Function at 0x6101f0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x404
mov eax, 0x6103fc89
call fcn.6102b349
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x400], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3dc], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.6100d83e
mov byte [ebp - 4], 2
push dword [ebp + 8]
push 0x61004e40
push 1
call fcn.6101b566
add esp, 0xc
push 0x61004e24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x3f4], eax
cmp eax, ebx
jne 0x6101f152
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6101f59c
push 0x61004e0c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3f8], eax
cmp eax, ebx
jne 0x6101f175
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6101f590
lea eax, [ebp - 0x3e8]
push eax
push ebx
push 0x104
lea eax, [ebp - 0x3a8]
push eax
push 8
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x6101f579
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
jne 0x6101f579
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3cc]
call fcn.6100de0c
push dword [ebp - 0x3cc]
push dword [ebp + 8]
push 0x61004dd4
push 1
call fcn.6101b566
add esp, 0x10
lea ecx, [ebp - 0x3dc]
call fcn.61019681
mov edi, dword [ebp - 0x3dc]
push 4
push ebx
push ebx
push ebx
mov ecx, edi
call fcn.61011088
test eax, eax
je 0x6101f58b
lea ecx, [ebp - 0x3c4]
push ecx
mov dword [ebp - 0x3c4], 0x1c
mov eax, dword [edi + 8]
push ebx
push eax
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e4], ebx
mov dword [ebp - 0x3e0], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
jmp 0x6101f55d
inc dword [ebp - 0x3e0]
or dword [ebp - 0x3d0], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.6100d83e
mov byte [ebp - 4], 3
mov eax, dword [edi + 8]
push ebx
push 0xc8
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x3c4]
push ecx
push eax
mov dword [ebp - 0x3f0], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x6101f27e
call esi
mov esi, eax
jmp 0x6101f4f9
mov eax, dword [edi + 8]
push 0x20019
push 2
push ebx
push 1
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [ebp - 0x3d8], eax
cmp eax, 0xffffffff
jne 0x6101f2f7
call esi
mov esi, eax
mov eax, 0xe0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
mov eax, esi
jne 0x6101f2c3
and eax, 0xffff
or eax, 0x800f0000
jmp 0x6101f2d1
cmp esi, ebx
jle 0x6101f2d1
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x800f0204
je 0x6101f531
lea eax, [ebp - 0x1a0]
push eax
push 0x61004d80
push 2
call fcn.6101b566
add esp, 0xc
jmp 0x6101f4f9
push 0x104
lea ecx, [ebp - 0x3c8]
call fcn.61012308
lea ecx, [ebp - 0x3fc]
push ecx
push eax
push ebx
push ebx
push 0x61004950
push dword [ebp - 0x3d8]
mov dword [ebp - 0x3fc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6101f35c
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
mov esi, eax
call fcn.61011dc1
lea eax, [ebp - 0x1a0]
push eax
push 0x61004d28
push 2
call fcn.6101b566
add esp, 0xc
jmp 0x6101f4e5
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
call fcn.61011dc1
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x3cc]
call fcn.61013bc2
test eax, eax
jne 0x6101f4ce
lea eax, [ebp - 0x1a0]
push eax
push dword [ebp - 0x3c8]
push 0x61004ca0
push 1
call fcn.6101b566
add esp, 0x10
push ebx
push dword [ebp - 0x3b0]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x3f0], 1
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
je 0x6101f461
cmp eax, 0x25
je 0x6101f461
lea eax, [ebp - 0x1a0]
push eax
push 0x61004bf8
push 1
call fcn.6101b566
add esp, 0xc
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov dword [ebp - 0x3d0], eax
cmp eax, 0xffffffff
jne 0x6101f407
call esi
mov esi, eax
jmp 0x6101f4e5
push dword [ebp - 0x400]
lea eax, [ebp - 0x1a0]
push dword [ebp - 0x3f8]
push ecx
mov ecx, esp
mov dword [ebp - 0x408], esp
push eax
call fcn.6100dfda
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3cc]
call fcn.61011da0
push ecx
mov ecx, esp
mov dword [ebp - 0x410], esp
push eax
call fcn.6100dfda
mov byte [ebp - 4], 5
push dword [ebp - 0x3d0]
mov byte [ebp - 4], 3
call fcn.6101e9ce
mov esi, eax
cmp esi, ebx
jne 0x6101f4d0
jmp 0x6101f4ce
lea eax, [ebp - 0x1a0]
push eax
push 0x61004b68
push 1
call fcn.6101b566
add esp, 0xc
push ebx
push 4
lea ecx, [ebp - 0x3d4]
push ecx
push ebx
push 0xa
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x3d4], ebx
mov eax, dword [edi + 8]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x6101f3fe
or dword [ebp - 0x3d4], 0x20
mov eax, dword [edi + 8]
push 4
lea ecx, [ebp - 0x3d4]
push ecx
push 0xa
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
je 0x6101f3fe
xor esi, esi
cmp dword [ebp - 0x3d0], 0xffffffff
je 0x6101f4e5
push dword [ebp - 0x3d0]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp dword [ebp - 0x3d8], ebx
je 0x6101f4f9
push dword [ebp - 0x3d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x6101f531
cmp dword [ebp - 0x3f0], ebx
je 0x6101f527
lea eax, [ebp - 0x1a0]
push eax
push 0x61004b10
push 3
call fcn.6101b566
add esp, 0xc
mov dword [ebp - 0x3ec], 1
jmp 0x6101f531
mov dword [ebp - 0x3e4], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c8]
call fcn.6100d793
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x3c4]
push ecx
push dword [ebp - 0x3e0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6101f231
call esi
cmp eax, 0x103
je 0x6101f575
call esi
jmp 0x6101f16e
xor esi, esi
jmp 0x6101f590
push dword [ebp + 8]
push 0x61004aa0
push 3
call fcn.6101b566
add esp, 0xc
mov esi, 0x65b
push dword [ebp - 0x3f4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
jne 0x6101f5d1
cmp dword [ebp - 0x3ec], ebx
je 0x6101f5bb
push 0x610049f0
push 3
call fcn.6101b566
mov esi, 0x643
jmp 0x6101f5cf
cmp dword [ebp - 0x3e4], ebx
je 0x6101f5d1
push 0x61004960
push 2
call fcn.6101b566
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.6100d793
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x6101f5f4
mov ecx, edi
call fcn.6100d0cb
mov dword [ebp - 0x3dc], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
call fcn.6102b3db
ret 8