Function at 0x1010fde
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x101101b
push esi
push 0x2001f
push edi
push dword [ebp + 8]
push 0x80000003
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ed01
push ebx
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x10111b8
push dword [esi]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101107f
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetKeySecurity]
lea eax, [ebp - 8]
push eax
push edi
push 4
push dword [ebp + 8]
call ebx
cmp eax, 0x7a
jne 0x1011076
push dword [ebp - 8]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1011076
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 4
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1011076
mov dword [ebp - 0xc], 1
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp + 0xc], eax
lea eax, [esi + 8]
push eax
push edi
push 0x7001f
push edi
push 0x10111b4
push edi
push 0x100e598
push dword [esi]
call ebx
test eax, eax
jne 0x1011184
cmp dword [ebp - 0xc], edi
je 0x10110c6
push dword [ebp - 4]
push 4
push dword [esi + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
lea ecx, [ebp - 0x14]
push ecx
lea eax, [esi + 0xc]
push eax
push edi
push 0x7001f
push edi
push 0x10111b4
push edi
push 0x100e678
push dword [esi]
call ebx
test eax, eax
jne 0x1011184
cmp dword [ebp - 0xc], edi
je 0x10110ff
push dword [ebp - 4]
push 4
push dword [esi + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetKeySecurity]
lea ebx, [esi + 4]
push ebx
push 0x2001f
push edi
push 0x100e608
push dword [esi]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1011184
lea ecx, [ebp - 0x18]
push ecx
lea eax, [esi + 0x436]
push eax
push edi
push edi
push 0x1011218
push dword [ebx]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [ebp - 0x18], 0x410
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1011155
mov dword [esi + 0x14], 1
cmp dword [esi + 0x14], edi
je 0x101117d
xor eax, eax
mov word [esi + 0x844], ax
lea eax, [esi + 0x436]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, edi
je 0x101117d
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x10], 1
pop ebx
cmp dword [ebp + 0xc], edi
je 0x1011192
push dword [ebp + 0xc]
call sym.spoolsv.exe_PrvImpersonatePrinterClient
cmp dword [ebp - 4], edi
je 0x101119f
push dword [ebp - 4]
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [ebp - 0x10], edi
je 0x1013b8c
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 8
push esi
call fcn.0100ec1d
jmp 0x10111a8
mov dword [esi], edi
jmp 0x1013b8c