Function at 0x14017e030
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
mov rbx, rdx
lea rdx, str.CBaseSeqPrinterDriver::bWriteRegistryInitSet
lea rcx, [rsp + 0x70]
call fcn.14001abe0
nop
lea rax, [0x1402a8360]
lea r13, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rax
je 0x14017e0c5
test byte [rcx + 0x1c], 1
je 0x14017e0c5
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x23
lea r8, [0x1402669d8]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor edx, edx
lea r15d, [rdx + 1]
mov r8d, 0x618
lea rcx, [rbp - 0x40]
call fcn.1401e7e40
xor esi, esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x14017e4f3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r12, [rsi - 1]
test rbx, rbx
je 0x14017e13d
cmp rbx, 0x10000
jae 0x14017e12e
movzx edx, bx
lea rcx, [rsp + 0x30]
call fcn.1400041d0
jmp 0x14017e150
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x14017e131
jmp 0x14017e13f
mov eax, esi
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140004e60
nop
xor r14b, r14b
mov rbx, qword [rsp + 0x30]
movsxd rdi, dword [rbx - 0x10]
mov eax, esi
test edi, edi
jle 0x14017e1d7
mov edx, 0x2c
nop word [rax + rax]
cdqe
lea rsi, [rax + rax]
cmp word [rsi + rbx], 0x5c
jne 0x14017e1b1
test r14b, r14b
jne 0x14017e1ad
mov r14b, 1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14017e1ad
lfence
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140004e00
mov rbx, qword [rsp + 0x30]
mov edx, 0x2c
mov word [rsi + rbx], dx
lea rax, [rsi + 2]
sar rax, 1
cmp eax, edi
jl 0x14017e170
test r14b, r14b
je 0x14017e1d7
cmp edi, dword [rbx - 0xc]
jg 0x14017e4fe
mov dword [rbx - 0x10], edi
xor r14d, r14d
mov word [rbx + rdi*2], r14w
jmp 0x14017e1da
xor r14d, r14d
mov r8, rbx
lea rdx, str._sPrinterDriverData
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x1400136d6.0]
mov rsi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov rdi, qword [rax + 8]
sub rdi, qword [rax]
sar rdi, 4
test rdi, rdi
je 0x14017e287
movabs rax, 0xfffffffffffffff
cmp rdi, rax
ja 0x14017e509
lfence
shl rdi, 4
mov rcx, rdi
call fcn.140006010
mov r8, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
add rax, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x38]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
call fcn.14001ab10
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], r14
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlPrintPrinters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14017e35a
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14017e34a
mov rdi, qword [rsp + 0x38]
cmp rdi, qword [rsp + 0x40]
je 0x14017e332
nop dword [rax + rax]
mov rsi, qword [rdi + 8]
mov r14, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, r15d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rdi, 0x10
cmp rdi, qword [rsp + 0x40]
jne 0x14017e2f0
xor r14d, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14017e35d
mov r15d, r14d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14017e35d
mov r15d, r14d
mov byte [rsp + 0x78], 1
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
cmp rcx, rsi
je 0x14017e3a8
test byte [rcx + 0x1c], 1
je 0x14017e3a8
mov r9, r13
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x24
mov dword [rsp + 0x20], r15d
lea r8, [0x1402669d8]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14017e424
mov rsi, qword [rsp + 0x40]
cmp rdi, rsi
je 0x14017e3d6
nop dword [rax]
mov rcx, rdi
call fcn.14001a770
add rdi, 0x10
cmp rdi, rsi
jne 0x14017e3c0
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rdx, rdi
and rdx, 0xfffffffffffffff0
mov rax, rdi
cmp rdx, 0x1000
jb 0x14017e407
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017e4ed
mov rcx, rdi
call fcn.1400079c0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
lea rsi, [0x1402a8360]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x14017e448
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rsp + 0x70], rax
cmp byte [rsp + 0x78], 0
jne 0x14017e4a8
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x14017e4a8
test byte [rcx + 0x1c], 1
je 0x14017e4a8
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r8, qword [rbp - 0x80]
cmp qword [0x1402bbdc8], 8
cmovae r13, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], r8
mov r9, r13
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rbp - 0x60]
call fcn.1400048a0
lea rcx, [rbp - 0x80]
call fcn.1400048a0
mov eax, r15d
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401ec41c
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80070057
call fcn.140001470
int3
call fcn.140006080
int3