Function at 0x14005f360
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r13d, r13d
mov rbx, r8
mov r12d, r13d
mov qword [rbp - 8], r13
mov edi, r13d
mov dword [rbp + 0x58], r13d
mov esi, r13d
mov r15d, r13d
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
lea rcx, [0x1400aaa28]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
test rbx, rbx
je 0x14005f546
cmp word [rbx], r13w
je 0x14005f546
mov qword [rsp + 0x40], r13
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rdx, str.SystemCurrentControlSetControlPrintProviders
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x3001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x14005f3fb
mov ecx, eax
jmp 0x14005f54b
mov rcx, qword [rbp - 8]
mov rdx, rbx
call fcn.14005e730
mov r14, rax
test rax, rax
je 0x14005f551
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.Order
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov dword [rbp + 0x50], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14005f3f4
mov ecx, dword [rbp + 0x50]
test ecx, ecx
je 0x14005f551
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x14005f551
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.Order
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14005f3f4
mov edx, dword [rbp + 0x50]
lea r9, [rbp - 0x10]
mov r8, rbx
mov rcx, rdi
call fcn.1400611ac
mov rsi, rax
test rax, rax
je 0x14005f551
mov eax, dword [rbp - 0x10]
lea rdx, str.Order
mov rcx, qword [rbp - 8]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x14005f3f4
mov rdx, rbx
lea rcx, str.LanMan_Print_Services
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14005f4fc
mov rcx, qword [rbp - 8]
lea r9, [rbp + 0x58]
call fcn.140060f10
test eax, eax
sete r15b
mov rcx, qword [rbp - 8]
mov rdx, rbx
call fcn.140060d84
test r15d, r15d
je 0x14005f51a
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 8]
call fcn.140061298
mov rcx, qword [0x1400aad38]
cmp qword [rcx], r13
je 0x14005f53e
mov rax, qword [rcx]
cmp rax, r14
je 0x14005f538
mov rcx, rax
cmp qword [rax], r13
jne 0x14005f526
jmp 0x14005f53e
mov rax, qword [r14]
mov qword [rcx], rax
mov r12d, 1
jmp 0x14005f564
mov ecx, 0x57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jne 0x14005f564
lea ecx, [rax + 8]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
test rdi, rdi
je 0x14005f571
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
test rsi, rsi
je 0x14005f57e
mov rcx, rsi
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14005f58d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, [0x1400aaa28]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0xa0]
mov eax, r12d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret