Function at 0x40cf70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aa28
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x427664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x218]
push ecx
push 0x20019
xor edi, edi
push edi
push str.Enum
push SysStringLen
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40cff8
push str.Could_not_read_from_HKLMEnum
lea ecx, [ebp - 0x234]
call dword [0x41ca04]
push 0x423ca4
lea edx, [ebp - 0x234]
push edx
call sub.MSVCR100.dll__CxxThrowException
xor ecx, ecx
push edi
push edi
mov eax, ecx
push edi
inc ecx
push edi
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x214]
push edx
push eax
mov eax, dword [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40d2de
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x220]
push ecx
push 0x20019
push edi
lea edx, [ebp - 0x214]
push edx
push eax
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d09d
push str.Could_not_read_from_HKLMEnum_
lea ecx, [ebp - 0x228]
call dword [0x41ca04]
lea ecx, [ebp - 0x214]
push ecx
push eax
lea edx, [ebp - 0x238]
push edx
mov byte [ebp - 4], 1
call fcn.00404c10
add esp, 0xc
push 0x423ca4
lea eax, [ebp - 0x238]
push eax
call sub.MSVCR100.dll__CxxThrowException
mov ecx, str.USBPORTS
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d0ce
cmp dx, di
je 0x40d0ca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d0ce
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40d0a8
xor eax, eax
jmp 0x40d0d3
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, edi
sete bl
xor esi, esi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x114]
mov eax, esi
push edx
push eax
mov eax, dword [ebp - 0x220]
push eax
mov dword [ebp - 0x21c], pe_nt_image_headers32
inc esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40d2c6
mov ecx, str.PNP0500
lea eax, [ebp - 0x114]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d146
cmp dx, di
je 0x40d142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d146
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40d120
xor eax, eax
jmp 0x40d14b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x40d197
mov ecx, 0x41f1d8
lea eax, [ebp - 0x114]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d186
cmp dx, di
je 0x40d182
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d186
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40d160
xor eax, eax
jmp 0x40d18b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x40d197
cmp ebx, edi
je 0x40d0dc
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push edi
lea edx, [ebp - 0x114]
push edx
push eax
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d24e
push 0x41f1d4
lea ecx, [ebp - 0x22c]
call dword [0x41ca04]
push str.Could_not_read_from_HKLMEnum_
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call dword [0x41ca04]
lea ecx, [ebp - 0x214]
push ecx
push eax
lea edx, [ebp - 0x248]
push edx
mov byte [ebp - 4], 3
call fcn.00404c10
add esp, 0xc
lea ecx, [ebp - 0x22c]
push ecx
push eax
lea edx, [ebp - 0x24c]
push edx
mov byte [ebp - 4], 4
call fcn.00404b90
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push eax
lea edx, [ebp - 0x244]
push edx
mov byte [ebp - 4], 5
call fcn.00404c10
add esp, 0xc
push 0x423ca4
lea eax, [ebp - 0x244]
push eax
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x224]
push ecx
push ebx
push edx
call fcn.0040cb90
mov eax, dword [ebp - 0x224]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d0dc
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x228]
jmp 0x40cffa
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418c9e
mov esp, ebp
pop ebp
ret