Function at 0x404e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSet_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x405010
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x40506c
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [esi*4 + 0x418f90]
cmp eax, ebx
je 0x404ea4
cmp edi, 1
push 1
jne 0x404e94
mov edx, dword [esi*4 + 0x418fb4]
push edx
push ecx
call fcn.004050c0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
inc esi
jmp 0x404e6b
push eax
push ecx
call fcn.004050c0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
inc esi
jmp 0x404e6b
push ebx
push ebx
push ebx
push ebx
push str.VID_0421PID_
push str.EnumNMWCD
push ecx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push 1
push str.NMWCDVID_0421PID_
push str.MatchingDeviceId
push ebx
push str.ControlClass4D36E96D_E325_11CE_BFC1_08002BE10318
push eax
call fcn.004055e0
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push 1
push str.NMWCDVID_0421PID_
push str.MatchingDeviceId
push ebx
push str.ControlClass4D36E978_E325_11CE_BFC1_08002BE10318
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push 1
push str.NMWCDVID_0421PID_
push str.MatchingDeviceId
push ebx
push str.ControlClass4f919108_4adf_11d5_882d_00b0d02fe381
push edx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push 1
push str.USBVID_0421PID_
push str.MatchingDeviceId
push ebx
push str.ControlClass4f919108_4adf_11d5_882d_00b0d02fe381
push eax
call fcn.004055e0
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push str.4F919108_4ADF_11D5_882D_00B0D02FE381
push str.ClassGuid
push str.VID_0421PID_
push str.EnumUSB
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push str._NMWCDVID_0421PID_
push str.ControlDeviceClasses2c7089aa_2e0e_11d1_b114_00c04fc2aae4
push edx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push str._NMWCDVID_0421PID_
push str.ControlDeviceClasses4f919100_4adf_11d5_882d_00b0d02fe381
push eax
call fcn.004055e0
add esp, 0x1c
push ebx
push ebx
mov ecx, dword [ebp - 0x14]
push ebx
push ebx
push str._NMWCDVID_0421PID_
push str.ControlDeviceClasses4f919102_4adf_11d5_882d_00b0d02fe381
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push str._NMWCDVID_0421PID_
push str.ControlDeviceClasses4f919106_4adf_11d5_882d_00b0d02fe381
push edx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push str._NMWCDVID_0421PID_
push str.ControlDeviceClasses4f91910c_4adf_11d5_882d_00b0d02fe381
push eax
call fcn.004055e0
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push str._USBVID_0421PID_
push str.ControlDeviceClassesa5dcbf10_6530_11d2_901f_00c04fb951ed
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40506c
cmp dword [0x41e04c], ebx
je 0x40505b
push str.SYSTEMCurrentControlSet_
push str.USB_Key___ls_not_found_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push ebx
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x41e04c], ebx
je 0x40505b
push str.SYSTEMCurrentControlSet_
push str.USB_Key___ls_open_failed_r_n
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push ebx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
jmp 0x405055