Function at 0x14002a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x6b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x6f0], rbx
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov r13, rdx
mov r12, rcx
call fcn.140015a10
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002a80c
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
call fcn.140069504
xor edx, edx
mov r8d, 0x618
lea rcx, [rsp + 0x80]
call fcn.140080d50
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002a857
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x38], rdi
or rsi, 0xffffffffffffffff
test r12, r12
je 0x14002a8b6
test r12, 0xffffffffffff0000
jne 0x14002a8a2
movzx ebp, r12w
mov ecx, ebp
call fcn.1400696b8
test rax, rax
je 0x14002a8cd
mov r8d, ebp
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003a40
mov rdi, qword [rsp + 0x38]
jmp 0x14002a8cd
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14002a8b8
xor ecx, ecx
mov r8d, ecx
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140003c40
mov rdi, qword [rsp + 0x38]
mov dx, 0x5c
mov rcx, rdi
call fcn.140080890
mov rbp, rax
test rax, rax
jne 0x14002a8e8
mov ebp, esi
jmp 0x14002aa4d
sub rbp, rdi
sar rbp, 1
test ebp, ebp
js 0x14002aa4d
lea r8d, [rbp + 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140003e50
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14002a964
cmp dword [rbx + 0x10], 0
jl 0x14002a955
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002a955
call fcn.1400031e0
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14002a94a
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x14002a964
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002a984
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r9d, [rbp - 2]
mov r8d, 2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140003560
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x38]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14002a9fd
cmp dword [rdi + 0x10], 0
jl 0x14002a9ee
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002a9ee
call fcn.1400031e0
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14002a9e3
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14002a9fd
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002aa1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov rdi, qword [rsp + 0x38]
mov r9, rdi
lea r8, str.SystemCurrentControlSetControlPrintPrinters
lea rdx, str._s___s__s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14002aa6c
mov r9, r12
lea r8, str.SystemCurrentControlSetControlPrintPrinters
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ab26
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Share_Name
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002aae0
mov word [r13], 0
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Attributes
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002ac6b
mov qword [rsp + 0x58], 0
xor edx, edx
mov r8d, 0x618
lea rcx, [rsp + 0x80]
call fcn.140080d50
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlPrintPrinters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002acfb
test ebp, ebp
js 0x14002ab94
mov r9, rbx
mov r8, rdi
lea rdx, str.___s__s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14002abad
mov r9d, 0x30c
mov r8, r12
mov rdx, r9
lea rcx, [rsp + 0x80]
call fcn.1400852d0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002acb0
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Share_Name
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002ac1f
mov word [r13], 0
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Attributes
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x50]
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ac8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14002aca9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x14002ad38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002acd8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14002acf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
or eax, 0xffffffff
jmp 0x14002ad38
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ad17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14002ad35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x6f0]
add rsp, 0x6b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret