Function at 0x40b820
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x32c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x24], esi
jne 0x40b845
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40baca
push 0xfc
lea edx, [esp + 0x13c]
push edx
mov ecx, 0x3f
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push esi
mov dword [esp + 0x3c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push eax
call esi
test eax, eax
jne 0x40babf
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x144]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ba57
mov edx, dword [esp + 0xc]
mov ecx, 0x3f
lea edi, [esp + 0x38]
push 0xfc
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push eax
push edx
mov dword [esp + 0x3c], eax
call esi
test eax, eax
jne 0x40ba4c
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ba0f
mov ecx, 0x3f
lea edi, [esp + 0x238]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push str.DeviceDesc
push eax
mov dword [esp + 0x40], 1
mov dword [esp + 0x38], 0xfc
call ebx
test eax, eax
jne 0x40b97c
lea ecx, [esp + 0x238]
push ecx
call fcn.004081e0
add esp, 4
test eax, eax
jne 0x40b97c
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ba0f
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x20], al
lea eax, [esp + 0x30]
push eax
push 0
push str.PrinterID
push ecx
mov dword [esp + 0x40], 3
mov dword [esp + 0x38], 4
call ebx
test eax, eax
jne 0x40b9fc
mov dl, byte [esp + 0x14]
mov ecx, dword [ebp + 0xc]
cmp dl, byte [ecx]
mov esi, dword [esp + 0x20]
jne 0x40b9ea
lea edx, [esp + 0x14]
sub ecx, edx
lea esp, [esp]
cmp eax, esi
jge 0x40b9ec
inc eax
lea edx, [ecx + eax]
mov dword [esp + 0x34], eax
mov al, byte [esp + eax + 0x14]
cmp al, byte [esp + edx + 0x14]
mov eax, dword [esp + 0x34]
je 0x40b9d0
cmp eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jne 0x40b9fc
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40ba34
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
push 0xfc
lea ecx, [esp + 0x3c]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x3c], eax
call esi
test eax, eax
je 0x40b8f2
jmp 0x40ba44
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40ba7f
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push 0xfc
lea ecx, [esp + 0x13c]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x40], eax
call esi
test eax, eax
je 0x40b8a2
jmp 0x40babf
mov ecx, dword [esp + 0xc]
push 0xfc
lea eax, [esp + 0x3c]
push eax
push 0
push ecx
call esi
cmp eax, 0x103
mov edx, dword [esp + 0xc]
push edx
jne 0x40bab9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x138]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40babf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret