Function at 0x10004b980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xf30
mov rax, qword [0x100080258]
xor rax, rsp
mov qword [rsp + 0xf20], rax
xor ebp, ebp
mov rdi, rcx
lea rcx, [r11 - 0xeb6]
lea r8d, [rbp + 0x4e]
xor edx, edx
mov ebx, ebp
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x80], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xd0], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2e2]
xor edx, edx
mov r8d, 0x616
mov word [rsp + 0x2e0], bp
call sub.msvcrt.dll_memset
lea edx, [rbp + 0x28]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x64], ebp
mov dword [rsp + 0x68], 2
call fcn.10004b86c
cmp eax, ebp
je 0x10004bd38
mov esi, 0x30c
cmp rdi, rbp
je 0x10004ba85
lea rax, [rsp + 0x2e0]
mov rdx, rsi
lea rcx, [rsp + 0x2e0]
sub rdi, rax
lea rax, [rdx + 0x7ffffcf2]
cmp rax, rbp
je 0x10004ba74
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x10004ba74
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10004ba52
cmp rdx, rbp
jne 0x10004ba82
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], bp
cmp ebx, ebp
mov r14d, 0x80070000
jl 0x10004bc71
lea rcx, [rsp + 0x2e0]
mov edx, 0x2c
call sub.msvcrt.dll_wcschr
cmp rax, rbp
je 0x10004baad
mov word [rax], bp
lea r8, str.PrintersDefaults
lea rax, [rsp + 0xd0]
mov edi, 0x104
lea rcx, [rsp + 0xd0]
mov ebx, ebp
sub r8, rax
mov rdx, rdi
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x10004baf4
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x10004baf4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10004bad1
cmp rdx, rbp
jne 0x10004bb02
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, ebp
mov word [rcx], bp
jl 0x10004bc71
lea r8, [0x10007a8e0]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
call fcn.100005bcc
cmp eax, ebp
mov ebx, eax
jl 0x10004bc71
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
call fcn.100005bcc
cmp eax, ebp
mov ebx, eax
jl 0x10004bc71
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jl 0x10004bc71
cmp dword [rsp + 0x68], 2
jne 0x10004bc03
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x900]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x64], 0x618
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10004bc03
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x900]
call sub.msvcrt.dll__wcsicmp
cmp eax, ebp
je 0x10004bc71
mov rax, rsi
lea rcx, [rsp + 0x2e0]
mov ebx, ebp
cmp word [rcx], bp
je 0x10004bc1f
add rcx, 2
sub rax, 1
jne 0x10004bc10
cmp rax, rbp
jne 0x10004bc2e
mov ebx, 0x80070057
mov rsi, rbp
jmp 0x10004bc34
sub rsi, rax
add rsi, rsi
cmp ebx, ebp
jl 0x10004bc71
mov rcx, qword [rsp + 0x70]
lea eax, [rsi + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0x2e0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movzx ebx, ax
or ebx, r14d
cmp eax, ebp
cmovle ebx, eax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x10004bc81
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, ebp
jl 0x10004bd38
lea rax, [rsp + 0x78]
lea rdx, str.PrintersDefaults
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], ebp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jl 0x10004bd28
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
movzx ebx, ax
or ebx, r14d
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jl 0x10004bd28
mov r8d, dword [rsp + 0x60]
mov edx, 0x1069
xor ecx, ecx
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, qword [rsp + 0x78]
cmp rcx, rbp
je 0x10004bd38
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0xf20]
xor rcx, rsp
call fcn.1000010b0
lea r11, [rsp + 0xf30]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret