Function at 0x14002a720
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov r13, rcx
xor r8d, r8d
lea rdx, str.Tool_DeleteRegKeyICA
lea rcx, [rbp - 0x18]
call fcn.14000b870
nop
lea r12, str.ICA_3.0
mov qword [rsp + 0x20], r12
mov r9, r13
lea r8, str.pRegRoot___s__pSubKey___s
mov esi, 1
mov edx, esi
lea rcx, [rbp - 0x18]
call fcn.14000ba50
call fcn.140050920
mov r14, qword [rax + 8]
xor ebx, ebx
mov qword [rbp - 0x38], rbx
mov dword [rbp + 0x50], esi
mov dword [rbp + 0x48], ebx
call fcn.14004cde4
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002a7b4
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r15, [0x14021131c]
mov rbx, r15
shr rbx, 0x10
test rbx, rbx
jne 0x14002a7f9
movzx edi, r15w
mov ecx, edi
call fcn.14004cbb8
test rax, rax
je 0x14002a809
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400012a0
jmp 0x14002a809
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.1400014d0
nop
call fcn.14004cde4
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002a828
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x40], rdi
test rbx, rbx
jne 0x14002a864
movzx r12d, r15w
mov ecx, r12d
call fcn.14004cbb8
test rax, rax
je 0x14002a879
mov r8d, r12d
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400012a0
mov rdi, qword [rbp - 0x40]
jmp 0x14002a879
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x40]
call fcn.1400014d0
mov rdi, qword [rbp - 0x40]
jmp 0x14002a880
lea r12, str.ICA_3.0
call fcn.14004cde4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002a89f
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
test rbx, rbx
jne 0x14002a8d6
movzx ebx, r15w
mov ecx, ebx
call fcn.14004cbb8
test rax, rax
je 0x14002a8e6
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.1400012a0
jmp 0x14002a8e6
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.1400014d0
nop
mov r9, r12
mov r8, r13
lea rdx, [0x140212328]
lea rcx, [rbp - 0x30]
call fcn.140006620
lea r11, [rbp - 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or r12, 0xffffffffffffffff
test eax, eax
jne 0x14002ab19
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ab0d
mov edx, dword [rbp + 0x48]
test edx, edx
jns 0x14002a96e
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, edx
or ecx, eax
jge 0x14002a989
lea rcx, [rbp - 0x40]
call fcn.1400015c0
mov rdi, qword [rbp - 0x40]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ab0d
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.14018f24c
test eax, eax
js 0x14002ab02
cmp eax, dword [rdi - 0xc]
jg 0x14002ab02
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r13w
lea rdx, [0x1402145dc]
lea rcx, [rbp - 0x28]
call fcn.140001110
nop
mov r8, qword [r14 + 0x810]
lea rdx, str.Canon__s
lea rcx, [rbp - 0x28]
call fcn.140006620
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.140190f4c
test rax, rax
je 0x14002aae1
mov rdx, rdi
lea rcx, [rbp + 0x58]
call fcn.14002ae20
xor eax, eax
mov rcx, r12
mov rbx, qword [rbp + 0x58]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
test edi, edi
jns 0x14002aa4b
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14002aa68
mov edx, edi
lea rcx, [rbp + 0x58]
call fcn.1400015c0
mov rbx, qword [rbp + 0x58]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0x50]
xor r8d, r8d
lea rdx, str.VirtualDriverEx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
test eax, eax
jne 0x14002aab9
call fcn.14018f24c
test eax, eax
js 0x14002aaae
cmp eax, dword [rbx - 0xc]
jg 0x14002aaae
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
jmp 0x14002aae1
mov ecx, 0x80070057
call fcn.140001000
int3
call fcn.14018f24c
test eax, eax
js 0x14002aad6
cmp eax, dword [rbx - 0xc]
jg 0x14002aad6
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov esi, r13d
jmp 0x14002aae1
mov ecx, 0x80070057
call fcn.140001000
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002ab0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002ab0d
mov ecx, 0x80070057
call fcn.140001000
int3
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002ab27
cmp eax, 2
je 0x14002ab27
cmp eax, 3
je 0x14002ab27
xor eax, eax
mov esi, eax
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x18]
call fcn.14000ba50
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002ab60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002ab80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14002aba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x18]
call fcn.14000ba00
mov eax, esi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret