Function at 0x4023e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x52372b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x56e188]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
push edi
mov eax, dword [0x56e188]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlClassEB781AAF_9C70_4523_A5DF_642A87ECA567
mov ebx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402459
push 0x54f2f8
mov ecx, ebx
call fcn.004053e0
jmp 0x402654
call fcn.00410e81
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402473
push 0x80004005
call fcn.00405240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
movzx ecx, word [esp + 0x454]
movzx edx, word [esp + 0x450]
push ecx
push edx
lea eax, [esp + 0x24]
push str.usb_vid__04xpid__04x
push eax
mov dword [esp + 0x458], 0
call fcn.00404a40
add esp, 0x10
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x402515
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x54f2f8
mov ecx, ebx
call fcn.004053e0
mov dword [esp + 0x448], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x402648
mov esi, dword [esp + 0x24]
add esi, 0xffffffff
mov edi, 0x104
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 1
js 0x402612
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esp, [esp]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x248]
push edx
push esi
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x402605
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x240]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402605
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push str.MatchingDeviceId
push ecx
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x4025bb
mov edx, dword [esp + 0x18]
push edx
jmp 0x4025ff
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.004fd499
add esp, 8
test eax, eax
jne 0x4025fa
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.InfPath
push edx
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x40267d
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esi, 1
jns 0x402540
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x54f2f8
mov ecx, ebx
call fcn.004053e0
mov dword [esp + 0x448], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402654
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.004fd1b4
add esp, 0x43c
ret
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.004053e0
lea ecx, [esp + 0x1c]
call fcn.004012b0
mov eax, esi
jmp 0x402656