 0x140006ab5
lea eax, [rbx + rdi]
test edi, eax
jne 0x140006a73
cmp ebx, 0x8007007a
jne 0x140006ab5
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.14008142c
mov ebx, eax
test eax, eax
js 0x140006aa7
mov rdx, qword [rbp - 0x59]
lea r9, [rbp - 0x61]
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 0x29]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call fcn.140073400
mov ebx, eax
lea rcx, [rbp - 0x51]
call fcn.140081ad4
mov eax, dword [rbp - 0x39]
jmp 0x140006a60
mov rcx, qword [rbp - 0x49]
call fcn.14001026c
test r12d, r12d
je 0x140006ad6
lea rcx, [0x1400c8ed8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, r13d
test rsi, rsi
je 0x140006b49
mov qword [rbp - 0x59], rsi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 4
lea r8, [rbp - 0x61]
mov edi, eax
mov rcx, rsi
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov ecx, edi
test eax, eax
je 0x140006bab
cmp dword [rbp - 0x61], 2
je 0x140006bab
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, r13d
mov rcx, qword [rbp - 0x11]
test ebx, ebx
cmovns ebx, eax
test rcx, rcx
je 0x140006b67
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x11], r13
mov rcx, qword [rbp - 0x19]
lea rax, [0x1400c8f30]
cmp rcx, rax
je 0x140006b88
lea rax, [0x1400c8f32]
cmp rcx, rax
je 0x140006b88
call fcn.14000eccc
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14000f060
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r9d, 8
lea r8, [rbp - 0x59]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
nop dword [rax + rax]
test eax, eax
jns 0x140006b36
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400c72a8]
lea rcx, [0x1400c72a8]
cmp rax, rcx
je 0x140006c40
test byte [rax + 0x44], 0x20
je 0x140006c40
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea r8, [0x1400aa820]
mov edx, 0x14
mov r9d, eax
mov rcx, qword [rcx + 0x38]
call fcn.14001c1f8
call fcn.1400320a8
jmp 0x140006b49