Function at 0x1002cc50
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1009c6ac
mov eax, dword fs:[0]
push eax
sub esp, 0xab8
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0xab0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0xacc]
mov dword fs:[0], eax
mov eax, dword [esp + 0xadc]
push 2
xor esi, esi
push esi
push esi
push 0x100a66f0
mov dword [esp + 0x3c], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1002d219
xor eax, eax
lea ecx, [esp + 0x64]
push ecx
push esi
push ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x70], 0x1c
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1002d1ed
push 0x1fe
lea eax, [esp + 0xca]
xor edx, edx
push esi
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], 4
mov word [esp + 0xd0], dx
call fcn.10079c60
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0xcc]
push edx
lea eax, [esp + 0x30]
push eax
push 9
lea ecx, [esp + 0x78]
push ecx
push ebx
call ebp
test eax, eax
je 0x1002d1cf
lea edx, [esp + 0x18]
push edx
push 0x200
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
lea edx, [esp + 0x78]
push edx
push ebx
call ebp
test eax, eax
je 0x1002d1cf
lea eax, [esp + 0x18]
push eax
push 0x200
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x30]
push edx
push 0x16
lea eax, [esp + 0x78]
push eax
push ebx
call ebp
cmp eax, esi
je 0x1002ce7d
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0xc8]
call fcn.10002500
mov dword [esp + 0xad4], esi
mov edx, dword [esp + 0x3c]
push 0x100aaf68
push edx
call fcn.10075d21
add esp, 8
cmp eax, esi
jne 0x1002ce69
lea eax, [esp + 0x18]
push eax
push 0x200
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x30]
push edx
push 4
lea eax, [esp + 0x78]
push eax
push ebx
call ebp
cmp eax, esi
je 0x1002ce69
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0xc8]
call fcn.10002500
mov byte [esp + 0xad4], 1
lea edi, [esp + 0x28]
call fcn.1000fad0
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], esi
jl 0x1002ce4d
push 0x100aaf70
push eax
call fcn.10075f11
add esp, 8
cmp eax, esi
je 0x1002ce4d
sub eax, dword [esp + 0x28]
sar eax, 1
cmp eax, 0xffffffff
jne 0x1002ce58
mov edx, dword [esp + 0x2c]
mov dword [edx + 0x10], 1
mov byte [esp + 0xad4], 0
lea ecx, [esp + 0x28]
call fcn.100025b0
mov dword [esp + 0xad4], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.100025b0
lea eax, [esp + 0x18]
push eax
push 0x200
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x30]
push edx
push 0xe
lea eax, [esp + 0x78]
push eax
push ebx
call ebp
cmp eax, esi
je 0x1002d1cf
push 0xf003f
push 1
push esi
push 1
lea ecx, [esp + 0x74]
push ecx
push ebx
mov dword [esp + 0x34], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
mov dword [esp + 0x40], edi
cmp edi, 0xffffffff
je 0x1002d211
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
push str.MaxTargetId
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 4
cmp dword [esp + 0x1c], ecx
jne 0x1002d1c8
cmp dword [esp + 0x18], ecx
jne 0x1002d1c8
cmp eax, esi
jne 0x1002d1c8
xor eax, eax
xor edx, edx
mov dword [esp + 0x20], esi
mov word [esp + 0x9c], dx
mov dword [esp + 0x9e], eax
mov dword [esp + 0xa2], eax
mov dword [esp + 0xa6], eax
mov dword [esp + 0xaa], eax
mov dword [esp + 0xae], eax
mov dword [esp + 0xb2], eax
mov dword [esp + 0xb6], eax
mov dword [esp + 0xba], eax
mov dword [esp + 0xbe], eax
mov word [esp + 0xc2], ax
xor ebp, ebp
jmp 0x1002cf70
push 0xa
lea eax, [esp + 0xa0]
push eax
push ebp
call fcn.10077afe
add esp, 0xc
mov eax, str.Target
lea ecx, [esp + 0x80]
call fcn.10006660
mov dword [esp + 0xad4], 2
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x4c]
push edx
lea edi, [esp + 0xa4]
call fcn.1002d500
add esp, 8
mov byte [esp + 0xad4], 3
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x88]
call fcn.100073a0
mov byte [esp + 0xad4], 2
lea esi, [esp + 0x48]
call fcn.100531f0
cmp dword [esp + 0x98], 8
mov eax, dword [esp + 0x84]
jae 0x1002cffb
lea eax, [esp + 0x84]
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002d1a1
push 0x1fe
push eax
lea ecx, [esp + 0x4ce]
push ecx
mov word [esp + 0x4d0], ax
call fcn.10079c60
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x6ce]
push eax
mov word [esp + 0x6d0], dx
call fcn.10079c60
add esp, 0xc
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [esp + 0x2ce]
push edx
mov word [esp + 0x2d0], cx
call fcn.10079c60
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x8ce]
push ecx
mov word [esp + 0x8d0], ax
call fcn.10079c60
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x4c8]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.DeviceType
push edx
call esi
test eax, eax
jne 0x1002d1a1
mov edi, 1
cmp dword [esp + 0x4c4], edi
jne 0x1002d1a1
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x6c8]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.ScsiDeviceType
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2c8]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.DeviceTimingMode
push ecx
call esi
test eax, eax
jne 0x1002d181
mov ecx, dword [esp + 0x2c4]
test ecx, ecx
je 0x1002d181
call fcn.1002c120
cmp eax, edi
jne 0x1002d181
mov eax, dword [esp + 0x2c]
cmp dword [eax + 8], 0
mov dword [esp + 0x44], edi
jne 0x1002d181
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x80]
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x40]
push eax
call fcn.1002c170
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002d171
mov dword [esp + 0x30], 1
jmp 0x1002d181
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 1
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x8c8]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.DeviceTimingModeSupported
push edx
call esi
mov dword [esp + 0xad4], 0xffffffff
lea esi, [esp + 0x80]
call fcn.100531f0
inc ebp
xor esi, esi
cmp ebp, 9
jle 0x1002cf70
mov edi, dword [esp + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x64]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x44], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x1002cd02
cmp ebx, esi
je 0x1002d1f8
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edx, dword [esp + 0x2c]
cmp dword [edx + 8], esi
jne 0x1002d21e
mov eax, dword [esp + 0x34]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x30]
jmp 0x1002d222
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x1002d222
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xacc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xab0]
xor ecx, esp
call fcn.100755ed
add esp, 0xac4
ret 4