Function at 0x41eda0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55750c
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x5d7b20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], esi
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x36c], ebx
call fcn.00413de0
cmp ax, 0xc
je 0x41ee1c
call fcn.00413de0
mov dword [ebp - 0x384], ebx
cmp ax, 0xb
jne 0x41ee26
mov dword [ebp - 0x384], 1
lea ecx, [ebp - 0x370]
push ecx
lea edx, [ebp - 0x37c]
push edx
push ebx
push ebx
push 2
push ebx
push 2
call sub.WINSPOOL.DRV_EnumPrintersW
mov eax, dword [ebp - 0x37c]
push 0x127a
add eax, 0x54
push str.DevConFunc.cpp
push eax
mov dword [ebp - 0x360], eax
call fcn.0043e4e0
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x388], edi
cmp edi, ebx
jne 0x41ee89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Memory_Allocation_Error.
call fcn.004162d0
add esp, 8
xor eax, eax
jmp 0x41f4e3
mov edx, dword [ebp - 0x360]
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x37c]
push ecx
push edx
push edi
push 2
push ebx
push 2
call sub.WINSPOOL.DRV_EnumPrintersW
test eax, eax
jne 0x41eec8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EnumPrinterError
call fcn.004162d0
add esp, 8
xor eax, eax
jmp 0x41f4e3
xor eax, eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x370], ebx
jbe 0x41f4d4
add edi, 4
jmp 0x41eee7
mov esi, dword [ebp - 0x38c]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi]
push ecx
push edx
push eax
push str._d:_pPrinterName___s__pDriverName___s_n
call fcn.00415550
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x390]
add esp, 0x10
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41f4b2
cmp esi, ebx
je 0x41ef44
mov edx, dword [edi]
push edx
push str.TEST_pPrinterName___s___n
call fcn.00415550
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi]
push eax
push ecx
push eax
push esi
call fcn.0053f95d
mov edx, dword [edi]
push edx
push str.TEST2_pPrinterName___s___n
call fcn.00415550
add esp, 0x20
call fcn.0044c104
xor ecx, ecx
cmp dword [ebp - 0x384], ebx
jne 0x41f321
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x41f4ff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x354], eax
push str.SYSTEMCurrentControlSetControlPrintPrinters
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], ebx
call fcn.0040b870
push 1
push 0x56825c
lea ecx, [ebp - 0x354]
call fcn.00405330
mov ecx, dword [edi]
cmp ecx, ebx
jne 0x41efa5
xor eax, eax
jmp 0x41efbf
mov eax, ecx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x41efb0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x354]
call fcn.00405330
push 1
push 0x56825c
lea ecx, [ebp - 0x354]
call fcn.00405330
push 0x11
push str.PrinterDriverData
lea ecx, [ebp - 0x354]
call fcn.00405330
mov edx, dword [ebp - 0x354]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x358]
push ecx
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41f2ed
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
push ebx
push ebx
push str.PrinterID
push edx
mov dword [ebp - 0x35c], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f2af
lea ecx, [ebp - 0x374]
mov dword [ebp - 0x368], ebx
call fcn.00404770
lea ecx, [ebp - 0x364]
call fcn.00404770
push str.EnumRootPrinter
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 2
call fcn.0040b870
mov ecx, dword [ebp - 0x374]
lea eax, [ebp - 0x368]
push eax
push 0x20019
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41f24f
mov ecx, dword [ebp - 0x368]
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x30]
push eax
push ebx
push ecx
mov dword [ebp - 0x360], 0xf
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41f23c
lea edx, [ebp - 0x374]
push edx
lea ecx, [ebp - 0x364]
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x360], 0xf
call fcn.00405460
push 1
push 0x56825c
lea ecx, [ebp - 0x364]
call fcn.00405330
lea eax, [ebp - 0x30]
lea edx, [eax + 2]
jmp 0x41f110
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41f110
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x364]
call fcn.00405330
mov edx, dword [ebp - 0x364]
