Function at 0x140003bb0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd8
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp - 9], rax
mov r12, qword [rbp + 0x77]
lea rax, [0x1400c8ea0]
xor r13d, r13d
mov qword [rbp - 0x31], rdx
mov dword [rbp - 0x61], r8d
mov r15, r9
mov qword [rbp - 0x59], r13
mov esi, r13d
mov dword [rbp - 0x29], 0x20676572
mov r14d, r13d
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x11], 0x80004005
test rcx, rcx
jne 0x140010c66
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r14d, 1
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rsi, rax
test rax, rax
je 0x140010c75
mov edi, r13d
test edi, edi
js 0x140003e41
mov rcx, qword [rbp - 0x19]
test rcx, rcx
jne 0x140010c81
mov ecx, 0x7e
call fcn.14000d114
mov rbx, rax
test rax, rax
je 0x140010cbd
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionPrintConnections
mov edx, 0x3f
sub r8, rax
mov edi, r13d
lea rcx, [rdx + 0x7fffffbf]
test rcx, rcx
je 0x140003cb4
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140003cab
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140003c83
jmp 0x140010c93
test rdx, rdx
je 0x140010c93
mov word [rax], r13w
lea rax, [0x1400c8ea0]
mov rcx, qword [rbp - 0x21]
cmp rcx, rax
jne 0x140010ca2
mov qword [rbp - 0x21], rbx
mov rbx, r13
mov rcx, rbx
call fcn.14000d154
mov dword [rbp - 0x11], edi
test edi, edi
js 0x140003e41
mov rdx, qword [rbp - 0x21]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x19]
mov dword [rbp - 0x69], r13d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jg 0x140010cc7
mov dword [rbp - 0x11], eax
test edi, edi
js 0x140003e41
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov dword [rbp - 0x39], edi
mov qword [rbp - 0x51], rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140010ce2
mov ecx, dword [rbp - 0x3d]
mov eax, 2
inc ecx
mov edx, ecx
mul rdx
mov dword [rbp - 0x3d], ecx
lea rdx, [0x1400c8e88]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000e6c8
mov qword [rbp - 0x49], rax
mov r8, rax
test rax, rax
je 0x140010cd8
mov ecx, ebx
call fcn.140006040
mov dword [rbp - 0x39], eax
mov edi, eax
test eax, eax
js 0x140010ceb
mov eax, dword [rbp - 0x3d]
lea r9, [rbp - 0x69]
mov rcx, qword [rbp - 0x51]
xor edx, edx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x69], eax
mov dword [rbp - 0x41], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ecx, eax
call fcn.140006040
mov dword [rbp - 0x39], eax
mov ebx, 0x80000000
test eax, eax
jns 0x140010cfd
mov rcx, qword [rbp - 0x49]
call fcn.14000e6bc
test r14d, r14d
je 0x140003e59
lea rcx, [0x1400c8e38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ebx, r13d
test rsi, rsi
je 0x140003eef
mov qword [rbp - 0x59], rsi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 4
lea r8, [rbp - 0x61]
mov ebx, eax
mov rcx, rsi
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
mov ecx, ebx
test eax, eax
jne 0x140010d55
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r9d, 8
lea r8, [rbp - 0x59]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
nop dword [rax + rax]
test eax, eax
js 0x140010d71
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ebx, r13d
test edi, edi
js 0x140010ddd
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140003f10
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x19], r13
mov rcx, qword [rbp - 0x21]
lea rax, [0x1400c8ea0]
cmp rcx, rax
je 0x140003f31
lea rax, [0x1400c8ea2]
cmp rcx, rax
je 0x140003f31
call fcn.14000d154
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000d4b0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007542c
test eax, eax
mov edi, 0x8007007b
cmovne edi, r13d
test edi, edi
jns 0x140003c19
jmp 0x140003e41
lea rax, [0x1400c8ea0]
cmp rbx, rax
je 0x140003cdb
lea rax, [0x1400c8ea2]
cmp rbx, rax
jne 0x140003cd3
jmp 0x140003cdb
cmp word [rcx], r13w
je 0x140003c19
jmp 0x140003f54
call fcn.140031a88
mov edi, eax
jmp 0x140003c46
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x140003c5b
mov word [rax - 2], r13w
mov edi, 0x8007007a
jmp 0x140003f71
lea rax, [0x1400c8ea2]
cmp rcx, rax
je 0x140003ccc
call fcn.14000d154
nop
jmp 0x140003ccc
mov edi, 0x8007000e
jmp 0x140003f71
movzx edi, ax
or edi, 0x80070000
mov dword [rbp - 0x11], edi
jmp 0x140003d38
mov ebx, 0xe
jmp 0x140003dd9
mov r8, qword [rbp - 0x49]
jmp 0x140003dd9
cmp ax, 0x103
jne 0x140003ded
mov edi, r13d
jmp 0x140003ded
lea eax, [rdi + rbx]
test ebx, eax
jne 0x140010d10
cmp edi, 0x8007007a
jne 0x140003e38
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.140080e6c
mov edi, eax
test eax, eax
js 0x140010d44
mov rdx, qword [rbp - 0x59]
lea r9, [rbp - 0x61]
mov rcx, qword [rbp - 0x19]
lea r8, [rbp - 0x31]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.140072d80
mov edi, eax
lea rcx, [rbp - 0x51]
call fcn.140081514
mov eax, dword [rbp - 0x39]
jmp 0x140003e30
cmp dword [rbp - 0x61], 2
je 0x140003ea7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
jmp 0x140003edc
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400c72a8]
lea rcx, [0x1400c72a8]
cmp rax, rcx
je 0x140010dd1
test byte [rax + 0x44], 0x20
je 0x140010dd1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea r8, [0x1400aa900]
mov edx, 0x14
mov r9d, eax
mov rcx, qword [rcx + 0x38]
call fcn.140016318
call fcn.140031a88
mov ebx, eax
jmp 0x140003eef
mov ebx, edi
jmp 0x140003ef7