Function at 0x100565b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1114
call fcn.1001a2d0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10ec]
push eax
call fcn.10065660
add esp, 4
push 0x5c
lea ecx, [ebp - 0x10ec]
call fcn.10001cb0
mov dword [ebp - 0x3a0], eax
mov ecx, dword [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x10f8]
push edx
lea ecx, [ebp - 0x10ec]
call fcn.10001f00
push eax
lea ecx, [ebp - 0x10ec]
call fcn.10002750
lea ecx, [ebp - 0x10f8]
call fcn.10001850
push 0x5c
lea ecx, [ebp - 0x10ec]
call fcn.10001cb0
mov dword [ebp - 0x10e8], eax
mov eax, dword [ebp - 0x3a0]
push eax
mov ecx, dword [ebp - 0x10e8]
add ecx, 1
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10ec]
call fcn.10001e20
mov dword [ebp - 0xf5c], 0xffffffff
mov dword [ebp - 0x10dc], 0xffffffff
mov byte [ebp - 0x10e1], 0
mov dword [ebp - 0x354], 0
lea ecx, [ebp - 0x380]
call fcn.10001af0
lea ecx, [ebp - 0xf60]
call fcn.10001af0
mov byte [ebp - 0x365], 0
lea ecx, [ebp - 0x10d4]
call fcn.10001af0
lea ecx, [ebp - 0x10d0]
call fcn.10001af0
lea ecx, [ebp - 0x370]
call fcn.10001af0
lea ecx, [ebp - 0x10cc]
call fcn.10001af0
lea ecx, [ebp - 0x1094]
call fcn.10001af0
lea eax, [ebp - 0x36c]
push eax
push 0xa
lea ecx, [ebp - 0x118]
push ecx
push 0x100781cc
call dword [sym.imp.SETUPAPI.dll_SetupDiClassGuidsFromNameA]
test eax, eax
jne 0x10056756
mov byte [ebp - 0x10f9], 0
lea ecx, [ebp - 0x1094]
call fcn.10001850
lea ecx, [ebp - 0x10cc]
call fcn.10001850
lea ecx, [ebp - 0x370]
call fcn.10001850
lea ecx, [ebp - 0x10d0]
call fcn.10001850
lea ecx, [ebp - 0x10d4]
call fcn.10001850
lea ecx, [ebp - 0xf60]
call fcn.10001850
lea ecx, [ebp - 0x380]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x10ec]
call fcn.10001850
mov al, byte [ebp - 0x10f9]
jmp 0x10056f0b
push 2
push 0
push 0
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0xffffffff
jne 0x100567ea
mov byte [ebp - 0x10fa], 0
lea ecx, [ebp - 0x1094]
call fcn.10001850
lea ecx, [ebp - 0x10cc]
call fcn.10001850
lea ecx, [ebp - 0x370]
call fcn.10001850
lea ecx, [ebp - 0x10d0]
call fcn.10001850
lea ecx, [ebp - 0x10d4]
call fcn.10001850
lea ecx, [ebp - 0xf60]
call fcn.10001850
lea ecx, [ebp - 0x380]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x10ec]
call fcn.10001850
mov al, byte [ebp - 0x10fa]
jmp 0x10056f0b
mov dword [ebp - 0x39c], 0x1c
push 0x20019
push 0
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x10056882
mov byte [ebp - 0x10fb], 0
lea ecx, [ebp - 0x1094]
call fcn.10001850
lea ecx, [ebp - 0x10cc]
call fcn.10001850
lea ecx, [ebp - 0x370]
call fcn.10001850
lea ecx, [ebp - 0x10d0]
call fcn.10001850
lea ecx, [ebp - 0x10d4]
call fcn.10001850
lea ecx, [ebp - 0xf60]
call fcn.10001850
lea ecx, [ebp - 0x380]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x10ec]
call fcn.10001850
mov al, byte [ebp - 0x10fb]
jmp 0x10056f0b
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1114], eax
lea ecx, [ebp - 0x39c]
push ecx
mov edx, dword [ebp - 0x1114]
push edx
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov ecx, dword [ebp - 0x354]
add ecx, 1
mov dword [ebp - 0x354], ecx
test eax, eax
je 0x10056e7f
lea edx, [ebp - 0x36c]
push edx
push 0x3e8
lea eax, [ebp - 0x1090]
