Function at 0x415c30
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564b61
mov eax, dword fs:[0]
push eax
mov eax, 0x1085c
call fcn.00542ad0
mov eax, dword [0x5c0490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1085c]
mov esi, ecx
push str.Tool_VDCModuleUninstallCheck
push eax
mov dword [ebp - 0x10850], esi
call fcn.00401190
add esp, 0xc
push ebx
push esi
push str.lpszDriver___s__bDebug___d
lea ecx, [ebp - 0x1085c]
push 1
push ecx
mov dword [ebp - 4], ebx
call fcn.00401410
add esp, 0x14
push 0xfffe
lea edx, [ebp - 0x10420]
push ebx
push edx
mov dword [ebp - 0x1083c], ebx
call fcn.00541d20
add esp, 0xc
xor edi, edi
call fcn.00448c3f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x415cd3
push 0x80004005
call fcn.00404160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10838], eax
push 0x410
lea ecx, [ebp - 0x10830]
push ebx
push ecx
mov byte [ebp - 4], 1
call fcn.00541d20
add esp, 0xc
push 0x208
lea edx, [ebp - 0x218]
push ebx
push edx
mov dword [ebp - 0x10854], ebx
mov dword [ebp - 0x1084c], ebx
mov dword [ebp - 0x10834], ebx
call fcn.00541d20
add esp, 0xc
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00541d20
add esp, 0xc
mov dword [ebp - 0x10848], ebx
mov dword [ebp - 0x10864], ebx
mov dword [ebp - 0x10840], ebx
call fcn.0044b52d
mov eax, dword [eax + 4]
mov dword [ebp - 0x10868], eax
add eax, 0xe0
push eax
lea ecx, [ebp - 0x10838]
call fcn.004063a0
push 0xfffe
lea ecx, [ebp - 0x10420]
push ebx
push ecx
call fcn.00541d20
mov ecx, dword [ebp - 0x10838]
mov eax, dword [ecx - 0xc]
add esp, 0xc
lea edx, [eax + eax]
push edx
push ecx
lea eax, [ebp - 0x10420]
push eax
call fcn.005442b0
add esp, 0xc
lea ecx, [ebp - 0x10844]
push ecx
lea edx, [ebp - 0x10420]
push 0x5958e8
push edx
mov dword [ebp - 0x10844], ebx
call fcn.0053deaa
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x4161b5
mov eax, dword [ebp - 0x10850]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x415dfa
lea ecx, [ebp - 0x10844]
push ecx
push 0x5958e8
push ebx
call fcn.0053deaa
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x415dc8
jmp 0x4161b5
cmp esi, ebx
je 0x4161b5
mov esi, dword [sym.imp.WINSPOOL.DRV_EnumPrintersW]
lea edx, [ebp - 0x1084c]
push edx
lea eax, [ebp - 0x10854]
push eax
push ebx
push ebx
push 2
push ebx
push 6
call esi
cmp eax, ebx
jne 0x415e83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x415e83
push ebx
push str.return___08x
lea ecx, [ebp - 0x1085c]
push 2
push ecx
call fcn.00401410
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10838]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415e6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1085c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
xor eax, eax
jmp 0x416205
mov ecx, dword [ebp - 0x10854]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x10850], edi
cmp edi, ebx
je 0x4161b3
mov ecx, dword [ebp - 0x10854]
lea edx, [ebp - 0x1084c]
push edx
lea eax, [ebp - 0x10854]
push eax
push ecx
push edi
push 2
push ebx
push 6
call esi
cmp eax, 1
jne 0x415fe6
mov eax, dword [ebp - 0x1084c]
cmp eax, ebx
jbe 0x415fdc
mov dword [ebp - 0x10860], ebx
add edi, 0x10
nop
mov eax, dword [ebp - 0x10868]
add eax, 0xe0
push eax
lea ecx, [ebp - 0x10838]
call fcn.004063a0
push 0xfffe
lea edx, [ebp - 0x10420]
push ebx
push edx
call fcn.00541d20
mov esi, dword [ebp - 0x10838]
mov eax, dword [esi - 0xc]
add esp, 0xc
add eax, eax
push eax
lea ecx, [ebp - 0x10420]
push esi
push ecx
call fcn.005442b0
add esp, 0xc
lea edx, [ebp - 0x10844]
push edx
lea eax, [ebp - 0x10420]
push 0x5958e8
push eax
call fcn.0053deaa
add esp, 0xc
cmp eax, ebx
je 0x415f6e
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x415f97
lea edx, [ebp - 0x10844]
push edx
push 0x5958e8
push ebx
call fcn.0053deaa
add esp, 0xc
cmp eax, ebx
jne 0x415f47
mov eax, dword [ebp - 0x10860]
inc eax
add edi, 0x54
mov esi, 1
mov dword [ebp - 0x10860], eax
cmp eax, dword [ebp - 0x1084c]
jb 0x415ee0
mov edi, dword [ebp - 0x10850]
jmp 0x415fec
mov eax, dword [ebp - 0x10850]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415fc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1085c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
xor eax, eax
jmp 0x416205
mov dword [ebp - 0x10834], 1
mov esi, dword [ebp - 0x10834]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, 1
jne 0x4161b3
lea ecx, [ebp - 0x1083c]
push ecx
push 0x2001f
push ebx
push str.SOFTWARECanonVDCSETUPVDCUser
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41605b
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10838]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416042
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1085c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
xor eax, eax
jmp 0x416205
call fcn.00448c3f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x416075
push 0x80004005
call fcn.00404160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10834], eax
mov edi, dword [ebp - 0x10868]
lea ecx, [edi + 0xe8]
push ecx
lea ecx, [ebp - 0x10834]
mov byte [ebp - 4], 2
call fcn.004063a0
mov edx, dword [ebp - 0x10834]
mov eax, dword [ebp - 0x1083c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edx
push eax
call esi
add edi, 0xec
push edi
lea ecx, [ebp - 0x10834]
call fcn.004063a0
mov ecx, dword [ebp - 0x10834]
mov edx, dword [ebp - 0x1083c]
push ecx
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x10840]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x10864]
push edx
mov edx, dword [ebp - 0x1083c]
push ebx
lea eax, [ebp - 0x10848]
push eax
lea ecx, [ebp - 0x218]
push ecx
push ebx
push edx
xor esi, esi
mov dword [ebp - 0x10848], 0x104
mov dword [ebp - 0x10840], 0x208
call edi
cmp eax, ebx
jne 0x416177
lea esp, [esp]
lea eax, [ebp - 0x10840]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x10864]
push edx
mov edx, dword [ebp - 0x1083c]
push ebx
lea eax, [ebp - 0x10848]
push eax
lea ecx, [ebp - 0x218]
push ecx
inc esi
push esi
push edx
mov dword [ebp - 0x10848], 0x104
mov dword [ebp - 0x10840], 0x208
call edi
cmp eax, ebx
je 0x416130
mov eax, dword [ebp - 0x1083c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp ecx, esi
sbb edi, edi
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10834]
add eax, 0xfffffff0
inc edi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4161b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4161b5
xor edi, edi
push edi
push str.return___08x
lea ecx, [ebp - 0x1085c]
push 2
push ecx
call fcn.00401410
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10838]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4161f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1085c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053ca73
mov esp, ebp
pop ebp
ret