Function at 0x403370
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x194
push ebx
push ebp
mov ebp, dword [esp + 0x1a0]
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareBrotherPeer_to_Peer_Print_LPR
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
mov dword [0x416840], 0
mov byte [ebp], 0
mov ecx, dword [0x415f98]
mov dword [esp + 0x14], 1
mov eax, ecx
lea edx, [esp + 0x1c]
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edi, dword [ecx + eax*4 + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x1c]
cmp al, 0x5c
je 0x403b08
mov ecx, dword [0x415e94]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, 5
jne 0x4034d0
lea ecx, [esp + 0x1c]
push ecx
push str.SystemCurrentControlSetcontrolPrintMonitorsStandard_TCP_IP_PortPorts
push 0x412948
push ebp
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push ebp
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40377b
lea eax, [esp + 0x1ac]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.IPAddress
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40377b
mov eax, dword [esp + 0x1b0]
test eax, eax
je 0x403490
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403769
mov ecx, dword [0x415f98]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x41295c
push 0x41296c
push ebp
call ebx
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037ba
mov esi, 4
cmp ecx, esi
jl 0x4035aa
lea ecx, [esp + 0x1c]
push ecx
push str.SystemCurrentControlSetcontrolPrintMonitorsLPR_PortPorts
push 0x4129b8
push ebp
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push ebp
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40377b
lea eax, [esp + 0x1ac]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Server_Name
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40377b
mov eax, dword [esp + 0x1b0]
test eax, eax
je 0x40356a
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403769
mov ecx, dword [0x415f98]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x4129cc
push 0x4129dc
push ebp
call ebx
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037ba
cmp al, 0x42
je 0x4035b6
cmp al, 0x62
jne 0x4037ba
mov al, byte [esp + 0x1d]
cmp al, 0x4c
je 0x4035c6
cmp al, 0x6c
jne 0x4037ba
mov al, byte [esp + 0x1e]
cmp al, 0x50
je 0x4035d6
cmp al, 0x70
jne 0x4037ba
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x7c]
push ecx
push edx
push 0x4129e8
push ebp
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebp
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40377b
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.ResolveIP
push ecx
call esi
test eax, eax
jne 0x40367e
mov al, byte [esp + 0x1c]
test al, al
je 0x40365d
mov edx, dword [0x4129fc]
mov eax, dword [0x412a00]
mov ecx, dword [0x412a04]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], eax
jmp 0x403697
mov edx, dword [str.PrinterIP]
mov eax, dword [0x412a0c]
mov cx, word [0x412a10]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], eax
mov word [esp + 0x64], cx
jmp 0x40369b
mov edx, dword [str.PrinterAddr]
mov eax, dword [0x412a18]
mov ecx, dword [0x412a1c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
lea edx, [esp + 0x1ac]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x68]
push 0
push edx
push eax
mov dword [esp + 0x2c], 1
call esi
test eax, eax
jne 0x403730
mov eax, dword [esp + 0x1b0]
test eax, eax
je 0x4036f0
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403769
mov ecx, dword [0x415f98]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [esp + 0x1c]
push edx
push eax
push str.Brnipmon.exe
push str._s___s___s
push ebp
call ebx
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037ba
mov byte [ebp], 0
mov ecx, dword [0x415f98]
mov eax, ecx
lea edx, [esp + 0x1c]
shl eax, 3
sub eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [0x415ec0]
mov edi, dword [eax + ecx*4 + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4037ba
mov byte [ebp], 0
mov ecx, dword [0x415f98]
mov eax, ecx
lea edx, [esp + 0x1c]
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edi, dword [ecx + eax*4 + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp], 0
jne 0x403b08
cmp dword [0x415e94], 5
jg 0x403b08
lea ecx, [esp + 0x1c]
push str.lpt1:
push ecx
call fcn.004105e0
add esp, 8
test eax, eax
je 0x4038fd
lea edx, [esp + 0x1c]
push str.lpt2:
push edx
call fcn.004105e0
add esp, 8
test eax, eax
je 0x4038fd
lea eax, [esp + 0x1c]
push str.lpt3:
push eax
call fcn.004105e0
add esp, 8
test eax, eax
je 0x4038fd
cmp dword [0x415e94], 4
jge 0x403b08
lea ecx, [esp + 0x1c]
push str.BRUSB
push ecx
mov byte [esp + 0x29], 0
call fcn.004105e0
add esp, 8
test eax, eax
jne 0x403b08
mov ecx, dword [0x415f98]
mov dword [0x416840], 2
mov eax, ecx
lea esi, [esp + 0x1c]
shl eax, 3
sub eax, ecx
or ecx, 0xffffffff
mov dword [esp + 0x18], esi
lea edx, [eax + eax*2]
mov eax, dword [0x415ec0]
mov edi, dword [eax + edx*4 + 0xc]
lea edx, [eax + edx*4]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1b0]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4038cf
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
mov eax, dword [edx + 4]
lea ecx, [esp + 0x1c]
push eax
push ecx
push str.Busmx99a.exe
push str._s__s__s
push ebp
call ebx
add esp, 0x14
push 1
call fcn.00403280
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
mov dword [0x416840], 1
call fcn.00403b20
test eax, eax
je 0x40391f
mov byte [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
mov eax, dword [esp + 0x1b0]
test eax, eax
je 0x403956
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
mov ecx, dword [0x415f98]
mov eax, ecx
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 4]
lea eax, [esp + 0x1c]
push edx
push eax
push str.Brcdcmon.exe
push 0x412a64
push ebp
call ebx
mov edx, dword [0x415e80]
add esp, 0x14
lea ecx, [esp + 0xa4]
push 0x100
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0xa4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa4]
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0xa4]
dec ecx
sub eax, 3
lea edi, [esp + 0xa4]
push edx
push 0x40
mov byte [ecx + eax], 0
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x415ec0]
repne scasb al, byte es:[edi]
mov ecx, dword [0x412a70]
lea eax, [esp + 0x24]
mov dword [edi - 1], ecx
mov ecx, dword [0x415f98]
push eax
mov eax, ecx
shl eax, 3
sub eax, ecx
push 0x415ee4
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 + 0x10]
push eax
push 0x412a74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x1c]
test al, al
je 0x403adb
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x403a6c
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x415f98]
lea edx, [esp + 0x1c]
mov eax, ecx
push 0x412a7c
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
push edx
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 0x10]
push edx
push 0x412a88
jmp 0x403a93
mov ecx, dword [0x415f98]
push 0x412a90
mov eax, ecx
push 0
shl eax, 3
sub eax, ecx
mov ecx, dword [0x415ec0]
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4 + 0x10]
push edx
push 0x412a9c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
mov eax, dword [str.Disable]
mov ecx, dword [0x412aa8]
dec edi
push edx
mov dword [edi], eax
mov dword [edi + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x403b08
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
mov ecx, dword [0x415f98]
mov edx, dword [0x415ec0]
mov eax, ecx
push 0x412aac
shl eax, 3
sub eax, ecx
push 0
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*4 + 0x10]
push eax
push 0x412ab8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret