Function at 0x61020b85
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x270
mov eax, 0x6103f74b
call fcn.6102ab31
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x27c], edi
call fcn.6100d224
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x264], ebx
call fcn.6100d224
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.6100d224
mov byte [ebp - 4], 2
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
je 0x61021038
push esi
call fcn.6101735a
test al, al
je 0x61021038
cmp edi, ebx
je 0x61021038
mov dword [edi], ebx
call fcn.610170fb
push 2
pop edi
cmp eax, edi
je 0x61020c2b
cmp eax, 3
je 0x61020c2b
cmp eax, 4
mov dword [ebp - 0x250], edi
jne 0x61020c35
mov dword [ebp - 0x250], 1
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.61012293
test eax, eax
jne 0x61020c61
push dword [esi]
push 0x610048f0
push edi
call fcn.6101b077
add esp, 0xc
mov dword [ebp - 0x23c], ebx
jmp 0x61021004
cmp dword [ebp - 0x250], 1
jne 0x61020cc7
push ecx
lea eax, [ebp - 0x238]
mov ecx, esp
mov dword [ebp - 0x26c], esp
push eax
call fcn.6100d24f
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.61011d8f
cmp eax, ebx
je 0x61020ca0
push dword [ebp - 0x238]
push 0x610057e4
jmp 0x61020d2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
push 0x610057b4
push eax
push 3
call fcn.6101b109
add esp, 0x10
jmp 0x61021004
cmp dword [ebp - 0x250], edi
jne 0x61020d39
push 0x6100502c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x260], eax
jne 0x61020cf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
jmp 0x61020ff0
push 0x610057a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x25c], eax
je 0x61020ce4
push dword [ebp + 0xc]
lea eax, [ebp - 0x238]
push eax
call fcn.6101e732
cmp eax, ebx
push dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
jne 0x61020d66
push 0x61005764
push 1
call fcn.6101b077
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.61017dbb
test al, al
jne 0x61020d7b
mov dword [ebp - 0x23c], 0x57
jmp 0x61020ff0
push 0x61005730
push eax
push 3
call fcn.6101b109
add esp, 0x10
jmp 0x61020ff0
push 6
push ebx
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x26c], edi
je 0x61020ce4
lea eax, [ebp - 0x234]
push eax
push ebx
push edi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x234], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x61020fb0
inc dword [ebp - 0x264]
push 0x20019
push 2
push ebx
push 1
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, 0xffffffff
mov dword [ebp - 0x258], eax
je 0x61020f7f
lea ecx, [ebp - 0x278]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x274]
push ecx
push ebx
push 0x61004b94
push eax
mov dword [ebp - 0x278], 0x208
mov dword [ebp - 0x274], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x61020f6c
push 0xffffffffffffffff
push dword [ebp - 0x244]
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x61020f6c
cmp dword [ebp - 0x250], 1
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], ebx
push eax
jne 0x61020e75
lea esi, [ebp - 0x234]
mov ecx, edi
call fcn.61020a0b
jmp 0x61020ebe
push ebx
push ebx
lea eax, [ebp - 0x234]
push eax
push edi
push ebx
call dword [ebp - 0x25c]
test eax, eax
jne 0x61020ecc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xe0000203
mov dword [ebp - 0x240], eax
jne 0x61020ecc
lea eax, [ebp - 0x248]
push eax
push 4
push ebx
lea eax, [ebp - 0x234]
push eax
push edi
push ebx
call dword [ebp - 0x25c]
test eax, eax
jne 0x61020ec6
call esi
mov dword [ebp - 0x240], eax
jmp 0x61020ecc
mov dword [ebp - 0x240], ebx
cmp dword [ebp - 0x240], ebx
jne 0x61020edc
inc dword [ebp - 0x254]
jmp 0x61020f52
call fcn.6101af38
test eax, eax
je 0x61020f52
lea ecx, [ebp - 0x268]
call fcn.6100d224
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push edi
lea edi, [ebp - 0x268]
call fcn.6101ec8d
test eax, eax
jne 0x61020f28
push dword [ebp - 0x268]
push 0x610056d8
push dword [ebp - 0x240]
push 3
call fcn.6101b109
add esp, 0x10
jmp 0x61020f3d
push 0x610056a0
push dword [ebp - 0x240]
push 3
call fcn.6101b109
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x268]
call fcn.6100d179
mov edi, dword [ebp - 0x26c]
cmp dword [ebp - 0x248], ebx
mov esi, dword [ebp - 0x270]
je 0x61020f6c
mov eax, dword [ebp - 0x27c]
mov dword [eax], 1
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x258], 0xffffffff
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x264]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x61020dbe
cmp dword [ebp - 0x258], 0xffffffff
je 0x61020fb0
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
call fcn.6101af38
test eax, eax
je 0x61020ff0
cmp dword [ebp - 0x254], ebx
push dword [esi]
je 0x61020fe1
push dword [ebp - 0x254]
push 0x61005648
push 1
call fcn.6101b077
jmp 0x61020d73
push 0x61005600
push 1
call fcn.6101b077
add esp, 0xc
cmp dword [ebp - 0x260], ebx
je 0x61021004
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.6100d179
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24c]
call fcn.6100d179
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.6100d179
mov eax, dword [ebp - 0x23c]
jmp 0x61021067
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.6100d179
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24c]
call fcn.6100d179
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.6100d179
push 0x57
pop eax
call fcn.6102abc3
ret 0xc