Function at 0x41036995
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4114a4e3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x411bade8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Entering_CTPACWMITCreateList::PutInstance
push 0x41157f9c
push 0x1000001
push 0x9eb
push str.WMIProv.cpp
call fcn.41002c10
xor ebx, ebx
add esp, 0x14
mov dword [ebp - 0x20], ebx
xor esi, esi
call fcn.41031dc0
test eax, eax
jne 0x41036745
mov eax, 0x80070005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11]
push eax
push str.DetectedGPO
mov ecx, edi
call dword [sym.imp.framedyn.dll_public:_bool___thiscall_CInstance::Getbool_unsigned_short_int_const___bool__const]
cmp byte [ebp - 0x11], 1
jne 0x41036794
push str.GPO_is_active._WMI_PutInstance_is_forbidden_for_printer_create_list_
push 0x2000001
push 0x9f9
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
mov eax, 0x80041001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.PrinterCreateList
push edi
lea ecx, [ebp - 0x40]
call fcn.410308e0
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x41036ba6
push str.PrinterCreateListEx2
push edi
lea ecx, [ebp - 0x54]
call fcn.410308e0
mov eax, dword [ebp - 0x44]
cmp eax, ebx
jne 0x41036ba6
xor eax, eax
xor edi, edi
cmp dword [ebp - 0x48], edi
setg al
xor ecx, ecx
add eax, eax
cmp dword [ebp - 0x34], edi
setg cl
or eax, ecx
cmp eax, 3
ja case.default.0x410367e1
jmp dword [eax*4 + 0x41036bbc]
push str.PrinterCreateList_not_present
push 0x2000001
push 0xa11
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
xor ebx, ebx
xor esi, esi
push ebx
push str.look_for_PrinterCreateList_Ex2___d
push 0x1000001
push 0xa24
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0x10]
call fcn.41001530
mov dword [ebp - 4], edi
cmp esi, edi
je 0x41036abb
mov dword [ebp - 0x28], esi
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
cmp eax, dword [esi + 8]
jg 0x41036907
lea ebx, [ebx]
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.41034470
mov eax, dword [eax]
push eax
push str.line:__s
push 0x1000001
push 0xa2b
push str.WMIProv.cpp
mov byte [ebp - 4], 1
call fcn.41002c10
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410368a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.41034470
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.41001a50
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410368e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x10]
call fcn.410078d0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 8]
jle 0x41036850
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x10]
call fcn.410078d0
lea ecx, [ebp - 0x98]
call fcn.410264f0
mov dword [ebp - 0x98], 0x4116a10c
mov eax, ebx
dec eax
mov byte [ebp - 4], 3
mov esi, str.PrinterCreateList
mov edi, str.PrinterCreateListEx2
je 0x410369cf
dec eax
jne 0x41036a24
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x98]
call fcn.41007700
test eax, eax
jne 0x410369c3
push str.Syntax_error_in_PrinterCreateListEx2
push 0x2000001
push 0xa44
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0
call fcn.41026580
lea ecx, [ebp - 0x10]
call fcn.41017b50
jmp 0x4103677b
mov ebx, 1
lea esi, [ebp - 0x40]
jmp case.default.0x410367e1
mov ebx, 2
lea esi, [ebp - 0x54]
jmp case.default.0x410367e1
push str.PrinterCreateList_and_PrinterCreateListEx2_are_present
push 0x2000001
push 0xa20
jmp 0x4103676e
mov esi, str.PrinterCreateListEx2
mov edi, str.PrinterCreateList
jmp 0x41036a24
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x98]
call fcn.41007dd0
test eax, eax
jne 0x41036a1a
push str.Syntax_error_in_PrinterCreateList
push 0x2000001
push 0xa3b
push str.WMIProv.cpp
call fcn.41002c10
add esp, 0x10
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0
call fcn.41026580
lea ecx, [ebp - 0x10]
call fcn.41017b50
jmp 0x4103677b
mov esi, str.PrinterCreateList
mov edi, str.PrinterCreateListEx2
lea ecx, [ebp - 0x1c]
call fcn.41010ac0
push 0xf003f
push str.SoftwareThinPrintTPAutoConnect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.41010fa0
test eax, eax
jne 0x41036a9b
push esi
push str.store_data_to__s
push 0x1000001
push 0xa50
push str.WMIProv.cpp
call fcn.41002c10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
add esp, 0x14
add ecx, ecx
push ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push esi
call fcn.41002090
lea ecx, [ebp - 0x1c]
call fcn.41033180
test eax, eax
jne 0x41036a93
push edi
lea ecx, [ebp - 0x1c]
call fcn.41014c20
lea ecx, [ebp - 0x1c]
call fcn.41010b50
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.41010de0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0
call fcn.41026580
jmp 0x41036b7d
lea ecx, [ebp - 0x1c]
call fcn.41010ac0
push 0xf003f
push str.SoftwareThinPrintTPAutoConnect
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.41010fa0
test eax, eax
jne 0x41036b6a
push str.delete_all_printercreatelists
push 0x1000001
push 0xa62
push str.WMIProv.cpp
call fcn.41002c10
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov edx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esp, 0x24
push str.PrinterCreateList
push edx
call esi
push str.Entering_CRegKeyEx::DeleteValue
push 0x41157f9c
push 0x1000001
push 0x1a5
push str.RegKeyEx.h
call fcn.41002c10
mov eax, dword [ebp - 0x1c]
add esp, 0x14
push str.PrinterCreateListEx2
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.41010b50
mov dword [ebp - 0x20], edi
jmp 0x41036b71
mov dword [ebp - 0x20], 0x80041001
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.41010de0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41036ba3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8