Function at 0x1001d3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100e7c94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x114], eax
cmp dword [ebx + 0x38], eax
jne 0x1001d5bf
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x1001d58d
cmp byte [eax + 0x100], 0
lea esi, [eax + 0x100]
je 0x1001d58d
mov eax, dword [ebx + 0x40]
mov edx, 0
add eax, 0x110
mov ecx, edx
mov dword [ebp - 0x10c], eax
je 0x1001d582
test esi, esi
je 0x1001d582
mov eax, dword [ebx + 0xc]
lea esi, [eax + 0x102]
nop dword [eax]
nop word [eax + eax]
mov al, byte [edx + eax + 0x100]
mov dword [ebp - 0x110], eax
cmp al, 0x2a
je 0x1001d506
mov ebx, dword [ebp - 0x10c]
mov bl, byte [ecx + ebx]
mov byte [ebp - 0x105], bl
mov ebx, dword [ebp - 0x120]
cmp al, 0x3f
je 0x1001d4f5
cmp byte [ebp - 0x105], 0
je 0x1001d5ca
cmp byte [ebp - 0x105], al
jne 0x1001d4ba
inc edx
inc esi
jmp 0x1001d565
mov ah, byte [ebp - 0x105]
mov al, ah
sub al, 0x61
cmp al, 0x19
ja 0x1001d4d1
add ah, 0xe0
mov byte [ebp - 0x105], ah
mov al, byte [ebp - 0x110]
sub al, 0x61
cmp al, 0x19
mov eax, dword [ebp - 0x110]
ja 0x1001d4e5
add al, 0xe0
cmp al, byte [ebp - 0x105]
jne 0x1001d5ca
inc edx
inc esi
jmp 0x1001d565
cmp byte [ebp - 0x105], 0
je 0x1001d5ca
inc edx
inc esi
jmp 0x1001d565
mov eax, dword [ebp - 0x11c]
mov ebx, dword [ebp - 0x120]
cmp byte [edx + eax + 0x101], 0x3f
jne 0x1001d58d
cmp byte [edx + eax + 0x102], 0
je 0x1001d58d
mov eax, dword [ebp - 0x10c]
mov al, byte [ecx + eax]
test al, al
je 0x1001d553
mov ah, byte [esi]
mov ebx, dword [ebp - 0x10c]
nop dword [eax + eax]
cmp al, ah
je 0x1001d54d
mov al, byte [ecx + ebx + 1]
inc ecx
test al, al
jne 0x1001d540
mov ebx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x10c]
cmp byte [ecx + eax], 0
je 0x1001d5ca
add edx, 3
add esi, 3
mov eax, dword [ebx + 0xc]
inc ecx
cmp byte [edx + eax + 0x100], 0
jne 0x1001d470
xor ecx, ecx
cmp byte [eax + edx + 0x100], cl
jmp 0x1001d586
xor ecx, ecx
cmp eax, esi
sete cl
test ecx, ecx
je 0x1001d5ca
mov eax, dword [ebx + 0x80]
or eax, 0x10
push eax
mov eax, dword [ebx + 0x40]
push 0
add eax, 0x210
push eax
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov edx, eax
mov dword [ebp - 0x114], edx
test edx, edx
je 0x1001d610
cmp edx, 0xffffffff
je 0x1001d610
jmp 0x1001d5d0
mov edx, dword [ebx + 0x44]
mov dword [ebp - 0x114], edx
jmp 0x1001d5d0
xor edx, edx
nop dword [eax]
inc edi
mov esi, edi
mov dword [ebp - 0x11c], esi
cmp edx, dword [ebx + 0x44]
je 0x1001d626
lea eax, [ebx + 0x64]
mov dword [eax], 0x1c
push eax
push edi
lea eax, [ebx + 0x10]
push eax
push 0
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
mov edx, dword [ebp - 0x114]
test eax, eax
jne 0x1001d62a
test edx, edx
je 0x1001d610
cmp edx, dword [ebx + 0x44]
je 0x1001d610
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003acef
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x1001d600
cmp dword [ebx + 0x38], 0
jne 0x1001d65c
mov ecx, dword [ebx + 0x78]
test cl, 4
jne 0x1001d5d0
mov eax, dword [ebx + 0x40]
and ecx, 1
mov dword [eax + 0x914], ecx
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], 0
jne 0x1001d65c
test byte [ebx + 8], 2
mov edi, esi
je 0x1001d5d0
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], 0
jne 0x1001d677
cmp dword [eax + 0x10c], 3
mov edi, esi
je 0x1001d5d0
cmp edx, dword [ebx + 0x44]
je 0x1001d732
push 0
add eax, 0x80c
lea ecx, [ebp - 0x10c]
push ecx
push 0x103
