Function at 0x403d00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41de01
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push esi
push edi
mov esi, ecx
call fcn.00404060
test al, al
je 0x403fb3
mov eax, dword [0x42ad0c]
mov dword [esp + 8], eax
mov ecx, dword [esi + 0xd8]
lea edx, [esp + 8]
mov dword [esp + 0x1c0], 0
mov eax, dword [ecx + 0xc]
push eax
push str.setupexe_instance
push str._s__s
push edx
call fcn.0041489c
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
add esp, 0x10
push eax
push 0
push 0x1f0001
call edi
test eax, eax
je 0x403d8f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xe8], 1
jmp 0x403f9f
mov ecx, dword [esp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.h_PrinterDriver_Installer
lea ecx, [esp + 0xc]
mov dword [esi + 0xe4], eax
call fcn.00415644
mov edx, dword [esp + 8]
push edx
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x403d79
mov ecx, esi
call fcn.00404ba0
test eax, eax
jge 0x403e20
cmp eax, 0xffffffff
jne 0x403dfa
call fcn.00418566
test eax, eax
je 0x403dee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x232c
jmp 0x403f8f
xor eax, eax
push 0x232c
jmp 0x403f8f
call fcn.00418566
test eax, eax
je 0x403e14
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x2332
jmp 0x403f8f
xor eax, eax
push 0x2332
jmp 0x403f8f
mov al, byte [esi + 0xee]
test al, al
je 0x403e50
call fcn.00418566
test eax, eax
je 0x403e44
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x2331
jmp 0x403f8f
xor eax, eax
push 0x2331
jmp 0x403f8f
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + 8]
mov ecx, eax
shr ecx, 9
test cl, 1
jne 0x403ea3
mov edx, eax
shr edx, 0xa
test dl, 1
jne 0x403ea3
shr eax, 7
test al, 1
je 0x403e7f
mov ecx, esi
call fcn.004051d0
test al, al
jne 0x403ea3
mov eax, dword [esi + 0xdc]
mov ecx, dword [eax + 8]
shr ecx, 8
test cl, 1
je 0x403fba
mov ecx, esi
call fcn.004051d0
test al, al
je 0x403fba
lea edx, [esp + 0xc]
mov dword [esp + 0x14], 1
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403f02
lea eax, [esp + 0x10]
lea ecx, [esp + 0xb4]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0xb3]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x403f31
lea eax, [esp + 0xb4]
push 0x4285cc
push eax
call edi
lea ecx, [esp + 0xb4]
push str.CanonTempINSDRV.INI
push ecx
call edi
push 0
push 0x80
push 3
push 0
push 0
lea edx, [esp + 0xc8]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x403fba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xe8], 1
call fcn.00418566
test eax, eax
je 0x403f88
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x403f8a
xor eax, eax
push 0x232b
add esi, 0xc0
push eax
push esi
call fcn.00401050
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00415507
xor al, al
jmp 0x404046
mov eax, dword [esi + 0xd8]
push 0x429858
add eax, 4
mov eax, dword [eax]
push eax
call fcn.00406d57
add esp, 8
test eax, eax
jne 0x404014
push eax
lea ecx, [esp + 0x1c]
call fcn.00401890
lea ecx, [esp + 0x18]
mov byte [esp + 0x1c0], 1
call fcn.00419073
lea ecx, [esp + 0x78]
mov byte [esp + 0x1c0], 2
call fcn.00414a80
lea ecx, [esp + 0x18]
mov byte [esp + 0x1c0], 0
call fcn.00418cb4
mov eax, dword [esp + 0x1c8]
mov ecx, esi
push eax
call fcn.00404380
test al, al
mov dword [esp + 0x1c0], 0xffffffff
lea ecx, [esp + 8]
jne 0x40403f
call fcn.00415507
xor al, al
jmp 0x404046
call fcn.00415507
mov al, 1
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1bc
ret 4