push eax
lea ecx, [ebp - 0x360]
push ecx
push 1
lea edx, [ebp - 0x39c]
push edx
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x100568f6
jmp 0x10056882
lea ecx, [ebp - 0x36c]
push ecx
push 0x3e8
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x360]
push eax
push 9
lea ecx, [ebp - 0x39c]
push ecx
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x1005692f
jmp 0x10056882
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x350]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x35c], 0xffffffff
jne 0x10056958
jmp 0x10056882
lea eax, [ebp - 0x10d8]
push eax
push 0x100781d0
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x10d8], 0xffffffff
jne 0x1005698c
mov edx, dword [ebp - 0x35c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10056882
lea eax, [ebp - 0xc]
push eax
push 0x100781d8
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x100569c7
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10056882
mov dword [ebp - 0x36c], 0x64
lea ecx, [ebp - 0x36c]
push ecx
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x360]
push eax
push 0
push 0x100781e8
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x100781f4
lea ecx, [ebp - 0x10f4]
call fcn.100017d0
lea edx, [ebp - 0x78]
push edx
lea ecx, [ebp - 0x10f0]
call fcn.10001ba0
lea ecx, [ebp - 0x10f4]
call fcn.10001d00
lea ecx, [ebp - 0x10f0]
call fcn.10001d00
lea ecx, [ebp - 0x10f4]
call fcn.10001330
test eax, eax
je 0x10056a59
lea eax, [ebp - 0x10f0]
push eax
lea ecx, [ebp - 0x10f4]
push ecx
call fcn.100035d0
add esp, 8
movzx edx, al
test edx, edx
je 0x10056e40
lea eax, [ebp - 0x1090]
push eax
lea ecx, [ebp - 0x380]
call fcn.10001c10
lea ecx, [ebp - 0x380]
call fcn.10001d00
push 0
lea ecx, [ebp - 0x370]
call fcn.10001ae0
push eax
lea ecx, [ebp - 0x380]
call fcn.10001c30
cmp eax, 0xffffffff
jne 0x10056ab6
push 0
lea ecx, [ebp - 0x10cc]
call fcn.10001ae0
push eax
lea ecx, [ebp - 0x380]
call fcn.10001c30
cmp eax, 0xffffffff
je 0x10056e06
push 0x10078200
lea ecx, [ebp - 0x370]
call fcn.100017b0
push 0x10078208
lea ecx, [ebp - 0x10cc]
call fcn.100017b0
push 0xbb8
push 0
lea ecx, [ebp - 0xf58]
push ecx
call fcn.100139b0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push 0x10078210
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x364]
push ecx
lea edx, [ebp - 0x220]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xf5c], eax
cmp dword [ebp - 0xf5c], 0
jne 0x10056b7d
mov dword [ebp - 0x378], 0xbb8
mov dword [ebp - 0x374], 1
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0xf58]
push ecx
lea edx, [ebp - 0x374]
push edx
push 0
push 0x10078224
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10dc], eax
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, byte [ebp - 0xf58]
test edx, edx
je 0x10056cda
movzx eax, byte [ebp - 0xf57]
test eax, eax
je 0x10056cda
lea ecx, [ebp - 0xf58]
push ecx
push 0x10078230
push 0x100a53a4
call fcn.100025d0
add esp, 0xc
mov ecx, 0x100a53a4
call fcn.10001d00
push 0x100a53a4
lea ecx, [ebp - 0x10d4]
call fcn.10002750
mov dword [ebp - 0x3a0], 0
push 0x1006f9cf
lea edx, [ebp - 0x10d4]
push edx
call fcn.10002030
add esp, 8
movzx eax, al
test eax, eax
je 0x10056cd5
push 0x3b
lea ecx, [ebp - 0x10d4]
call fcn.10001cb0
