Function at 0x1019eff
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x620]
push eax
xor esi, esi
push 0xf003f
push esi
push 0x1004f18
push 0x80000001
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x640], 0x208
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x63c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1019f62
or eax, 0xffffffff
jmp 0x101a2a6
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x628], esi
mov edi, 0x104
push esi
jmp 0x101a140
cmp dword [ebp - 0x634], 0x103
je 0x101a16f
lea eax, [ebp - 0x62c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101a11c
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push esi
push 0x1004f08
push dword [ebp - 0x62c]
mov dword [ebp - 0x640], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101a0b9
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101a0b9
push esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.010159e1
add esp, 0xc
test eax, eax
je 0x101a0b9
lea eax, [ebp - 0x638]
push eax
push 1
lea eax, [ebp - 0x641]
push eax
push 2
push dword [ebp - 0x63c]
mov dword [ebp - 0x638], esi
call sub.WINSPOOL.DRV_GetPrinterW
push dword [ebp - 0x638]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 0x634], eax
je 0x101a0ac
lea ecx, [ebp - 0x638]
push ecx
push dword [ebp - 0x638]
push eax
push 2
push dword [ebp - 0x63c]
call sub.WINSPOOL.DRV_GetPrinterW
test eax, eax
mov eax, dword [ebp - 0x634]
je 0x101a0a5
cmp dword [eax + 0x10], esi
je 0x101a09b
cmp dword [eax + 0x24], esi
jne 0x101a0a5
mov dword [ebp - 0x630], 1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x63c]
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x101a0c3
mov dword [ebp - 0x630], 1
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x630], 1
jne 0x101a11c
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01009000
lea eax, [ebp - 0x20c]
push eax
push 0x1004f18
push 0x1004c2c
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01005817
add esp, 0x20
test eax, eax
jne 0x101a11c
lea eax, [ebp - 0x414]
push eax
call fcn.01019e98
pop ecx
inc dword [ebp - 0x628]
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x628]
push dword [ebp - 0x620]
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x624], edi
call ebx
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1019f93
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 0xf003f
push esi
push 0x1004f68
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x101a262
or eax, 0xffffffff
jmp 0x101a2a4
lea eax, [ebp - 0x62c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101a25c
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push esi
push 0x1004f08
push dword [ebp - 0x62c]
mov dword [ebp - 0x640], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x101a250
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01009000
lea eax, [ebp - 0x20c]
push eax
push 0x1004f68
push 0x1004c2c
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01005817
add esp, 0x20
test eax, eax
jne 0x101a25c
lea eax, [ebp - 0x414]
push eax
call fcn.010198ae
pop ecx
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x628]
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x628]
mov dword [ebp - 0x624], edi
push dword [ebp - 0x620]
call ebx
test eax, eax
jne 0x101a1a8
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01008fe1
leave
ret