Function at 0x1000050a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r14d, r14d
mov rbx, rdx
mov ebp, r14d
mov esi, r14d
mov dword [rax + 8], r14d
mov rdi, r14
cmp rcx, r14
je 0x1000050ef
mov qword [rax - 0x78], rdx
mov rdx, rcx
mov r9d, 0x2001f
mov rcx, 0xffffffff80000003
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100018479
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov r12d, 1
cmp eax, r14d
jne 0x10000517e
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, 0x7a
jne 0x100005173
mov ecx, dword [rsp + 0xa0]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
cmp rax, r14
je 0x100005173
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0xa0]
lea edx, [r12 + 3]
mov r8, rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
cmp eax, r14d
cmove ebp, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx]
lea r13, [rbx + 0x10]
mov r12, rax
lea rax, [rsp + 0xb0]
lea r9, [0x100074930]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea rdx, [0x1000749e0]
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x1000052fa
cmp ebp, r14d
je 0x1000051e8
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rax, [rsp + 0xb0]
lea r13, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
lea r9, [0x100074930]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionPrinterPorts
xor r8d, r8d
mov dword [rsp + 0x28], 0x7001f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, r14d
jne 0x1000052fa
cmp ebp, r14d
je 0x10000524a
mov rcx, qword [r13]
mov r8, rdi
mov edx, 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
mov rcx, qword [rbx]
lea rbp, [rbx + 8]
lea rdx, [0x100074a50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x1000052fa
mov rcx, qword [rbp]
lea rax, [rsp + 0xb8]
lea rsi, [rbx + 0x446]
mov qword [rsp + 0x28], rax
lea rdx, [0x100074920]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rbx + 0x20], r14d
mov dword [rbx + 0x24], r14d
mov dword [rbx + 0x28], r14d
mov dword [rbx + 0x2c], r14d
mov dword [rbx + 0x30], r14d
mov dword [rsp + 0xb8], 0x410
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1000052d0
mov dword [rbx + 0x24], 1
cmp dword [rbx + 0x24], r14d
je 0x1000052f5
mov edx, 0x2c
mov rcx, rsi
mov word [rbx + 0x854], r14w
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r14
je 0x1000052f5
mov word [rax], r14w
mov esi, 1
cmp r12, r14
je 0x100005307
mov rcx, r12
call sym.spoolsv.exe_PrvImpersonatePrinterClient
cmp rdi, r14
je 0x100005314
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp esi, r14d
je 0x10000ac1c
mov eax, esi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.100004f34
nop
jmp 0x10000531d
mov qword [rbx], r14
jmp 0x10000ac1c