Function at 0x404d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1928
call fcn.00405f20
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0x12c4
push 0
lea eax, [ebp - 0x13d4]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x13d4], 0x574257
mov dword [ebp - 0x13d0], 0x10000
mov dword [ebp - 0x13cc], 0x12c4
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x13c8]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
push str.ZSpool32____s
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0xc], 0x30
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x127c]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, dword [ebp - 0xc]
jb 0x404dbc
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x127d], 0
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
cmp dword [ebp + 8], 0
je 0x40504e
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREZenographicsFilters
push 0x80000002
call dword [sym.imp.ZSPOOL.dll_RegOpenKeyExA]
test eax, eax
jne 0x40504e
mov dword [ebp - 0x13d8], 0
cmp dword [ebp - 0x10], 0
jne 0x405044
mov dword [ebp - 0x141c], 0x40
mov dword [ebp - 0x1528], 0x104
lea ecx, [ebp - 0x1528]
push ecx
lea edx, [ebp - 0x1520]
push edx
push 0
push 0
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x1418]
push ecx
mov edx, dword [ebp - 0x13d8]
mov dword [ebp - 0x1928], edx
mov eax, dword [ebp - 0x1928]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x13d8]
add edx, 1
mov dword [ebp - 0x13d8], edx
call dword [sym.imp.ZSPOOL.dll_RegEnumValueA]
test eax, eax
je 0x404e80
jmp 0x405044
lea eax, [ebp - 0x1520]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1524], eax
cmp dword [ebp - 0x1524], 0
je 0x40503f
push str.ZFltOpen
mov ecx, dword [ebp - 0x1524]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1534], eax
push str.ZFltClose
mov edx, dword [ebp - 0x1524]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1530], eax
push str.ZFltEnum
mov eax, dword [ebp - 0x1524]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x152c], eax
call dword [ebp - 0x1534]
cmp eax, 0x2ffe0000
jne 0x405032
push 0x3a4
push 0
lea ecx, [ebp - 0x18d8]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x18d8]
push edx
push 0x405057
call dword [ebp - 0x152c]
add esp, 8
cmp eax, 0x2ffe0000
jne 0x40502c
mov dword [ebp - 0x18dc], 0
mov dword [ebp - 0x18dc], 0
jmp 0x404f54
mov eax, dword [ebp - 0x18dc]
add eax, 1
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
cmp ecx, dword [ebp - 0x18d8]
jge 0x40502c
lea edx, [ebp - 0x191c]
mov dword [ebp - 0x1920], edx
mov eax, dword [ebp - 0x18dc]
imul eax, eax, 0x74
mov ecx, dword [ebp + eax - 0x1894]
push ecx
lea edx, [ebp - 0x191c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x4082a0
mov eax, dword [ebp - 0x1920]
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
add esp, 8
mov dword [ebp - 0x1924], eax
cmp dword [ebp - 0x1924], 0
je 0x405027
mov dword [ebp - 0x1920], 0
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x1924]
push edx
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x405022
push 1
mov eax, dword [ebp - 0x18dc]
imul eax, eax, 0x74
lea ecx, [ebp + eax - 0x18d4]
push ecx
lea edx, [ebp - 0x13d4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.00405133
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405022
lea ecx, [ebp - 0x13d4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405250
add esp, 8
mov dword [ebp - 8], eax
jmp 0x404f92
jmp 0x404f45
call dword [ebp - 0x1530]
mov eax, dword [ebp - 0x1524]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404e0d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ZSPOOL.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8