Function at 0x41cb0c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xc4]
sub esp, 0x144
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0xc0], eax
push ebx
push edi
push 6
pop ecx
xor ebx, ebx
push 2
push ebx
push ebx
xor eax, eax
mov dword [ebp - 0x60], 0x1c
lea edi, [ebp - 0x5c]
push 0x47039c
mov dword [ebp - 0x80], ebx
rep stosd dword es:[edi], eax
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x63], bl
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp eax, ebx
mov dword [ebp - 0x7c], eax
jne 0x41cb74
call dword [0x467358]
push eax
push str._DisableOnSoftRemove:_SetupDiGetClassDevs_failed._err_d_n
call fcn.0041b266
pop ecx
pop ecx
jmp 0x41cdcc
mov dword [ebp - 0x6c], ebx
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x7c]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x41cda4
push ebx
push 0x104
lea eax, [ebp - 0x44]
push eax
push ebx
push 1
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x41cbbf
call dword [0x467358]
push eax
push str._DisableOnSoftRemove:_SetupDiGetDeviceRegistryProperty_failed._err_d_n
jmp 0x41cd8b
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x68], ebx
xor esi, esi
mov dword [ebp - 0x70], ebx
call fcn.0043d40b
cmp byte [ebp - 0x44], bl
pop ecx
lea edi, [ebp - 0x44]
je 0x41cd82
push str.VID_
push edi
call fcn.0043b820
cmp eax, ebx
pop ecx
pop ecx
je 0x41cc58
push 0x10
add eax, 4
push ebx
push eax
call fcn.0043d1ed
movzx eax, ax
push str.PID_
push edi
mov dword [ebp - 0x70], eax
call fcn.0043b820
add esp, 0x14
cmp eax, ebx
je 0x41cc58
push 0x10
add eax, 4
push ebx
push eax
call fcn.0043d1ed
push str.REV_
push edi
movzx esi, ax
call fcn.0043b820
add esp, 0x14
cmp eax, ebx
je 0x41cc58
push 0x10
add eax, 4
push ebx
push eax
call fcn.0043d1ed
movzx eax, ax
add esp, 0xc
cmp word [ebp - 0x70], bx
mov dword [ebp - 0x68], eax
je 0x41cc58
cmp si, bx
je 0x41cc58
cmp ax, bx
jne 0x41cc6b
push edi
call fcn.00439690
lea edi, [edi + eax + 1]
cmp byte [edi], bl
pop ecx
jne 0x41cbdd
cmp word [ebp - 0x70], bx
je 0x41cd82
cmp si, bx
je 0x41cd82
cmp word [ebp - 0x68], bx
je 0x41cd82
movzx edi, word [ebp - 0x68]
movzx eax, word [ebp - 0x70]
movzx esi, si
push edi
push esi
push eax
push str.DisableOnSoftRemove:_found_VID:_04x_PID:_04x_REV:_04x_n
mov dword [ebp - 0x68], eax
call fcn.0041b266
push edi
push esi
push dword [ebp - 0x68]
lea eax, [ebp - 0x44]
push str.SYSTEMCurrentControlSetControlusbflags_04x_04x_04x
push 0x104
push eax
call fcn.0043ce7f
add esp, 0x28
lea eax, [ebp - 0x78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x44]
push eax
push reloc.WS2_32.dll_bind
call dword [0x4670bc]
cmp eax, ebx
je 0x41cce6
push eax
push str._DisableOnSoftRemove:_RegOpenKeyEx_failed._err_d_n
jmp 0x41cd8b
push 2
pop edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.DisableOnSoftRemove
push esi
push dword [ebp - 0x78]
mov dword [ebp - 0x74], edi
call dword [0x467050]
cmp eax, ebx
je 0x41cd42
push eax
push str.DisableOnSoftRemove:_no_value._RegQueryValueEx_returned__d_n
call fcn.0041b266
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x64]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x78]
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x63], bl
call dword [0x467054]
cmp eax, ebx
je 0x41cd70
push eax
push str._DisableOnSoftRemove:_RegSetValueEx_failed._err_d_n
call fcn.0041b266
pop ecx
pop ecx
jmp 0x41cd77
cmp dword [ebp - 0x74], edi
je 0x41cd59
push dword [ebp - 0x74]
push str.DisableOnSoftRemove:_wrong_value_length__d_n
call fcn.0041b266
pop ecx
pop ecx
mov byte [ebp - 0x64], bl
cmp byte [ebp - 0x64], 1
jne 0x41cd16
cmp byte [ebp - 0x63], bl
jne 0x41cd16
push str.DisableOnSoftRemove:_value_exists_already_n
call fcn.0041b266
jmp 0x41cd3f
mov dword [ebp - 0x80], 1
push dword [ebp - 0x78]
call dword [0x467004]
jmp 0x41cd92
lea eax, [ebp - 0x44]
push eax
push str.DisableOnSoftRemove:_ignore_dev_with_HARDWAREID__hs_n
call fcn.0041b266
pop ecx
pop ecx
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x3e8
jb 0x41cb78
jmp 0x41cdc2
mov esi, dword [0x467358]
call esi
cmp eax, 0x103
je 0x41cdc2
call esi
push eax
push str._DisableOnSoftRemove:_SetupDiEnumDeviceInfo_failed._err_d_n
call fcn.0041b266
pop ecx
pop ecx
push dword [ebp - 0x7c]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop esi
mov ecx, dword [ebp + 0xc0]
mov eax, dword [ebp - 0x80]
pop edi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0xc4
leave
ret 4