Function at 0x40f61a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
push ebx
push esi
push edi
push 0x15
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea eax, [ebp - 0x78]
push eax
mov esi, str.SYSTEMCurrentControlSetControlusbflags
lea edi, [ebp - 0x78]
push 0x80000002
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fb0f
cmp dword [ebp - 4], ebx
je 0x40fb0f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x40f759
cmp dword [ebp - 8], ebx
je 0x40f759
movzx eax, word [esi + 0xa]
push eax
movzx eax, word [esi + 8]
push eax
lea eax, [ebp - 0x508]
push str.IgnoreHWSerNum_04x_04x
push eax
call edi
add esp, 0x10
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 8], ebx
jbe 0x40f759
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x208
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40f74a
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40f718
push str.GlobalDisableSerNumGen
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40f74a
cmp dword [ebp - 0x10], ebx
je 0x40f73b
push str._r_n_________Registry_USB_Flags__r_n
call fcn.0040cdf8
lea eax, [ebp - 0x78]
push eax
push str.HKEY_LOCAL_MACHINE_s_r_n
call fcn.0040ce4b
add esp, 0xc
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 4]
call fcn.0040f265
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jb 0x40f6c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, word [esi + 8]
mov dword [ebp - 4], ebx
cmp ax, bx
je 0x40f85c
movzx ecx, word [esi + 0xc]
push ecx
movzx ecx, word [esi + 0xa]
movzx eax, ax
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x488]
push str._s_04X_04X_04X
push eax
call edi
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x488]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f85c
cmp dword [ebp - 4], ebx
je 0x40f85c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40f850
cmp dword [ebp - 8], ebx
je 0x40f850
cmp dword [ebp - 0x10], ebx
je 0x40f7f5
push str._r_n_________Registry_USB_Flags__r_n
call fcn.0040cdf8
pop ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x488]
push eax
push str.HKEY_LOCAL_MACHINE_s_r_n
call fcn.0040ce4b
pop ecx
pop ecx
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 8], ebx
jbe 0x40f850
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x208
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40f845
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 4]
call fcn.0040f265
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jb 0x40f810
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov ecx, dword [0x4fc544]
call fcn.004011ae
test eax, eax
je 0x40fa44
mov eax, dword [ebp + 8]
push str.USBSTOR
add eax, 0x1f6c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40fa44
lea eax, [ebp - 0x488]
push str.SYSTEMCurrentControlSetControlusbstor
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x488]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fa44
cmp dword [ebp - 4], ebx
je 0x40fa44
movzx eax, word [esi + 0xa]
push eax
movzx eax, word [esi + 8]
push eax
lea eax, [ebp - 0x24]
push str._04X_04X
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
add esp, 0x10
push 0x104
lea eax, [ebp - 0x280]
push eax
mov dword [ebp - 0xc], ebx
push ebx
jmp 0x40f997
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 8
jne 0x40f985
push 2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0043f5b5
add esp, 0xc
test eax, eax
jne 0x40f985
movzx ecx, word [ebp + eax - 0x27c]
cmp cx, 0x78
je 0x40f93e
cmp cx, word [ebp + eax - 0x20]
jne 0x40f985
inc eax
inc eax
cmp eax, 0xc
jl 0x40f929
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x488]
push str.SYSTEMCurrentControlSetControlusbstor_s
push eax
call edi
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x488]
push eax
push 0x80000002
mov dword [ebp + 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f985
cmp dword [ebp + 0xc], ebx
jne 0x40f9a9
inc dword [ebp - 0xc]
push 0x104
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x40f8fe
jmp 0x40fa38
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40fa2f
cmp dword [ebp - 8], ebx
je 0x40fa2f
cmp dword [ebp - 0x10], ebx
je 0x40f9dc
push str._r_n_________Registry_USB_Flags__r_n
call fcn.0040cdf8
pop ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x488]
push eax
push str.HKEY_LOCAL_MACHINE_s_r_n
call fcn.0040ce4b
pop ecx
xor esi, esi
pop ecx
cmp dword [ebp - 8], ebx
jbe 0x40fa2f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x710]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40fa29
lea eax, [ebp - 0x710]
push eax
push dword [ebp + 0xc]
call fcn.0040f265
inc esi
cmp esi, dword [ebp - 8]
jb 0x40f9f6
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
mov ecx, dword [0x4fc544]
push esi
call fcn.004011ae
test eax, eax
je 0x40fb0f
add esi, 0xe34
push esi
lea eax, [ebp - 0x488]
push str.SYSTEMCurrentControlSetEnum_sDevice_Parameters
push eax
call edi
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x488]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fb0f
cmp dword [ebp - 4], ebx
je 0x40fb0f
mov eax, str.DeviceHackFlags
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], str.MaximumTransferLength
mov dword [ebp - 0x1c], str.IdleUsbSelectiveSuspendPolicy
mov dword [ebp - 0x18], ebx
mov dword [ebp + 8], 4
xor edi, edi
mov esi, eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fb06
cmp dword [ebp - 0x10], ebx
je 0x40faea
push str._r_n_________Registry_USB_Flags__r_n
call fcn.0040cdf8
pop ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x488]
push eax
push str.HKEY_LOCAL_MACHINE_s_r_n
call fcn.0040ce4b
pop ecx
pop ecx
push esi
push dword [ebp - 4]
call fcn.0040f265
mov esi, dword [ebp + edi*4 - 0x20]
inc edi
cmp esi, ebx
jne 0x40fabc
pop edi
pop esi
pop ebx
leave
ret 8