Function at 0x10042270
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x38
mov eax, 0x1016805c
call fcn.101673a2
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x18]
push eax
call fcn.1003e2ec
mov esi, dword [ebp - 0x18]
test esi, esi
js 0x10042322
cmp dword [ebp - 0x1c], 0
je 0x100422bd
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
mov edx, 0x2001f
push eax
push 0
mov ecx, ebx
call fcn.1011593d
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042322
push 4
pop ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push 0x10018d5c
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10042313
jg 0x10042308
mov esi, eax
jmp 0x1004231d
movzx esi, ax
or esi, 0x80070000
jmp 0x1004231d
cmp dword [ebp - 0x2c], ebx
je 0x10042335
mov esi, 0x8000ffff
mov dword [ebp - 0x18], esi
jmp 0x10042335
cmp dword [ebp - 0x1c], 0
je 0x10042335
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x44]
call fcn.1003e392
mov al, byte [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x11], al
test esi, esi
js 0x10042383
test al, al
je 0x10042350
mov edi, ebx
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x10019004
push edi
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
test eax, eax
je 0x10042390
jg 0x10042374
mov esi, eax
jmp 0x1004237d
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x18], esi
mov al, byte [ebp - 0x11]
test al, al
je 0x100423c4
and dword [ebp - 0x24], 0
jmp 0x10042459
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
je 0x10042380
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x100423bd
test byte [eax + 0x44], 4
je 0x100423bd
push dword [eax + 0x3c]
mov edx, 0x1001932c
push dword [eax + 0x38]
push 0x4c
pop ecx
call fcn.1003f5d3
mov al, 1
mov byte [ebp - 0x11], al
jmp 0x10042383
test esi, esi
js 0x10042459
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push 0x1001902c
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 2
je 0x10042417
cmp dword [ebp - 0x2c], 4
jne 0x10042417
test eax, eax
je 0x10042412
jg 0x10042406
mov esi, eax
jmp 0x1004240f
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x24]
jmp 0x1004241c
xor ecx, ecx
mov dword [ebp - 0x24], ecx
test esi, esi
js 0x10042459
lea eax, [ecx - 1]
cmp eax, 1
ja 0x10042459
mov byte [ebp - 0x11], 1
mov edx, dword [0x101973c0]
cmp edx, 0x101973c0
je 0x10042459
test byte [edx + 0x44], 4
je 0x10042459
push 3
lea eax, [ecx + 1]
push eax
push dword [edx + 0x3c]
push dword [edx + 0x38]
mov edx, 0x1001932c
push 0x4d
pop ecx
call fcn.1003f7de
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.1003e2ec
mov esi, dword [ebp - 0x18]
test esi, esi
js 0x1004252a
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push 0
push 0x10018d5c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1004249e
jg 0x10042492
mov esi, eax
jmp 0x1004249b
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x18], esi
test esi, esi
js 0x1004252a
push 0
lea ecx, [ebp - 0x1c]
call fcn.1004057e
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x1004252a
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
cmp eax, 3
jae 0x100424ca
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100424fa
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x100424f2
test byte [eax + 0x44], 4
je 0x100424f2
push edi
push 3
push dword [eax + 0x3c]
mov edx, 0x1001932c
push dword [eax + 0x38]
push 0x4e
pop ecx
call fcn.1003f778
mov esi, 0x80004005
mov dword [ebp - 0x18], esi
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push 0x1001902c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1004252d
jg 0x1004251f
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x1004252d
movzx esi, ax
or esi, 0x80070000
jmp 0x1004251a
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x44]
call fcn.1003e392
mov al, byte [ebp - 0x11]
test al, al
je 0x10042785
test esi, esi
js 0x10042785
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x1004256e
test byte [eax + 0x44], 4
je 0x1004256e
push edi
push dword [eax + 0x3c]
mov edx, 0x1001932c
push dword [eax + 0x38]
push 0x4f
pop ecx
call fcn.1003f5f1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.1003e2ec
mov esi, dword [ebp - 0x18]
test esi, esi
js 0x10042589
mov ecx, dword [ebp - 0x1c]
call fcn.10040b7b
lea ecx, [ebp - 0x44]
call fcn.1003e392
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 1
push 0
push 0x10018dec
push 0x1001882c
push 0x100187d0
call fcn.1004150d
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 1
push 0
push 0x10018e08
push 0x10018858
push 0x100187fc
call fcn.1004150d
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 1
push 0
push 0x10018e2c
push 0x100188a8
push 0x10018888
call fcn.1004150d
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
push 1
push 0
push 0x10018e4c
push 0x10019054
push 0x100188d0
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
push 1
push 0
push 0x10018e78
push 0x10019068
push 0x100188f8
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
push 1
push 0
push 0x10018eac
push 0x10019084
push 0x10018928
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
push 1
push 0
push 0x10018edc
push 0x1001909c
push 0x10018954
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
mov eax, 0x10018794
push 0x1001899c
push 0
push 0
push eax
push 0x100190b8
push eax
mov ecx, ebx
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, 0x100187b8
mov ecx, ebx
push eax
push 0x100190d8
push eax
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, 0x10018984
mov ecx, ebx
push eax
push 0x100190f4
push eax
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push eax
push 0x10018f10
push 0x10019114
push 0x100189fc
mov ecx, ebx
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
js 0x10042782
mov edx, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, 0x10018a20
mov ecx, ebx
push eax
push 0x10019140
push eax
call fcn.100412c2
mov esi, eax
mov dword [ebp - 0x18], esi
mov al, byte [ebp - 0x11]
xor edi, edi
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], 1
test al, al
je 0x100427df
test esi, esi
js 0x100427df
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], eax
call fcn.10064cd2
test eax, eax
js 0x100427bc
mov ecx, dword [ebp - 0x34]
call fcn.10063964
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push 0
push 1
push 0x10018d9c
push 0x10018774
push 0x1001875c
call fcn.1004150d
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
test edi, edi
je 0x100427f6
mov ecx, edi
call fcn.1003f532
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.1003e2ec
mov esi, dword [ebp - 0x18]
test esi, esi
js 0x10042823
push 0x1001902c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 1
lea ecx, [ebp - 0x1c]
call fcn.1004057e
mov esi, eax
lea ecx, [ebp - 0x44]
call fcn.1003e392
cmp byte [ebp - 0x11], 0
je 0x10042888
test esi, esi
js 0x1004285f
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x10042888
test byte [eax + 0x44], 4
je 0x10042888
push dword [ebp - 0x20]
mov edx, 0x1001932c
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x50
pop ecx
call fcn.1003f5f1
jmp 0x10042888
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x10042888
test byte [eax + 0x44], 0x80
je 0x10042888
push esi
push dword [ebp - 0x20]
mov edx, 0x1001932c
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x51
pop ecx
call fcn.1003f64f
cmp dword [ebp - 0x1c], 0
je 0x10042897
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10167370
ret 0xc