Function at 0x43edc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43ee8a
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoPrinterTabs
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ee66
cmp word [esp + 0x20], 1
jne 0x43ee84
push eax
push 1
push 0xf1
push 0x28f8
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ee84
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push str.NoPrinterTabs
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ef24
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoDeletePrinter
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ef00
cmp word [esp + 0x20], 1
jne 0x43ef1e
push eax
push 1
push 0xf1
push 0x28f9
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ef1e
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoDeletePrinter
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43efbe
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoAddPrinter
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ef9a
cmp word [esp + 0x20], 1
jne 0x43efb8
push eax
push 1
push 0xf1
push 0x28fa
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43efb8
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoAddPrinter
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f058
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoPrinters
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43f034
cmp word [esp + 0x20], 1
jne 0x43f052
push eax
push 1
push 0xf1
push 0x28fb
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43f052
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoPrinters
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28fc
push str.DisableWebPrinting
mov edx, str.SOFTWAREPoliciesMicrosoftWindows_NTPrinters
mov ecx, 0x80000002
call fcn.0043da20
push 0x28fd
push str.DisableServerThread
mov edx, str.SystemCurrentControlSetControlPrint
mov ecx, 0x80000002
call fcn.0043da20
push 0x28fe
push str.BeepEnabled
mov edx, str.SYSTEMCurrentControlSetControlPrint
mov ecx, 0x80000002
call fcn.0043da20
push 0x28ff
push str.NoWideTextPrinting
mov edx, str.SoftwareMicrosoftOffice10.0WordOptions
mov ecx, 0x80000001
call fcn.0043da20
push 0x2900
push str.EventLog
mov edx, str.SYSTEMCurrentControlSetControlPrintProviders
mov ecx, 0x80000002
call fcn.0043da20
mov ecx, dword [esp + 0x848]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x814
ret