Function at 0x1010f87
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x1010fc4
push esi
push 0x2001f
push edi
push dword [ebp + 8]
push 0x80000003
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e739
push ebx
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x1011160
push dword [esi]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1011028
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
lea eax, [ebp - 8]
push eax
push edi
push 4
push dword [ebp + 8]
call ebx
cmp eax, 0x7a
jne 0x101101f
push dword [ebp - 8]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [ebp - 4], eax
cmp eax, edi
je 0x101101f
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 4
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x101101f
mov dword [ebp - 0xc], 1
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp + 0xc], eax
lea eax, [esi + 8]
push eax
push edi
push 0x7001f
push edi
push 0x101115c
push edi
push 0x100e5d0
push dword [esi]
call ebx
test eax, eax
jne 0x101112d
cmp dword [ebp - 0xc], edi
je 0x101106f
push dword [ebp - 4]
push 4
push dword [esi + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
lea ecx, [ebp - 0x14]
push ecx
lea eax, [esi + 0xc]
push eax
push edi
push 0x7001f
push edi
push 0x101115c
push edi
push 0x100e6b0
push dword [esi]
call ebx
test eax, eax
jne 0x101112d
cmp dword [ebp - 0xc], edi
je 0x10110a8
push dword [ebp - 4]
push 4
push dword [esi + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
lea ebx, [esi + 4]
push ebx
push 0x2001f
push edi
push 0x100e640
push dword [esi]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101112d
lea ecx, [ebp - 0x18]
push ecx
lea eax, [esi + 0x436]
push eax
push edi
push edi
push 0x10111c0
push dword [ebx]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [ebp - 0x18], 0x410
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x10110fe
mov dword [esi + 0x14], 1
cmp dword [esi + 0x14], edi
je 0x1011126
xor eax, eax
mov word [esi + 0x844], ax
lea eax, [esi + 0x436]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, edi
je 0x1011126
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x10], 1
pop ebx
cmp dword [ebp + 0xc], edi
je 0x101113b
push dword [ebp + 0xc]
call sym.spoolsv.exe_PrvImpersonatePrinterClient
cmp dword [ebp - 4], edi
je 0x1011148
push dword [ebp - 4]
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [ebp - 0x10], edi
je 0x1013c16
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 8
push esi
call fcn.0100ec85
jmp 0x1011151
mov dword [esi], edi
jmp 0x1013c16