Function at 0x4fd88d
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
mov dword [ebp - 4], 0xffffffff
call fcn.004fd1e7
test eax, eax
jne 0x4fd8ad
xor eax, eax
jmp 0x4fdd7a
mov dword [ebp - 0xc], 1
push 4
push 0
push 0
push 0
call dword [0x6811b4]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x4fd8d7
call fcn.004fd418
xor eax, eax
jmp 0x4fdd7a
mov dword [ebp - 0x2c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x28], 0x1c
mov dword [ebp - 0x30], 0
mov eax, 1
test eax, eax
je 0x4fdd5e
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [0x6811c8]
test eax, eax
jne 0x4fd91b
jmp 0x4fdd5e
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x544], 0x400
lea edx, [ebp - 0x540]
mov dword [ebp - 0x13c], edx
mov dword [ebp - 8], 0
lea eax, [ebp - 0x544]
push eax
mov ecx, dword [ebp - 0x544]
push ecx
lea edx, [ebp - 0x540]
push edx
lea eax, [ebp - 0x140]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [0x6811b0]
test eax, eax
jne 0x4fd980
jmp 0x4fdd59
lea eax, [ebp - 0x540]
mov dword [ebp - 0x13c], eax
jmp 0x4fd9ab
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x13c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 8], 0
jne 0x4fdd59
mov ecx, dword [ebp - 0x544]
lea edx, [ebp + ecx - 0x540]
cmp dword [ebp - 0x13c], edx
jae 0x4fdd59
mov eax, dword [ebp - 0x13c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4fdd59
mov dword [ebp - 0x554], 0
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov dword [ebp - 0x550], 0
jmp 0x4fda11
mov eax, dword [ebp - 0x550]
add eax, 1
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp - 0x550]
cmp ecx, dword [0x6811ac]
jge 0x4fda56
mov edx, dword [ebp - 0x550]
shl edx, 7
add edx, 0x67fdac
push edx
mov eax, dword [ebp - 0x13c]
push eax
call fcn.0054cb20
add esp, 8
test eax, eax
je 0x4fda54
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x550]
mov dword [ebp - 4], ecx
jmp 0x4fda56
jmp 0x4fda02
cmp dword [ebp - 8], 0
je 0x4fdd54
mov dword [ebp - 0x54c], 0x104
lea edx, [ebp - 0x54c]
push edx
mov eax, dword [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x140]
push edx
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [0x6811b0]
test eax, eax
je 0x4fdd54
mov dword [ebp - 0x760], 0
push 0x104
push 0
lea edx, [ebp - 0x864]
push edx
call fcn.0054bf90
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x75c]
push eax
call fcn.0054bf90
add esp, 0xc
mov dword [ebp - 0x54c], 0x104
lea ecx, [ebp - 0x54c]
push ecx
mov edx, dword [ebp - 0x54c]
push edx
lea eax, [ebp - 0x75c]
push eax
lea ecx, [ebp - 0x140]
push ecx
push 9
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [0x6811b0]
push 0x5c8d54
lea ecx, [ebp - 0x864]
push ecx
call fcn.0054be90
add esp, 8
lea edx, [ebp - 0x75c]
push edx
lea eax, [ebp - 0x864]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x760]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x864]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jne 0x4fdd27
mov dword [ebp - 0x54c], 0x104
lea eax, [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x658]
push ecx
push 0
push 0
push str.InfPath
mov edx, dword [ebp - 0x760]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jne 0x4fdd27
cmp dword [ebp + 0x10], 0
je 0x4fdc23
push 0x40
lea eax, [ebp - 0x8a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c8d84
lea ecx, [ebp - 0x8a4]
push ecx
call fcn.0054bea0
add esp, 8
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x8a4]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x8a4]
push ecx
push 0x40
lea edx, [ebp - 0x8e4]
push edx
push 0x6857cc
push 0x5c8d8c
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4fdc23
lea eax, [ebp - 0x658]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0054be90
add esp, 8
lea edx, [ebp - 0x658]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
push str.USBSTOR
lea eax, [ebp - 0x658]
push eax
call fcn.0054cb20
add esp, 8
test eax, eax
jne 0x4fdd27
cmp dword [ebp + 0xc], 0
je 0x4fdd27
push 0x40
lea ecx, [ebp - 0x964]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.inf_
lea edx, [ebp - 0x964]
push edx
call fcn.0054bea0
add esp, 8
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0x924]
push ecx
call fcn.0054be90
add esp, 8
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x964]
push eax
call fcn.0054bea0
add esp, 8
push 0x5c8db0
lea ecx, [ebp - 0x924]
push ecx
call fcn.0054bea0
add esp, 8
lea edx, [ebp - 0x964]
push edx
push 0x40
lea eax, [ebp - 0x9a4]
push eax
push 0x6857d0
push 0x5c8dc0
push 0x5c8dcc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4fdcf1
lea ecx, [ebp - 0x658]
push ecx
call fcn.004fd432
add esp, 4
lea edx, [ebp - 0x924]
push edx
push 0x40
lea eax, [ebp - 0x9a4]
push eax
push 0x6857d4
push str.SMIICName
push str.strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4fdd27
push 0x5c8de8
call fcn.004fd432
add esp, 4
mov ecx, dword [ebp - 0x760]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], 0
je 0x4fdd4d
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [0x6811b8]
mov dword [ebp - 0xc], eax
jmp 0x4fdd54
mov dword [ebp - 0xc], 1
jmp 0x4fd98e
jmp 0x4fd8f3
mov ecx, dword [ebp - 0x34]
push ecx
call dword [0x6811c4]
call fcn.004fd418
cmp dword [ebp - 4], 0
jl 0x4fdd78
mov eax, dword [ebp - 0xc]
jmp 0x4fdd7a
xor eax, eax
mov esp, ebp
pop ebp
ret