Function at 0x40dbbe
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a0
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x59c]
xor ecx, ecx
push eax
push 0xf003f
push ecx
push str.SYSTEMCurrentControlSetControlPrintPrinters
push reloc.OLEAUT32.dll_SysReAllocString
mov bl, cl
mov dword [ebp - 0x59c], ecx
mov dword [ebp - 0x594], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40defe
push esi
push 0x104
lea eax, [ebp - 0x108]
xor esi, esi
push eax
push esi
jmp 0x40dee9
lea eax, [ebp - 0x594]
inc esi
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x5a0], esi
push eax
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dedc
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x80
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x598]
push eax
push 0
push str.Port
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dec7
push 3
lea eax, [ebp - 0x188]
push 0x5080a0
push eax
call fcn.004cbf60
add esp, 0xc
test eax, eax
je 0x40dec7
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x400
push eax
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0x598]
push eax
push 0
push str.DeviceInterfaceId
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dec7
mov eax, dword [0x51e8d0]
jmp 0x40dd80
push 0xa
lea ecx, [ebp - 0x58c]
push ecx
push eax
call fcn.004cd831
mov ecx, dword [ebp - 0x58c]
add esp, 0xc
inc ecx
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x58c], ecx
cmp eax, 1
jne 0x40dd33
push 0
mov edx, str.4D36E979_E325_11CE_BFC1_08002BE10318
call fcn.0040daa2
pop ecx
test al, al
jne 0x40de40
mov eax, dword [ebp - 0x598]
mov ecx, dword [ebp - 0x58c]
cmp eax, 2
jne 0x40dd70
push 1
lea edx, [ebp - 0x108]
call fcn.0040daa2
pop ecx
test al, al
jne 0x40de40
mov ecx, dword [ebp - 0x58c]
lea edx, [ebp - 0x588]
push 1
call fcn.0040daa2
pop ecx
test al, al
jne 0x40de40
mov ecx, dword [ebp - 0x58c]
push ecx
call fcn.004c8d20
pop ecx
mov ecx, dword [ebp - 0x58c]
inc ecx
add eax, ecx
mov dword [ebp - 0x58c], eax
cmp byte [eax], 0
jne 0x40dce8
mov eax, dword [0x51e8d8]
jmp 0x40de31
push 0xa
lea ecx, [ebp - 0x58c]
push ecx
push eax
call fcn.004cd831
mov ecx, dword [ebp - 0x58c]
add esp, 0xc
inc ecx
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x58c], ecx
cmp eax, 1
jne 0x40dde4
push 0
mov edx, str.4D36E979_E325_11CE_BFC1_08002BE10318
call fcn.0040daa2
pop ecx
test al, al
jne 0x40df33
mov eax, dword [ebp - 0x598]
mov ecx, dword [ebp - 0x58c]
cmp eax, 2
jne 0x40de21
push 1
lea edx, [ebp - 0x108]
call fcn.0040daa2
pop ecx
test al, al
jne 0x40df33
mov ecx, dword [ebp - 0x58c]
lea edx, [ebp - 0x588]
push 1
call fcn.0040daa2
pop ecx
test al, al
jne 0x40df33
mov ecx, dword [ebp - 0x58c]
push ecx
call fcn.004c8d20
pop ecx
mov ecx, dword [ebp - 0x58c]
inc ecx
add eax, ecx
mov dword [ebp - 0x58c], eax
cmp byte [eax], 0
jne 0x40dd99
mov eax, 0x800
push eax
mov dword [ebp - 0x590], eax
call fcn.004c8d06
mov esi, eax
mov dword [ebp - 0x590], 0x800
pop ecx
test esi, esi
je 0x40deba
lea eax, [ebp - 0x590]
push eax
push esi
lea eax, [ebp - 0x598]
push eax
push 0
push str.SecurityDenied
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40deba
push dword [ebp - 0x590]
push esi
push dword [ebp - 0x598]
push eax
push str.Security
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.SecurityDenied
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov bl, 1
push esi
call fcn.004c8ceb
mov esi, dword [ebp - 0x5a0]
pop ecx
cmp dword [ebp - 0x594], 0
je 0x40dedc
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x40dc1c
pop esi
cmp dword [ebp - 0x59c], 0
je 0x40df13
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
je 0x40df27
call fcn.0040cba8
mov ecx, str.spooler
call fcn.0040cc88
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d307
leave
ret
mov eax, 0x800
push eax
mov dword [ebp - 0x590], eax
call fcn.004c8d06
mov esi, eax
mov dword [ebp - 0x590], 0x800
pop ecx
test esi, esi
je 0x40deba
lea eax, [ebp - 0x590]
push eax
push esi
lea eax, [ebp - 0x598]
push eax
push 0
push str.Security
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40deba
push dword [ebp - 0x590]
push esi
push dword [ebp - 0x598]
push eax
push str.SecurityDenied
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.Security
push dword [ebp - 0x594]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edx, [ebp - 0x108]
mov bl, 1
call fcn.0040db40
jmp 0x40deba