Function at 0x1019bd4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x620]
push eax
xor esi, esi
push 0xf003f
push esi
push 0x1004e48
push 0x80000001
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x640], 0x208
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x63c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1019c37
or eax, 0xffffffff
jmp 0x1019f7b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x628], esi
mov edi, 0x104
push esi
jmp 0x1019e15
cmp dword [ebp - 0x634], 0x103
je 0x1019e44
lea eax, [ebp - 0x62c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019df1
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push esi
push 0x1004e38
push dword [ebp - 0x62c]
mov dword [ebp - 0x640], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019d8e
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1019d8e
push esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.01015821
add esp, 0xc
test eax, eax
je 0x1019d8e
lea eax, [ebp - 0x638]
push eax
push 1
lea eax, [ebp - 0x641]
push eax
push 2
push dword [ebp - 0x63c]
mov dword [ebp - 0x638], esi
call sub.WINSPOOL.DRV_GetPrinterW
push dword [ebp - 0x638]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 0x634], eax
je 0x1019d81
lea ecx, [ebp - 0x638]
push ecx
push dword [ebp - 0x638]
push eax
push 2
push dword [ebp - 0x63c]
call sub.WINSPOOL.DRV_GetPrinterW
test eax, eax
mov eax, dword [ebp - 0x634]
je 0x1019d7a
cmp dword [eax + 0x10], esi
je 0x1019d70
cmp dword [eax + 0x24], esi
jne 0x1019d7a
mov dword [ebp - 0x630], 1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x63c]
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x1019d98
mov dword [ebp - 0x630], 1
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x630], 1
jne 0x1019df1
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01008e20
lea eax, [ebp - 0x20c]
push eax
push 0x1004e48
push 0x1004be8
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01005678
add esp, 0x20
test eax, eax
jne 0x1019df1
lea eax, [ebp - 0x414]
push eax
call fcn.01019b6d
pop ecx
inc dword [ebp - 0x628]
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x628]
push dword [ebp - 0x620]
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x624], edi
call ebx
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1019c68
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 0xf003f
push esi
push 0x1004e98
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1019f37
or eax, 0xffffffff
jmp 0x1019f79
lea eax, [ebp - 0x62c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019f31
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push esi
push 0x1004e38
push dword [ebp - 0x62c]
mov dword [ebp - 0x640], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1019f25
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01008e20
lea eax, [ebp - 0x20c]
push eax
push 0x1004e98
push 0x1004be8
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01005678
add esp, 0x20
test eax, eax
jne 0x1019f31
lea eax, [ebp - 0x414]
push eax
call fcn.01019583
pop ecx
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x628]
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x628]
mov dword [ebp - 0x624], edi
push dword [ebp - 0x620]
call ebx
test eax, eax
jne 0x1019e7d
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01008e04
leave
ret