Function at 0x417d72
Capabilities:
Print debug messages
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x19c
mov eax, dword [ebp + 0x7c]
push ebx
push esi
mov esi, dword [eax]
xor ebx, ebx
cmp esi, ebx
je 0x41812d
cmp dword [esi + 0x34], ebx
push edi
mov dword [ebp + 0x68], fcn.00417d72
jne 0x417dfc
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
push 1
mov dword [ebp + 0x7c], eax
call edi
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x417dd8
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x76
push ebx
call edi
push 0x75
push ebx
mov dword [ebp + 0x7c], eax
call edi
push ebx
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp + 0x7c], 0x320
jbe 0x417de9
cmp edi, 0x258
ja 0x417df0
mov dword [esi + 0x30], 1
inc dword [esi + 0x34]
and dword [esi + 0x38], 0
jmp 0x418106
mov ecx, dword [esi + 0x38]
mov edi, ecx
and edi, 3
xor eax, eax
lea edx, [eax + 0x41]
mov word [ebp + eax*2 - 0x28], dx
lea edx, [eax + 0x61]
mov word [ebp + eax*2 + 0xc], dx
inc eax
cmp eax, 0x1a
jb 0x417e06
xor eax, eax
lea edx, [eax + 0x30]
mov word [ebp + eax*2 + 0x40], dx
inc eax
cmp eax, 0xa
jb 0x417e1e
cmp ecx, 0x80
jne 0x417fba
push 0x895bade5
lea edx, [ebp + 0x64]
mov eax, esi
call fcn.004179c6
cmp eax, ebx
pop ecx
mov dword [ebp + 0x58], eax
je 0x418103
cmp dword [ebp + 0x64], ebx
je 0x418103
push 0xe4e1cad6
lea eax, [esi + 0xa0]
push ebx
push eax
call fcn.00401af5
add esp, 0xc
cmp eax, ebx
je 0x418103
mov ebx, dword [esi + 0x1c]
add ebx, eax
je 0x418103
xor eax, eax
lea ecx, [ebp + 0x7c]
push ecx
push eax
push eax
push 5
mov dword [ebp + 0x7c], eax
call ebx
push dword [ebp + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 8
push dword [esi + 0x18]
call edi
test eax, eax
mov dword [ebp + 0x6c], eax
je 0x418103
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x7c]
push eax
push 5
call ebx
test eax, eax
jne 0x417fb2
push 0x1000
push 8
push dword [esi + 0x18]
call edi
test eax, eax
mov dword [ebp + 0x70], eax
je 0x417fb2
mov edi, dword [ebp + 0x6c]
movzx eax, word [edi + 0x38]
mov ebx, dword [ebp + 0x70]
push 0
push 0
push 0x1000
push ebx
shr eax, 1
push eax
push dword [edi + 0x3c]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x417f97
cmp eax, 0xfff
jge 0x417f97
mov byte [eax + ebx], 0
xor ebx, ebx
cmp dword [ebp + 0x64], ebx
jbe 0x417f97
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp + 0x70]
mov edx, eax
jmp 0x417f2e
mov ecx, dword [ebp + 0x60]
movzx eax, byte [ecx]
inc ecx
cmp eax, 0x41
mov dword [ebp + 0x60], ecx
jl 0x417f42
cmp eax, 0x5a
jg 0x417f42
add eax, 0x20
movzx ecx, byte [edx]
inc edx
cmp ecx, 0x41
jl 0x417f53
cmp ecx, 0x5a
jg 0x417f53
add ecx, 0x20
test eax, eax
je 0x417f5b
cmp eax, ecx
je 0x417f2b
sub eax, ecx
je 0x417f80
push dword [ebp + 0x5c]
call fcn.00419020
lea ebx, [ebx + eax + 1]
mov eax, dword [ebp + 0x58]
add eax, ebx
cmp byte [eax], 0
pop ecx
mov dword [ebp + 0x5c], eax
je 0x417f97
cmp ebx, dword [ebp + 0x64]
jb 0x417f24
jmp 0x417f97
push dword [edi + 0x3c]
mov dword [ebp + 0x68], 0x4179fb
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esi + 0x30], 1
mov eax, dword [edi]
test eax, eax
je 0x417fa4
add edi, eax
jmp 0x417edc
push dword [ebp + 0x70]
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp + 0x6c]
jmp 0x4180f8
call fcn.004190ab
push 8
cdq
pop ecx
idiv ecx
mov dword [ebp + 0x7c], 0
mov ebx, edx
add ebx, 4
je 0x417ff6
call fcn.004190ab
cdq
push 0x3e
pop ecx
idiv ecx
mov ecx, dword [ebp + 0x7c]
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], ebx
mov ax, word [ebp + edx*2 - 0x28]
mov word [ebp + ecx*2 - 0x128], ax
jb 0x417fd3
and word [ebp + ebx*2 - 0x128], 0
test edi, edi
jne 0x41801f
inc dword [esi + 0x34]
cmp dword [esi + 0x34], 0x330
jne 0x418103
mov dword [ebp + 0x68], 0x417a12
jmp 0x418103
add ebx, edi
shl edi, 0xa
push edi
push 8
push dword [esi + 0x18]
mov dword [ebp + 0x70], edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test bl, 1
mov edi, eax
je 0x4180a7
xor ebx, ebx
cmp edi, ebx
je 0x418103
inc dword [esi + 0x24]
lea eax, [ebp + 0x7c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x128]
push eax
push SysReAllocStringLen
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4180a3
inc dword [esi + 0x28]
lea eax, [ebp + 0x70]
push eax
push edi
lea eax, [ebp + 0x54]
push eax
push ebx
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418092
mov dword [ebp + 0x6c], 1
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x6c], ebx
je 0x4180a3
inc dword [esi + 0x3c]
push edi
push ebx
jmp 0x4180fa
xor eax, eax
cmp edi, eax
je 0x418103
mov ecx, dword [ebp + 0x70]
push eax
push eax
push 3
push eax
push 7
push SysReAllocStringLen
lea eax, [ebp - 0x128]
push eax
mov dword [ebp + 0x7c], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4180f7
push 0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x7c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x60], 0
je 0x4180f7
inc dword [esi + 0x3c]
push edi
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc dword [esi + 0x38]
mov eax, dword [ebp + 0x68]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xf
mov ecx, dword [ecx + 4]
lea eax, [esi + 0x10]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
add ecx, 4
mov dword [esi + 0x14], ecx
mov dword [ecx], eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret