Function at 0x100006100
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r14d, r14d
mov rbx, rdx
mov ebp, r14d
mov esi, r14d
mov dword [rax + 8], r14d
mov rdi, r14
cmp rcx, r14
je 0x10000614f
mov qword [rax - 0x78], rdx
mov rdx, rcx
mov r9d, 0x2001f
mov rcx, 0xffffffff80000003
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100018a48
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov r12d, 1
cmp eax, r14d
jne 0x1000061de
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, 0x7a
jne 0x1000061d3
mov ecx, dword [rsp + 0xa0]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
cmp rax, r14
je 0x1000061d3
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
mov r8, rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, r14d
cmove ebp, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx]
lea r13, [rbx + 0x10]
mov r12, rax
lea rax, [rsp + 0xb0]
lea r9, [0x1000758a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea rdx, [0x100075950]
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x10000635a
cmp ebp, r14d
je 0x100006248
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rax, [rsp + 0xb0]
lea r13, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea r9, [0x1000758a0]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionPrinterPorts
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x10000635a
cmp ebp, r14d
je 0x1000062aa
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rbp, [rbx + 8]
lea rdx, [0x1000759c0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10000635a
mov rcx, qword [rbp]
lea rax, [rsp + 0xb8]
lea rsi, [rbx + 0x446]
mov qword [rsp + 0x28], rax
lea rdx, [0x100075890]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rbx + 0x20], r14d
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x28], r14d
mov dword [rbx + 0x2c], r14d
mov dword [rbx + 0x30], r14d
mov dword [rsp + 0xb8], 0x410
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x100006330
mov dword [rbx + 0x24], 1
cmp dword [rbx + 0x24], r14d
je 0x100006355
mov edx, 0x2c
mov rcx, rsi
mov word [rbx + 0x854], r14w
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r14
je 0x100006355
mov word [rax], r14w
mov esi, 1
cmp r12, r14
je 0x100006367
mov rcx, r12
call sym.spoolsv.exe_PrvImpersonatePrinterClient
cmp rdi, r14
je 0x100006374
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp esi, r14d
je 0x10000b01c
mov eax, esi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.100005fa0
nop
jmp 0x10000637d
mov qword [rbx], r14
jmp 0x10000b01c