Function at 0x417df0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x140
mov eax, 0x555732
call fcn.0052faf2
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x130], esi
push 4
mov dword [ebp - 4], esi
call fcn.0042b4e8
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x417e36
mov eax, 0x5b54e8
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x120], ebx
jmp 0x417e3e
mov dword [ebp - 0x120], esi
mov ebx, esi
mov dword [ebp - 0x14c], ebx
push 3
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
call fcn.00404273
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x118]
push eax
call fcn.00416b9d
pop ecx
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x118], eax
je 0x417e9a
push dword [ebp - 0x118]
call fcn.0052b484
pop ecx
mov eax, dword [ebp - 0x11c]
cmp dword [eax - 0xc], esi
jle 0x417eb3
add eax, 0xfffffff0
push eax
call fcn.00401e83
jmp 0x4180e8
lea eax, [ebp - 0x128]
push eax
push 0x20019
push esi
push str.SOFTWAREEPSONEPSON_Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417edc
mov eax, dword [ebp - 0x11c]
jmp 0x417ea5
xor eax, eax
push 0x7e
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push esi
push eax
call fcn.0052bfd0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x148], esi
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x90]
push eax
push esi
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x138], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4180c7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x134]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41805f
lea eax, [ebp - 0x124]
push eax
push esi
lea eax, [ebp - 0x13c]
push eax
push esi
push str.Supported
push dword [ebp - 0x134]
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x124], esi
call ebx
test eax, eax
jne 0x418053
mov eax, dword [ebp - 0x124]
add eax, 2
push eax
call fcn.0042b522
mov edi, eax
pop ecx
cmp edi, esi
je 0x4180c1
mov eax, dword [ebp - 0x124]
add eax, 2
push eax
push esi
push edi
call fcn.0052bfd0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
push edi
lea eax, [ebp - 0x13c]
push eax
push esi
push str.Supported
push dword [ebp - 0x134]
call ebx
lea eax, [ebp - 0x130]
push eax
push 0x58b144
mov dword [ebp - 0x130], esi
push edi
jmp 0x41801e
push dword [ebp + 8]
push eax
call fcn.0052cdad
pop ecx
pop ecx
test eax, eax
jne 0x41802c
lea eax, [ebp - 0x130]
push eax
push 0x58b144
push esi
call fcn.0052f120
add esp, 0xc
cmp eax, esi
jne 0x418002
jmp 0x41804c
lea eax, [ebp - 0x90]
push eax
call fcn.0052ba99
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00401e12
push edi
call fcn.0042b517
pop ecx
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
cmp dword [eax - 0xc], esi
jg 0x4180c1
push 0x80
lea eax, [ebp - 0x90]
push esi
push eax
call fcn.0052bfd0
add esp, 0xc
inc dword [ebp - 0x12c]
lea eax, [ebp - 0x148]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x12c]
mov dword [ebp - 0x138], 0x40
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x417f49
mov ebx, dword [ebp - 0x120]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
push eax
call fcn.00401e83
mov edi, dword [ebp - 0x140]
pop ecx
mov ecx, dword [ebp - 0x11c]
add eax, 0x10
add ecx, 0xfffffff0
mov dword [edi], eax
call fcn.004021a7
cmp ebx, esi
je 0x418114
mov eax, dword [ebx]
cmp eax, esi
je 0x41810d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call fcn.0042b517
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004021a7
mov eax, edi
call fcn.0052fb75
ret