push eax
mov dword [eax], 5
mov edi, esi
lea eax, [ebx + 0x64]
mov dword [ebp - 0x10c], 0x103
push eax
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov edx, dword [ebp - 0x114]
test eax, eax
je 0x1001d5d0
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x80b], 0
mov byte [eax + 0x80f], 0
mov edx, dword [ebx + 0x40]
lea esi, [edx + 0x810]
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d6e1
sub ecx, edi
lea eax, [edx + 0x710]
push ecx
push esi
push eax
mov dword [ebp - 0x10c], ecx
call fcn.1003cc70
mov ecx, dword [ebx + 0x40]
add esp, 0xc
mov eax, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x114]
mov byte [ecx + eax + 0x810], 0
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebx + 0x40]
mov byte [ecx + eax + 0x710], 0
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x910], 0xffffffff
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], 0
je 0x1001d7e2
mov eax, dword [eax + 0x10c]
cmp eax, 1
je 0x1001d760
cmp eax, 3
jne 0x1001d7e2
push 1
push 0
lea eax, [ebx + 0x64]
push eax
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDeviceInterfaceRegKey]
mov edi, eax
test edi, edi
je 0x1001d917
cmp edi, 0xffffffff
je 0x1001d917
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 4
push eax
mov eax, dword [ebx + 0x40]
add eax, 0x910
push eax
push 0
push 0
push str.LUsb0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1001d7e2
mov ecx, dword [ebx + 0x40]
mov eax, dword [ecx + 0x910]
cmp eax, 0xff
jg 0x1001d7e2
test eax, eax
js 0x1001d7e2
push eax
lea eax, [ecx + 0x810]
push str..libusb0__04d
push eax
call fcn.1001c4a0
add esp, 0xc
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x48]
push 0xff
add eax, 0x510
push eax
push 0
push 0
push esi
push dword [ebx + 0x44]
call edi
mov ecx, dword [ebx + 0x40]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov byte [ecx + eax + 0x510], 0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx + 0x40]
push 0xff
add eax, 0x410
push eax
push 0
push 0xb
push esi
push dword [ebx + 0x44]
call edi
mov ecx, dword [ebx + 0x40]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov byte [ecx + eax + 0x410], 0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx + 0x40]
push 4
add eax, 0x91c
push eax
push 0
push 0x15
push esi
push dword [ebx + 0x44]
call edi
test eax, eax
jne 0x1001d88c
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x91c], 0xffffffff
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx + 0x40]
push 4
add eax, 0x920
push eax
push 0
push 0x1c
push esi
push dword [ebx + 0x44]
call edi
test eax, eax
jne 0x1001d8b9
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x920], 0xffffffff
mov edx, dword [ebx + 4]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], 0
call fcn.1001cfc0
test eax, eax
jne 0x1001d924
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [ebx + 0x34], eax
mov dword [ebp - 0x118], ecx
test eax, eax
je 0x1001d9f7
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x1001d904
cmp eax, dword [ebx + 0x44]
je 0x1001d904
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003acef
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x114]
mov edi, esi
jmp 0x1001d5d0
mov edx, dword [ebp - 0x110]
mov ecx, 0x289
mov esi, dword [ebx + 0x40]
mov dword [ebp - 0x118], edx
mov edi, dword [edx + 0x1c]
rep movsd dword es:[edi], dword [esi]
cmp dword [edx + 8], 0x4b425355
mov esi, dword [ebp - 0x110]
jne 0x1001d974
