Function at 0x43f960
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43fa2a
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoPrinterTabs
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fa06
cmp word [esp + 0x20], 1
jne 0x43fa24
push eax
push 1
push 0xf1
push 0x28f8
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x43fa24
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push str.NoPrinterTabs
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fac4
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoDeletePrinter
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43faa0
cmp word [esp + 0x20], 1
jne 0x43fabe
push eax
push 1
push 0xf1
push 0x28f9
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x43fabe
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoDeletePrinter
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fb5e
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoAddPrinter
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fb3a
cmp word [esp + 0x20], 1
jne 0x43fb58
push eax
push 1
push 0xf1
push 0x28fa
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x43fb58
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoAddPrinter
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fbf8
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoPrinters
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fbd4
cmp word [esp + 0x20], 1
jne 0x43fbf2
push eax
push 1
push 0xf1
push 0x28fb
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x43fbf2
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoPrinters
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28fc
push str.DisableWebPrinting
mov edx, str.SOFTWAREPoliciesMicrosoftWindows_NTPrinters
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28fd
push str.DisableServerThread
mov edx, str.SystemCurrentControlSetControlPrint
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28fe
push str.BeepEnabled
mov edx, str.SYSTEMCurrentControlSetControlPrint
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28ff
push str.NoWideTextPrinting
mov edx, str.SoftwareMicrosoftOffice10.0WordOptions
mov ecx, 0x80000001
call fcn.0043e5c0
push 0x2900
push str.EventLog
mov edx, str.SYSTEMCurrentControlSetControlPrintProviders
mov ecx, 0x80000002
call fcn.0043e5c0
mov ecx, dword [esp + 0x848]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x814
ret