Function at 0x101bf6e
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x794
mov eax, dword [0x102c22c]
or dword [ebp - 0x758], 0xffffffff
or dword [ebp - 0x760], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x75c], edi
mov dword [ebp - 0x764], eax
je 0x101c401
push eax
push 4
lea ecx, [ebp - 0x764]
push ecx
push eax
push 0xa
push esi
push ebx
mov dword [ebp - 0x770], 1
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x101bffc
test byte [ebp - 0x764], 0x20
je 0x101bffc
push 0x1007500
push 0x103
lea eax, [ebp - 0x108]
push eax
call fcn.0100b4e5
push edi
push 0x10074dc
jmp 0x101c04f
push 0x10074d0
mov edi, 0x1001aa4
push edi
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0100d9ee
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x778]
push eax
push 0xa
push dword [esi + 0x14]
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_Property_ExW]
cmp eax, 0x1a
je 0x101c05b
push dword [ebp - 0x75c]
push 0x10074a0
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x101c36e
push 0x2001f
push 2
push 0
push 1
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, 0xffffffff
mov dword [ebp - 0x758], eax
jne 0x101c08a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007480
jmp 0x101c236
lea ecx, [ebp - 0x774]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x768]
push ecx
push 0
push 0x1007478
push eax
mov dword [ebp - 0x774], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101c34a
cmp dword [ebp - 0x768], 1
jne 0x101c34a
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0100d9ee
add esp, 0x10
push dword [ebp - 0x758]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x758], 0xffffffff
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
mov dword [ebp - 0x438], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
je 0x101c401
or dword [ebp - 0x430], 0x4000800
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
mov dword [ebp - 0x434], 0x800000
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
test eax, eax
jne 0x101c154
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100743c
jmp 0x101c236
push 2
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
jne 0x101c170
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007404
jmp 0x101c19d
lea eax, [ebp - 0x754]
push eax
push 0
push 2
push esi
push ebx
mov dword [ebp - 0x754], 0x31c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoA]
test eax, eax
jne 0x101c1d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10073b8
call fcn.01015c5a
push 0x10074d0
push edi
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0100d9ee
push dword [ebp - 0x75c]
push 0x10073a0
call fcn.01015c5a
add esp, 0x20
jmp 0x101c36e
push esi
push ebx
push 0x17
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x101c1f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007370
call fcn.01015c5a
pop ecx
jmp 0x101c347
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
mov dword [ebp - 0x438], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
je 0x101c401
call dword [sym.imp.SETUPAPI.dll_SetupOpenFileQueue]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x760], edi
jne 0x101c242
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007340
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x101c401
or dword [ebp - 0x434], 8
or byte [ebp - 0x42e], 8
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
mov dword [ebp - 0x420], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
test eax, eax
jne 0x101c281
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100743c
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x101c3b2
push esi
push ebx
push 0x15
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x101c2a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100730c
jmp 0x101c1eb
mov eax, dword [0x108f9bc]
mov dword [ebp - 0x780], eax
lea eax, [ebp - 0x794]
push eax
push edi
mov dword [ebp - 0x784], 1
call fcn.0100d9b8
test eax, eax
je 0x101c33d
cmp dword [ebp - 0x784], 0
je 0x101c33d
lea eax, [ebp - 0x108]
push eax
call fcn.01018ad9
cmp eax, 1
jne 0x101c36e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x103
push edi
lea eax, [ebp - 0x310]
push eax
push 0x1007308
lea eax, [ebp - 0x20c]
push eax
call fcn.01015121
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.01015121
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d9c2
jmp 0x101c36e
push 0x10072e0
call fcn.01015c5a
pop ecx
jmp 0x101c393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10072bc
call fcn.01015c5a
push dword [ebp - 0x75c]
push 0x10073a0
call fcn.01015c5a
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push esi
push ebx
call fcn.0101898c
mov eax, dword [0x106e504]
test eax, eax
je 0x101c393
push 0
push dword [ebp - 0x75c]
push eax
call fcn.01016588
push 2
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
cmp dword [ebp - 0x758], 0xffffffff
je 0x101c3b2
push dword [ebp - 0x758]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x760], 0xffffffff
je 0x101c401
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
mov dword [ebp - 0x438], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
je 0x101c3f5
and dword [ebp - 0x434], 0xfffffff7
or dword [ebp - 0x420], 0xffffffff
lea eax, [ebp - 0x438]
push eax
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
push dword [ebp - 0x760]
call dword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.0101439a
leave
ret 0xc