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
jle 0x10056c78
mov ecx, dword [ebp - 0x3a0]
add ecx, 1
push ecx
lea edx, [ebp - 0x1100]
push edx
lea ecx, [ebp - 0x10d4]
call fcn.10001de0
push eax
lea ecx, [ebp - 0x10d0]
call fcn.10002750
lea ecx, [ebp - 0x1100]
call fcn.10001850
mov eax, dword [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x1104]
push ecx
lea ecx, [ebp - 0x10d4]
call fcn.10001f00
push eax
lea ecx, [ebp - 0x10d4]
call fcn.10002750
lea ecx, [ebp - 0x1104]
call fcn.10001850
jmp 0x10056c9a
lea edx, [ebp - 0x10d4]
push edx
lea ecx, [ebp - 0x10d0]
call fcn.10002750
push 0x1006f9da
lea ecx, [ebp - 0x10d4]
call fcn.100017b0
push 0
lea ecx, [ebp - 0x10d0]
call fcn.10001ae0
push eax
lea ecx, [ebp - 0x380]
call fcn.10001c30
cmp eax, 0xffffffff
je 0x10056cd0
lea ecx, [ebp - 0x10d0]
call fcn.10001330
test eax, eax
je 0x10056cd0
mov byte [ebp - 0x365], 1
jmp 0x10056cd5
jmp 0x10056bd8
jmp 0x10056e06
push 0x10078234
lea eax, [ebp - 0x1108]
push eax
call fcn.10065660
add esp, 4
push eax
lea ecx, [ebp - 0x110c]
push ecx
call fcn.10001f80
add esp, 0xc
push eax
lea ecx, [ebp - 0x1094]
call fcn.10002750
lea ecx, [ebp - 0x110c]
call fcn.10001850
lea ecx, [ebp - 0x1108]
call fcn.10001850
push 0x10078244
lea ecx, [ebp - 0x1094]
call fcn.10001ae0
push eax
call fcn.10015838
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10056dff
mov edx, dword [ebp - 4]
push edx
call fcn.1001584f
add esp, 4
test eax, eax
jne 0x10056df1
push 0x32
push 0
lea eax, [ebp - 0x10c8]
push eax
call fcn.100139b0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
push 0x32
lea edx, [ebp - 0x10c8]
push edx
call fcn.10015883
add esp, 0xc
lea eax, [ebp - 0x10c8]
push eax
lea ecx, [ebp - 0xf60]
call fcn.100017b0
lea ecx, [ebp - 0xf60]
call fcn.10001d50
lea ecx, [ebp - 0xf60]
call fcn.10001d00
push 0
lea ecx, [ebp - 0xf60]
call fcn.10001330
push eax
lea ecx, [ebp - 0xf60]
call fcn.100015a0
push eax
lea ecx, [ebp - 0x380]
call fcn.10001c30
cmp eax, 0xffffffff
je 0x10056dec
lea ecx, [ebp - 0xf60]
call fcn.10001330
test eax, eax
je 0x10056dec
mov byte [ebp - 0x365], 1
jmp 0x10056df1
jmp 0x10056d46
mov ecx, dword [ebp - 4]
push ecx
call fcn.10015a42
add esp, 4
jmp 0x10056e06
mov byte [ebp - 0x365], 0
movzx edx, byte [ebp - 0x365]
test edx, edx
je 0x10056e40
push 0
mov eax, dword [ebp - 0x388]
push eax
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x37c]
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov eax, dword [ebp - 0x37c]
and eax, 8
jne 0x10056e40
mov byte [ebp - 0x10e1], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10f0]
call fcn.10001850
lea ecx, [ebp - 0x10f4]
call fcn.10001850
jmp 0x10056882
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov al, byte [ebp - 0x10e1]
mov byte [ebp - 0x110d], al
lea ecx, [ebp - 0x1094]
call fcn.10001850
lea ecx, [ebp - 0x10cc]
call fcn.10001850
lea ecx, [ebp - 0x370]
call fcn.10001850
lea ecx, [ebp - 0x10d0]
call fcn.10001850
lea ecx, [ebp - 0x10d4]
call fcn.10001850
lea ecx, [ebp - 0xf60]
call fcn.10001850
lea ecx, [ebp - 0x380]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x10ec]
call fcn.10001850
mov al, byte [ebp - 0x110d]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret