Function at 0x415f10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x5d7b20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionNetworkLanMan
xor edi, edi
lea eax, [ebp - 0x434]
push 0x104
push eax
mov dword [ebp - 0x858], edi
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x850], edi
call fcn.0053eeab
lea ecx, [ebp - 0x434]
push ecx
push str._INSTHL32___szRegKey___s_n
call fcn.00415550
add esp, 0x14
lea edx, [ebp - 0x848]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x434]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x848], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4161b7
mov edx, dword [ebp - 0x848]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x858]
push ecx
push edi
push edi
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
mov eax, dword [ebp - 0x848]
jne 0x4161b0
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x24]
push edx
push edi
push eax
mov dword [ebp - 0x84c], 0xf
mov dword [ebp - 0x854], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4161a6
push esi
nop
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x22c]
push 0x104
push edx
mov dword [ebp - 0x84c], 0xf
call fcn.0053eeab
push 0x56825c
lea eax, [ebp - 0x22c]
push 0x104
push eax
call fcn.0053e396
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x22c]
push 0x104
push edx
call fcn.0053e396
push str.Path
lea eax, [ebp - 0x844]
push 0x104
push eax
call fcn.0053eeab
lea ecx, [ebp - 0x22c]
push ecx
push str._INSTHL32___szSharedRes___s_n
call fcn.00415550
add esp, 0x38
lea edx, [ebp - 0x850]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x22c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416173
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x63c]
push edx
mov edx, dword [ebp - 0x850]
lea eax, [ebp - 0x85c]
push eax
push edi
lea ecx, [ebp - 0x844]
push ecx
push edx
mov dword [ebp - 0x84c], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push str._INSTHL32__szPrinterName:__s_n
call fcn.00415550
lea eax, [ebp - 0x63c]
push eax
push str._INSTHL32__szPath:__s_n
call fcn.00415550
add esp, 0x10
lea ecx, [ebp - 0x63c]
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416116
cmp dx, di
je 0x416112
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416116
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4160f0
xor eax, eax
jmp 0x41611b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x416160
push str.svrapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x41614f
push str.NetShareDel
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x416148
push edi
lea ecx, [ebp - 0x24]
push ecx
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x24]
push edx
push str._INSTHL32___szTemp___s_n
call fcn.00415550
add esp, 8
mov eax, dword [ebp - 0x850]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x850], edi
mov eax, dword [ebp - 0x854]
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x84c]
push ecx
inc eax
lea edx, [ebp - 0x24]
push edx
push eax
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x848]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x415ff0
pop esi
mov eax, dword [ebp - 0x848]
cmp eax, edi
je 0x4161b7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0053e1ad
mov esp, ebp
pop ebp
ret