Function at 0x100058ad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 0x10], 0xffffffff
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebx + 0x38], ecx
jne 0x100059df
mov edx, dword [ebx + 0xc]
cmp edx, ecx
je 0x100059ac
add edx, 0x100
mov dword [ebp - 8], edx
cmp byte [edx], cl
je 0x100059ac
mov edi, dword [ebx + 0x40]
add edi, 0x110
mov esi, ecx
je 0x100059a1
cmp edx, ecx
je 0x100059a1
cmp byte [edx], cl
je 0x1000599a
mov al, byte [esi + edx]
mov byte [ebp - 2], al
cmp al, 0x2a
je 0x1000595f
cmp al, 0x3f
je 0x10005951
mov dl, byte [ecx + edi]
test dl, dl
je 0x100059e5
cmp dl, al
je 0x1000594a
mov byte [ebp - 1], dl
sub dl, 0x61
cmp dl, 0x19
ja 0x10005935
add byte [ebp - 1], 0xe0
mov dl, al
sub dl, 0x61
cmp dl, 0x19
ja 0x10005941
add al, 0xe0
cmp al, byte [ebp - 1]
jne 0x100059e5
mov edx, dword [ebp - 8]
inc ecx
inc esi
jmp 0x10005990
cmp byte [ecx + edi], 0
je 0x100059e5
inc ecx
inc esi
jmp 0x10005990
cmp byte [esi + edx + 1], 0x3f
jne 0x100059ac
cmp byte [esi + edx + 2], 0
je 0x100059ac
mov al, byte [ecx + edi]
inc esi
inc esi
test al, al
je 0x10005988
mov dl, byte [esi + edx]
cmp al, dl
je 0x10005985
inc ecx
mov al, byte [ecx + edi]
test al, al
jne 0x10005979
mov edx, dword [ebp - 8]
cmp byte [ecx + edi], 0
je 0x100059e5
inc esi
inc ecx
cmp byte [esi + edx], 0
jne 0x10005909
xor eax, eax
cmp byte [esi + edx], al
jmp 0x100059a5
xor eax, eax
cmp edi, edx
sete al
test eax, eax
je 0x100059e5
mov eax, dword [ebx + 0x80]
or eax, 0x10
push eax
mov eax, dword [ebx + 0x40]
push 0
add eax, 0x210
push eax
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100059d7
cmp eax, 0xffffffff
jne 0x100059e5
xor eax, eax
inc eax
jmp 0x10005d40
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebx + 0x44]
je 0x10005a25
inc dword [ebp - 0x10]
lea eax, [ebx + 0x64]
push eax
push dword [ebp - 0x10]
mov dword [eax], 0x1c
lea eax, [ebx + 0x10]
push eax
push 0
push dword [ebp - 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
jne 0x10005a2a
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x100059d7
cmp eax, dword [ebx + 0x44]
je 0x100059d7
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x100059d7
inc dword [ebp - 0x10]
jne 0x10005a10
xor esi, esi
cmp dword [ebx + 0x38], esi
jne 0x10005a55
mov eax, dword [ebx + 0x78]
test al, 4
jne 0x100059e5
mov ecx, dword [ebx + 0x40]
and eax, 1
mov dword [ecx + 0x914], eax
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], esi
jne 0x10005a55
test byte [ebx + 8], 2
je 0x100059e5
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], esi
jne 0x10005a6f
cmp dword [eax + 0x10c], 3
je 0x100059e5
xor esi, esi
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebx + 0x44]
je 0x10005afe
push esi
mov edx, 0x103
lea esi, [ebp - 8]
push esi
add eax, 0x80c
push edx
push eax
mov dword [eax], 5
lea eax, [ebx + 0x64]
push eax
push ecx
mov dword [ebp - 8], edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
je 0x100059e5
mov edi, dword [ebx + 0x40]
xor eax, eax
add edi, 0x80b
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebx + 0x40]
lea esi, [edi + 0x810]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10005ac3
sub eax, ecx
push eax
push esi
add edi, 0x710
push edi
mov dword [ebp - 8], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 0x810], 0
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov byte [ecx + eax + 0x710], 0
xor esi, esi
mov eax, dword [ebx + 0x40]
or dword [eax + 0x910], 0xffffffff
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], esi
je 0x10005bab
mov eax, dword [eax + 0x10c]
cmp eax, 1
je 0x10005b2b
cmp eax, 3
jne 0x10005bab
push 1
push esi
lea eax, [ebx + 0x64]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDeviceInterfaceRegKey]
mov edi, eax
cmp edi, esi
je 0x100059e5
cmp edi, 0xffffffff
je 0x100059e5
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x40]
add eax, 0x910
push eax
xor esi, esi
push esi
push esi
push 0x10001800
push edi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
jne 0x10005bab
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax + 0x910]
cmp ecx, 0xff
jg 0x10005bab
cmp ecx, esi
jl 0x10005bab
push ecx
add eax, 0x810
push 0x100017ec
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x40]
push 0xff
add eax, 0x510
push eax
push esi
push esi
lea edi, [ebx + 0x48]
push edi
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x10005bd3
mov dword [ebp - 8], esi
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 0x510], 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x40]
push 0xff
add eax, 0x410
push eax
push esi
push 0xb
push edi
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x10005c07
mov dword [ebp - 8], esi
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 0x410], 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x40]
push 4
add eax, 0x91c
push eax
push esi
push 0x15
push edi
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x10005c3f
mov eax, dword [ebx + 0x40]
or dword [eax + 0x91c], 0xffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x40]
push 4
add eax, 0x920
push eax
push esi
push 0x1c
push edi
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x10005c69
mov eax, dword [ebx + 0x40]
or dword [eax + 0x920], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.100056c4
mov dword [ebx + 0x34], eax
cmp eax, esi
jne 0x10005d2b
mov esi, dword [ebp - 0x14]
call fcn.10005793
lea edi, [esi + 0x924]
lea eax, [esi + 0x210]
mov edx, edi
mov dword [ebp - 0x18], edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10005c99
push edi
call dword [sym.imp.msvcrt.dll__strupr]
mov dword [esp], 0x100017e4
push edi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x10005d15
push 0
push dword [ebx + 0x5c]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x10014480]
call dword [eax + 0x18]
test eax, eax
jne 0x10005d15
push eax
mov eax, dword [0x10014480]
push 0xff
push edi
push dword [ebp - 0x1c]
call dword [eax + 0x14]
test eax, eax
jne 0x10005d15
mov esi, dword [sym.imp.msvcrt.dll_strchr]
jmp 0x10005cf4
lea edi, [eax + 1]
push 0x5c
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10005cf1
mov edx, dword [ebp - 0x18]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10005d06
jmp 0x100059e5
lea eax, [esi + 0xc]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10005d1c
jmp 0x100059e5
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x10005d3e
cmp eax, dword [ebx + 0x44]
je 0x10005d3e
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
pop edi
pop esi
leave
ret