lea ecx, [ebp - 0x378]
push ecx
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f216
mov edx, dword [ebp - 0x378]
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x350]
push ecx
push ebx
push ebx
push str.PrinterID
push edx
mov dword [ebp - 0x35c], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f209
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x350]
cmp ecx, edx
je 0x41f1dc
movzx ebx, dl
movzx eax, cl
sub eax, ebx
jne 0x41f1d2
movzx edx, dh
movzx eax, ch
sub eax, edx
jne 0x41f1d2
movzx ecx, byte [ebp - 0x34e]
movzx eax, byte [ebp - 0x1be]
sub eax, ecx
jne 0x41f1d2
movzx edx, byte [ebp - 0x34d]
movzx eax, byte [ebp - 0x1bd]
sub eax, edx
je 0x41f1da
sar eax, 0x1f
or eax, 1
jne 0x41f207
xor ebx, ebx
push str.PrinterID_is_same._n
push 0x56dce8
call fcn.00415550
mov eax, dword [edi]
push eax
push str._s_didnot_connect_USB._n
call fcn.00415550
add esp, 0x10
mov dword [ebp - 0x36c], 1
jmp 0x41f209
xor ebx, ebx
mov ecx, dword [ebp - 0x378]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x368]
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x30]
push eax
inc esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41f0d1
mov edx, dword [ebp - 0x368]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x368], ebx
mov eax, dword [ebp - 0x364]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f275
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x374]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f2d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x358], ebx
jmp 0x41f2ff
push str.Registry_has_no_PrinterID_entry._n
push 0x56dce8
call fcn.00415550
mov ecx, dword [edi]
push ecx
push str._s_didnot_connect_USB._n
call fcn.00415550
add esp, 0x10
mov dword [ebp - 0x36c], 1
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x358], ebx
jmp 0x41f2ff
push str.Registry_has_no_PrinterDriverData_key._n
push 0x56dce8
call fcn.00415550
add esp, 8
mov eax, dword [ebp - 0x354]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41f4a6
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x41f4ff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x354], eax
push str.SYSTEMCurrentControlSetControlPrintPrinters
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], 3
call fcn.0040b870
push 1
push 0x56825c
lea ecx, [ebp - 0x354]
call fcn.00405330
mov ecx, dword [edi]
cmp ecx, ebx
jne 0x41f373
xor eax, eax
jmp 0x41f38f
mov eax, ecx
lea esi, [eax + 2]
jmp 0x41f380
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x41f380
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x354]
call fcn.00405330
push 1
push 0x56825c
lea ecx, [ebp - 0x354]
call fcn.00405330
push 7
push str.PnPData
lea ecx, [ebp - 0x354]
call fcn.00405330
mov esi, dword [ebp - 0x354]
lea ecx, [ebp - 0x358]
push ecx
push 0x20019
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f473
mov ecx, dword [ebp - 0x358]
lea edx, [ebp - 0x35c]
push edx
lea eax, [ebp - 0x1c0]
push eax
push ebx
push ebx
push str.DeviceInstanceId
push ecx
mov dword [ebp - 0x35c], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f435
push str.DeviceInstanceId_exists._n
push 0x56dce8
call fcn.00415550
mov edx, dword [edi]
push edx
push str._s_connect_USB._n
call fcn.00415550
jmp 0x41f45b
push str.DeviceInstanceId_donot_exists._n
push 0x56dce8
call fcn.00415550
mov eax, dword [edi]
push eax
push str._s_didnot_connect_USB._n
call fcn.00415550
mov dword [ebp - 0x36c], 1
mov ecx, dword [ebp - 0x358]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x358], ebx
jmp 0x41f48f
push str.Registry_has_no_PnPData_key._n
push 0x56dce8
call fcn.00415550
add esp, 8
mov dword [ebp - 0x36c], 1
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f4b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x380]
inc eax
add edi, 0x54
mov dword [ebp - 0x380], eax
cmp eax, dword [ebp - 0x370]
jb 0x41eee1
mov edi, dword [ebp - 0x388]
push edi
call fcn.0043e500
mov eax, dword [ebp - 0x36c]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e1ad
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403e70
int3