Function at 0x45626b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xec4]
sub esp, 0xf44
push ebx
push esi
push edi
mov eax, dword [0x721bb0]
push 9
pop ecx
mov dl, byte [0x6d05b8]
mov esi, str.SYSTEMCurrentControlSetControlClass
lea edi, [ebp + 0x8a8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x37
mov dword [ebp + 0xec0], eax
pop ecx
xor eax, eax
lea edi, [ebp + 0x8cf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp + 0xab0], dl
lea edi, [ebp + 0xab1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp + 0xbb4], dl
lea edi, [ebp + 0xbb5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x78]
push eax
xor ebx, ebx
push 0x20019
push ebx
lea eax, [ebp + 0x8a8]
push eax
push 0x80000002
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x6c], 0x104
mov byte [ebp - 0x5d], bl
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4565c9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4565c0
cmp dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], ebx
jbe 0x4565c0
push 0x104
lea eax, [ebp + 0x7a4]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegEnumKeyA]
test eax, eax
jne 0x4565ac
mov cl, byte [ebp + eax + 0x8a8]
mov byte [ebp + eax + 0xcb8], cl
inc eax
cmp cl, bl
jne 0x45635b
lea edi, [ebp + 0xcb8]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x456375
mov esi, 0x6d5828
lea eax, [ebp + 0x7a4]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45638c
lea edi, [ebp + 0xcb8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x45639c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x68]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0xcb8]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4565b1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xdbc]
push eax
push ebx
push ebx
push str.Class
push dword [ebp - 0x68]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x456405
push dword [ebp - 0x68]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x4565b1
lea eax, [ebp + 0xdbc]
push str.MEDIA
push eax
call fcn.006a481c
test eax, eax
pop ecx
pop ecx
jne 0x4565a3
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4565b1
cmp dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], ebx
jbe 0x4565a3
push 0x104
lea eax, [ebp + 0x7a4]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x68]
call dword [sym.imp.advapi32.dll_RegEnumKeyA]
test eax, eax
jne 0x456529
mov cl, byte [ebp + eax + 0xcb8]
mov byte [ebp + eax + 0x9ac], cl
inc eax
cmp cl, bl
jne 0x45646b
lea edi, [ebp + 0x9ac]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x456485
mov esi, 0x6d5828
lea eax, [ebp + 0x7a4]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45649c
lea edi, [ebp + 0x9ac]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4564ac
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x64]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x9ac]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4565a3
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xdbc]
push eax
push ebx
push ebx
push str.Driver
push dword [ebp - 0x64]
call esi
test eax, eax
jne 0x456520
lea eax, [ebp + 0xdbc]
push 0x1209a98
push eax
call fcn.006a481c
test eax, eax
pop ecx
pop ecx
je 0x45653a
push dword [ebp - 0x64]
call dword [sym.imp.advapi32.dll_RegCloseKey]
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x80]
jb 0x45644b
jmp 0x4565a3
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xdbc]
push eax
push ebx
push ebx
push str.DriverDesc
push dword [ebp - 0x64]
mov byte [ebp - 0x5d], 1
call esi
test eax, eax
jne 0x45656c
mov cl, byte [ebp + eax + 0xdbc]
mov byte [ebp + eax + 0xbb4], cl
inc eax
cmp cl, bl
jne 0x456559
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xdbc]
push eax
push ebx
push ebx
push str.DriverVersion
push dword [ebp - 0x64]
call esi
test eax, eax
jne 0x45659a
mov cl, byte [ebp + eax + 0xdbc]
mov byte [ebp + eax + 0xab0], cl
inc eax
cmp cl, bl
jne 0x456587
push dword [ebp - 0x64]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [ebp - 0x68]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp byte [ebp - 0x5d], bl
jne 0x4565c0
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x7c]
jb 0x45633b
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor ecx, ecx
inc ecx
mov edi, 0x6d05b8
mov esi, 0x1209af8
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x45670c
push 0x1209a98
lea eax, [ebp - 0x5c]
push str._Sound_Card_Drv__t:___s__n
push eax
call fcn.006935d4
lea eax, [ebp - 0x5c]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4565fb
mov edi, dword [ebp + 0xecc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x45660b
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
inc ecx
mov edi, 0x6d05b8
lea esi, [ebp + 0xbb4]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x45666e
lea eax, [ebp + 0xbb4]
push eax
lea eax, [ebp - 0x5c]
push str._Sound_Card_t_t:___s__n
push eax
call fcn.006935d4
lea eax, [ebp - 0x5c]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x456654
mov edi, dword [ebp + 0xecc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x456664
jmp 0x4566a1
push 0x1209af8
lea eax, [ebp - 0x5c]
push str._Sound_Card_t_t:___s__n
push eax
call fcn.006935d4
lea eax, [ebp - 0x5c]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x456689
mov edi, dword [ebp + 0xecc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x456699
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
inc ecx
mov edi, 0x6d05b8
lea esi, [ebp + 0xab0]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x45670c
lea eax, [ebp + 0xab0]
push eax
lea eax, [ebp - 0x5c]
push str._Sound_Version_t_t:___s__n
push eax
call fcn.006935d4
lea eax, [ebp - 0x5c]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4566e2
mov ecx, dword [ebp + 0xecc]
sub eax, edx
mov esi, edx
dec ecx
mov dl, byte [ecx + 1]
inc ecx
cmp dl, bl
jne 0x4566f4
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xec0]
pop edi
pop esi
pop ebx
call fcn.00692fc7
add ebp, 0xec4
leave
ret