Function at 0x10000618c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r14d, r14d
mov rbx, rdx
mov ebp, r14d
mov esi, r14d
mov dword [rax + 8], r14d
mov rdi, r14
cmp rcx, r14
je 0x1000061db
mov qword [rax - 0x78], rdx
mov rdx, rcx
mov r9d, 0x2001f
mov rcx, 0xffffffff80000003
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x1000189d5
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov r12d, 1
cmp eax, r14d
jne 0x10000626a
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, 0x7a
jne 0x10000625f
mov ecx, dword [rsp + 0xa0]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
cmp rax, r14
je 0x10000625f
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
mov r8, rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, r14d
cmove ebp, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx]
lea r13, [rbx + 0x10]
mov r12, rax
lea rax, [rsp + 0xb0]
lea r9, [0x1000758a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea rdx, [0x100075950]
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x1000063e6
cmp ebp, r14d
je 0x1000062d4
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rax, [rsp + 0xb0]
lea r13, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea r9, [0x1000758a0]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionPrinterPorts
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x1000063e6
cmp ebp, r14d
je 0x100006336
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rbp, [rbx + 8]
lea rdx, [0x1000759c0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x1000063e6
mov rcx, qword [rbp]
lea rax, [rsp + 0xb8]
lea rsi, [rbx + 0x446]
mov qword [rsp + 0x28], rax
lea rdx, [0x100075890]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rbx + 0x20], r14d
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x28], r14d
mov dword [rbx + 0x2c], r14d
mov dword [rbx + 0x30], r14d
mov dword [rsp + 0xb8], 0x410
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1000063bc
mov dword [rbx + 0x24], 1
cmp dword [rbx + 0x24], r14d
je 0x1000063e1
mov edx, 0x2c
mov rcx, rsi
mov word [rbx + 0x854], r14w
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r14
je 0x1000063e1
mov word [rax], r14w
mov esi, 1
cmp r12, r14
je 0x1000063f3
mov rcx, r12
call sym.spoolsv.exe_PrvImpersonatePrinterClient
cmp rdi, r14
je 0x100006400
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp esi, r14d
je 0x10000af9c
mov eax, esi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.100006028
nop
jmp 0x100006409
mov qword [rbx], r14
jmp 0x10000af9c