Function at 0x1004d44c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x30
mov eax, 0x1018a4d2
call fcn.10188e2d
mov dword [ebp - 0x2c], edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov bh, byte [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x10]
push eax
call fcn.100440e8
mov esi, dword [ebp - 0x10]
test esi, esi
js 0x1004d504
cmp dword [ebp - 0x14], 0
je 0x1004d49d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
mov edx, 0x2001f
push eax
push 0
mov ecx, edi
call fcn.1013db2f
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d504
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x18
push 0x1001d56c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1004d4f4
jg 0x1004d4e9
mov esi, eax
jmp 0x1004d4ff
movzx esi, ax
or esi, 0x80070000
jmp 0x1004d4ff
cmp dword [ebp - 0x24], 4
je 0x1004d517
mov esi, 0x8000ffff
mov dword [ebp - 0x10], esi
jmp 0x1004d517
cmp dword [ebp - 0x14], 0
je 0x1004d517
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x3c]
call fcn.1004417d
mov edi, dword [ebp + 8]
test esi, esi
js 0x1004d55f
mov eax, edi
test bh, bh
jne 0x1004d52f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push 4
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 0x1001d810
push eax
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
test eax, eax
je 0x1004d5ab
jg 0x1004d553
mov esi, eax
jmp 0x1004d55c
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
mov bl, bh
test bh, bh
jne 0x1004d62f
test esi, esi
js 0x1004d62f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x18
push 0x1001d838
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 2
je 0x1004d5ed
cmp dword [ebp - 0x24], 4
jne 0x1004d5ed
test eax, eax
je 0x1004d5e8
jg 0x1004d5dc
mov esi, eax
jmp 0x1004d5e5
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
je 0x1004d55f
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004d5d8
test byte [eax + 0x44], 4
je 0x1004d5d8
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x5a
pop ecx
call fcn.1004a045
mov bl, 1
jmp 0x1004d62f
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x18]
jmp 0x1004d5f2
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov bl, bh
test esi, esi
js 0x1004d62f
lea eax, [ecx - 1]
cmp eax, 1
ja 0x1004d62f
mov bl, 1
mov edx, dword [0x101c33f0]
cmp edx, 0x101c33f0
je 0x1004d62f
test byte [edx + 0x44], 4
je 0x1004d62f
push 3
lea eax, [ecx + 1]
push eax
push dword [edx + 0x3c]
push dword [edx + 0x38]
mov edx, 0x1001db38
push 0x5b
pop ecx
call fcn.1004a2f5
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100440e8
mov esi, dword [ebp - 0x10]
test esi, esi
js 0x1004d6fd
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push 0x1001d56c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1004d674
jg 0x1004d668
mov esi, eax
jmp 0x1004d671
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d6fd
push 0
lea ecx, [ebp - 0x14]
call fcn.1004b10c
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d6fd
mov eax, dword [ebp - 0x18]
cmp eax, 3
jae 0x1004d69d
inc eax
mov dword [ebp - 0x18], eax
jmp 0x1004d6cf
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004d6c7
test byte [eax + 0x44], 4
je 0x1004d6c7
push dword [ebp - 0x1c]
mov edx, 0x1001db38
push 3
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x5c
pop ecx
call fcn.1004a28f
mov esi, 0x80004005
mov dword [ebp - 0x10], esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x1001d838
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1004d6fd
jg 0x1004d6f1
mov esi, eax
jmp 0x1004d6fa
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x3c]
call fcn.1004417d
test bl, bl
je 0x1004d95a
test esi, esi
js 0x1004d95a
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004d73d
test byte [eax + 0x44], 4
je 0x1004d73d
push dword [ebp - 0x1c]
mov edx, 0x1001db38
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x5d
pop ecx
call fcn.1004a093
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100440e8
mov esi, dword [ebp - 0x10]
test esi, esi
js 0x1004d758
mov ecx, dword [ebp - 0x14]
call fcn.1004b725
lea ecx, [ebp - 0x3c]
call fcn.1004417d
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
mov ecx, edi
push 1
push 0
push 0x1001d5fc
push 0x1001cc7c
push 0x1001cc20
call fcn.1004c5a4
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
mov ecx, edi
push 1
push 0
push 0x1001d618
push 0x1001cca8
push 0x1001cc4c
call fcn.1004c5a4
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
mov ecx, edi
push 1
push 0
push 0x1001d63c
push 0x1001ccf8
push 0x1001ccd8
call fcn.1004c5a4
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push 1
push eax
push 0x1001d65c
push 0x1001d860
push 0x1001cd20
mov ecx, edi
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push 1
push eax
push 0x1001d688
push 0x1001d874
push 0x1001cd48
mov ecx, edi
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push 1
push eax
push 0x1001d6bc
push 0x1001d890
push 0x1001cd78
mov ecx, edi
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push 1
push eax
push 0x1001d6ec
push 0x1001d8a8
push 0x1001cda4
mov ecx, edi
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push 0x1001cdec
push eax
push eax
mov eax, 0x1001cbe4
mov ecx, edi
push eax
push 0x1001d8c4
push eax
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, 0x1001cc08
mov ecx, edi
push eax
push 0x1001d8e4
push eax
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, 0x1001cdd4
mov ecx, edi
push eax
push 0x1001d900
push eax
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1001d720
push 0x1001d920
push 0x1001ce4c
mov ecx, edi
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x1004d95a
mov edx, dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, 0x1001ce70
mov ecx, edi
push eax
push 0x1001d94c
push eax
call fcn.1004c272
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 0x2c], 0
test bl, bl
je 0x1004d9b4
test esi, esi
js 0x1004d9b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.100798b5
mov byte [ebp - 4], 1
test eax, eax
js 0x1004d994
mov ecx, dword [ebp - 0x2c]
call fcn.10078408
mov edx, dword [ebp - 0x14]
mov ecx, edi
push 0
push 1
push 0x1001d5ac
push 0x1001cbc4
push 0x1001cbac
call fcn.1004c5a4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.1004f1b2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100440e8
mov esi, dword [ebp - 0x10]
test esi, esi
js 0x1004d9ed
push 0x1001d838
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 1
lea ecx, [ebp - 0x14]
call fcn.1004b10c
mov esi, eax
lea ecx, [ebp - 0x3c]
call fcn.1004417d
test bl, bl
je 0x1004da50
test esi, esi
js 0x1004da27
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004da50
test byte [eax + 0x44], 4
je 0x1004da50
push dword [ebp - 0x1c]
mov edx, 0x1001db38
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x5e
pop ecx
call fcn.1004a093
jmp 0x1004da50
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004da50
test byte [eax + 0x44], 0x80
je 0x1004da50
push esi
push dword [ebp - 0x1c]
mov edx, 0x1001db38
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x5f
pop ecx
call fcn.1004a0f3
cmp dword [ebp - 0x14], 0
je 0x1004da5f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10188de9
ret 0xc