cmp dword [esi], 0
je 0x1001d95f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x118]
jmp 0x1001d974
lea ecx, [esi + 0xc]
mov eax, 1
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
jg 0x1001d974
lock dec dword [ecx]
mov ecx, dword [edx + 0x1c]
mov eax, dword [ebx]
mov dword [ecx + 0xa24], eax
mov eax, dword [edx + 0x1c]
mov dword [eax + 0xa28], esi
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x1001d9c7
mov eax, dword [eax + 0xa30]
mov ecx, dword [edx + 0x1c]
mov dword [ecx + 0xa30], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xa30]
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0xa2c], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x20]
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0xa30], eax
mov eax, dword [edx + 0x1c]
jmp 0x1001d9dd
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x20], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xa30], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xa2c], 0
mov ecx, dword [edx + 0x1c]
mov dword [ebp - 0x118], ecx
mov dword [ebx + 0x34], 0
lea eax, [ecx + 0x210]
mov dword [ebp - 0x110], 0
push eax
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x104]
push 0x100
push eax
mov dword [ecx + 8], 0xffffffff
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
call fcn.1006ab54
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1006a976
mov ebx, dword [ebp - 0x118]
lea esi, [ebp - 0x104]
add esp, 0x14
mov edi, esi
cmp byte [edi], 0
je 0x1001dab6
push 0x5c
push esi
call fcn.1003e2a0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001da6f
mov byte [esi], 0
inc esi
mov eax, dword [ebp - 0x110]
sub eax, 1
je 0x1001da93
sub eax, 1
jne 0x1001daaa
push edi
lea eax, [ebx + 0xc]
push 0x100
push eax
call fcn.1006ab54
add esp, 0xc
jmp 0x1001daaa
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push str.VID__04XPID__04XMI__02X
push edi
call fcn.1001c540
add esp, 0x14
inc dword [ebp - 0x110]
mov edi, esi
test esi, esi
jne 0x1001da55
mov esi, dword [ebp - 0x118]
mov ebx, dword [ebp - 0x120]
cmp dword [esi], 0xffffffff
je 0x1001dacd
xor eax, eax
mov word [esi + 2], ax
cmp dword [esi + 4], 0xffffffff
je 0x1001dad9
xor eax, eax
mov word [esi + 6], ax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x1001dae7
and eax, 0x7f
mov dword [esi + 8], eax
mov ecx, dword [ebp - 0x124]
lea edi, [esi + 0x924]
mov edx, edi
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1001daf7
push edi
call fcn.1006a900
push str.MI_
push edi
call fcn.1003e030
add esp, 0xc
test eax, eax
je 0x1001db94
push 0
push dword [ebx + 0x5c]
lea eax, [ebp - 0x128]
push eax
mov eax, dword [0x1480ce34]
mov eax, dword [eax + 0x18]
call eax
test eax, eax
jne 0x1001db94
push eax
mov eax, dword [0x1480ce34]
push 0xff
push edi
push dword [ebp - 0x128]
mov eax, dword [eax + 0x14]
call eax
test eax, eax
jne 0x1001db94
mov esi, edi
push 0x5c
push esi
call fcn.1003e2a0
add esp, 8
test eax, eax
je 0x1001db74
lea esi, [eax + 1]
push 0x5c
push esi
call fcn.1003e2a0
add esp, 8
test eax, eax
jne 0x1001db62
sub edi, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [edi + esi - 1], al
test al, al
jne 0x1001db76
mov edi, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x114]
jmp 0x1001d5d0
lea ecx, [esi + 0xc]
sub edi, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x1001dba0
mov edi, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x114]
jmp 0x1001d5d0