Function at 0x403d90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x388
mov rax, qword [0x00417b90]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov r9, rcx
mov qword [rsp + 0x3a0], rbx
mov ebx, edx
lea rdx, str._s_sPorts
lea r8, str.SystemCurrentControlSetControlPrintMonitors
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x48]
lea rdx, [rsp + 0x270]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4043a8
mov qword [rsp + 0x380], rdi
xor edi, edi
mov eax, edi
nop
mov rcx, qword [rsp + 0x48]
mov edx, eax
add eax, 1
lea r8, [rsp + 0x160]
mov r9d, 0x104
mov dword [0x004190f8], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x403e40
mov eax, dword [0x004190f8]
jmp 0x403e10
mov eax, dword [0x004190f8]
sub eax, 1
test ebx, ebx
mov dword [0x004190f8], eax
je 0x404395
movsxd rcx, eax
mov qword [rsp + 0x3a8], rsi
shl rcx, 3
call fcn.0040a4e0
mov esi, edi
mov qword [0x004190f0], rax
mov eax, dword [0x004190f8]
test eax, eax
jle 0x403ea7
mov rbx, rdi
mov ecx, 0x38c
call fcn.0040a4e0
mov rcx, qword [0x004190f0]
add esi, 1
mov qword [rbx + rcx], rax
mov eax, dword [0x004190f8]
add rbx, 8
cmp esi, eax
jl 0x403e81
test eax, eax
mov rsi, qword [rsp + 0x3a8]
jle 0x404395
mov rbx, rdi
nop
nop
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x160]
mov r9d, 0x104
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x0041762c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404382
mov rcx, qword [0x004190f0]
lea rdx, [rsp + 0x160]
mov rcx, qword [rbx + rcx]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.PrintMode
add r8, 0x104
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.DatTmout
add r8, 0x10c
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.CmdTmout
add r8, 0x108
call fcn.00403cf0
test eax, eax
jne 0x403fdd
mov rax, qword [0x004190f0]
mov rcx, qword [rbx + rax]
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x108], eax
mov rax, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
lea rdx, str.PortNum
mov r8, qword [rbx + rax]
add r8, 0x110
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.NonSpool
add r8, 0x380
call fcn.00403cf0
mov rax, qword [0x004190f0]
mov r8, qword [rbx + rax]
cmp dword [r8 + 0x104], 0
jne 0x4040e2
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x41
mov rax, qword [rbx + rax]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
add rax, 0x128
lea r9, [rsp + 0x40]
lea rdx, str.HostName
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 0x21
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
add rcx, 0x169
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
lea rdx, str.PortName
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.UseSCPorts
add r8, 0x384
call fcn.00403cf0
jmp 0x404377
mov rcx, qword [rsp + 0x38]
lea rdx, str.BASE64
add r8, 0x114
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.Chunked
add r8, 0x118
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.MaxChunk
add r8, 0x11c
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.ProxyNum
add r8, 0x120
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.UseProxy
add r8, 0x124
call fcn.00403cf0
mov r11, qword [0x004190f0]
mov rcx, qword [rsp + 0x38]
mov r8, qword [rbx + r11]
lea rdx, str.JobSheets
add r8, 0x388
call fcn.00403cf0
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 9
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rcx, 0x18a
mov qword [rsp + 0x28], rax
lea rdx, str.Language
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11, qword [0x004190f0]
xor edx, edx
mov rcx, qword [rbx + r11]
mov r8d, 0x105
add rcx, 0x193
call fcn.00409d50
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 0x105
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rcx, 0x193
mov qword [rsp + 0x28], rax
lea rdx, str.ProxyName
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 0x61
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rcx, 0x298
mov qword [rsp + 0x28], rax
lea rdx, [0x0041296c]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11, qword [0x004190f0]
xor ecx, ecx
mov rax, qword [rbx + r11]
mov qword [rax + 0x2f9], rcx
mov qword [rax + 0x301], rcx
mov qword [rax + 0x309], rcx
mov qword [rax + 0x311], rcx
mov qword [rax + 0x319], rcx
mov qword [rax + 0x321], rcx
mov qword [rax + 0x329], rcx
mov qword [rax + 0x331], rcx
mov byte [rax + 0x339], cl
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 0x41
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rcx, 0x2f9
mov qword [rsp + 0x28], rax
lea rdx, str.UserName
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [0x004190f0]
mov dword [rsp + 0x30], 0x41
mov rcx, qword [rbx + rax]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
add rcx, 0x33a
mov qword [rsp + 0x28], rax
lea rdx, str.PassWord
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11, qword [0x004190f0]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbx + r11]
mov dword [rcx + 0x37c], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
add rbx, 8
cmp edi, dword [0x004190f8]
jl 0x403ec0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x380]
mov eax, 1
mov rbx, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.00409d20
add rsp, 0x388
ret
jmp 0x403d90