Function at 0x1000ece0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov ebx, dword [ebp + 8]
test byte [0x1001a0b8], 8
jne 0x1000eef0
test ebx, ebx
je 0x1000ed90
cmp word [ebx], 0
je 0x1000ed90
mov eax, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp], ebx
mov dword [ebp - 0x228], eax
call eax
lea esi, [eax + 0x20b]
mov dword [ebp - 0x21c], esi
add esi, esi
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x1000ed6c
lea eax, [ebp - 0x220]
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov dword [esp], 0x80000001
mov dword [ebp - 0x224], eax
call eax
sub esp, 0xc
test eax, eax
je 0x1000ee30
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 2
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esi, [ebp - 0x21c]
xor ecx, ecx
mov dword [ebp - 0x21c], 0x104
lea ebx, [ebp - 0x214]
mov word [ebp - 0x214], cx
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.10003310
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x1000ed84
lea eax, [ebp - 0x220]
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintPrinters
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
je 0x1000ef28
test byte [0x1001a0b8], 8
je 0x1000ed75
mov dword [esp + 0xc], str.no_local_printer_found_n
mov dword [esp + 8], str.SetDefaultPrinterW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x1000ed75
lea eax, [esi - 0x416]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.ucrtbase.dll_memcpy
mov eax, 0x2c
mov dword [ebp - 0x21c], 0x414
mov word [edi + esi - 0x416], ax
lea eax, [ebp - 0x21c]
mov dword [esp + 0x14], eax
lea eax, [edi + esi - 0x414]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov esi, eax
test eax, eax
je 0x1000efa0
cmp eax, 2
je 0x1000eeb4
test byte [0x1001a0b8], 1
jne 0x1000f088
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x709
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
xor eax, eax
test esi, esi
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, ebx
call fcn.10002fe0
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SetDefaultPrinterW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x1000ecfc
mov dword [ebp - 0x21c], 0x104
xor edx, edx
mov word [ebp - 0x214], dx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x1000f030
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x1000edf3
lea eax, [ebp - 0x218]
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x224]
call eax
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
test eax, eax
jne 0x1000eec7
mov dword [esp], edi
mov eax, dword [ebp - 0x228]
call eax
mov dword [esp + 0x10], edi
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.device
mov eax, dword [ebp - 0x218]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x218]
sub esp, 0x18
mov dword [esp], eax
call ebx
sub esp, 4
jmp 0x1000eec7
test byte [0x1001a0b8], 8
jne 0x1000f050
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x1000ed0e
mov eax, ebx
call fcn.10002fe0
mov dword [esp + 0xc], str.using__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SetDefaultPrinterW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x1000f039
mov eax, ebx
call fcn.10002fe0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.RegQueryValueExW_failed_with__ld_for__s_n
mov dword [esp + 8], str.SetDefaultPrinterW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 0
call fcn.100032c0
jmp 0x1000eeb4