Function at 0x410850
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41320c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x41907c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
push 0
push 0
mov edi, ecx
push 0x4141dc
mov dword [ebp - 0x1c4], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
xor ecx, ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x1c0], ecx
lea ecx, [ebp - 0xe4]
push ecx
push 0
push eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0xe4], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x410916
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040366e
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1c4]
mov ebx, 7
xor esi, esi
xor edx, edx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb8], esi
mov word [ebp - 0xc8], dx
lea eax, [ebp - 0xc8]
push eax
push 9
lea edx, [ebp - 0xe4]
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], esi
call fcn.00410440
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
mov word [ebp - 0x30], cx
lea edx, [ebp - 0xc8]
push edx
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 1
call fcn.00402670
add esp, 0x10
mov byte [ebp - 4], 2
cmp dword [ebp - 0x7c], 8
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x184], esi
jae 0x410991
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x184]
push ecx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x184], esi
je 0x4109dd
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x184]
push eax
mov ecx, str.DeviceID
call fcn.00410110
mov ecx, dword [ebp - 0x184]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x184], esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x180], ebx
jb 0x4109f1
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
cmp edx, ebx
jb 0x4109fa
mov edx, ebx
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x410a06
lea ecx, [ebp - 0x30]
cmp edx, esi
jbe 0x410a33
lea ebx, [ebx]
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x410a23
add ecx, 2
add eax, 2
dec edx
jne 0x410a10
jmp 0x410a2d
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, esi
jne 0x410a4a
mov ebx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jae 0x410a3f
or eax, 0xffffffff
jmp 0x410a48
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
cmp eax, esi
sete al
test al, al
sete al
test al, al
je 0x410aac
cmp dword [ebp - 0x7c], 8
jb 0x410a6b
mov edx, dword [ebp - 0x90]
push edx
call fcn.00403d7c
add esp, 4
xor eax, eax
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x80], esi
mov word [ebp - 0x90], ax
jb 0x410a90
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00403d7c
add esp, 4
xor edx, edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xb4], 8
mov dword [ebp - 0x1c], 7
jmp 0x4111ec
mov eax, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, eax
je 0x410ae2
mov edx, dword [ebp - 0x1a4]
push edx
mov ebx, eax
call fcn.00402890
mov ecx, dword [ebp - 0x1a4]
add esp, 4
mov esi, eax
mov eax, dword [edi + 4]
push ecx
push eax
mov eax, esi
call fcn.004028f0
add esp, 8
mov dword [edi + 4], esi
xor esi, esi
mov ecx, 0x10
mov edx, edi
call fcn.00401460
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x18c]
push edx
push 0x20019
push esi
push str.SYSTEMCurrentControlSetControlClass
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18c], esi
call edi
cmp dword [ebp - 0xb4], 8
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x190], esi
jae 0x410b2e
lea eax, [ebp - 0xc8]
mov edx, dword [ebp - 0x18c]
lea ecx, [ebp - 0x190]
push ecx
push 0x20019
push esi
push eax
push edx
call edi
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x188]
push eax
push 0x20019
push esi
push str.Events
push ecx
mov dword [ebp - 0x188], esi
call edi
mov dword [ebp - 0x180], esi
lea esp, [esp]
xor ebx, ebx
push 0x100
lea esi, [ebp - 0x1a0]
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
call fcn.004025c0
mov edi, dword [ebp - 0x19c]
mov esi, dword [ebp - 0x1a0]
mov edx, edi
sub edx, esi
sar edx, 1
mov ecx, 0x100
sub ecx, edx
je 0x410bdc
xor eax, eax
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
mov esi, dword [ebp - 0x1a0]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x19c]
mov eax, 0x100
sub eax, edx
lea eax, [edi + eax*2]
mov dword [ebp - 0x19c], eax
lea ecx, [ebp - 0x1d4]
push ecx
mov ecx, dword [ebp - 0x188]
push ebx
push ebx
push ebx
sub eax, esi
sar eax, 1
lea edx, [ebp - 0x1cc]
push edx
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x180]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41114a
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x17c]
push edx
push 0x20019
push ebx
push esi
push eax
mov dword [ebp - 0x17c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 7
xor ecx, ecx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x74], cx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 4
call fcn.00410110
xor ecx, ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], cx
lea edx, [ebp - 0xac]
push edx
lea eax, [ebp - 0x17c]
push eax
mov ecx, str.GUID
mov byte [ebp - 4], 5
call fcn.00410110
mov eax, dword [ebp - 0xac]
add esp, 0x10
cmp dword [ebp - 0x98], 8
jae 0x410cbc
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x1b8], ebx
lea ecx, [ecx]
push 0x100
lea esi, [ebp - 0x1b4]
mov dword [ebp - 0x1dc], ebx
mov dword [ebp - 0x1d8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
call fcn.004025c0
mov edi, dword [ebp - 0x1b0]
mov esi, dword [ebp - 0x1b4]
mov edx, edi
sub edx, esi
sar edx, 1
mov ecx, 0x100
sub ecx, edx
je 0x410d3a
xor eax, eax
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
mov esi, dword [ebp - 0x1b4]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x1b0]
mov eax, 0x100
sub eax, edx
lea eax, [edi + eax*2]
mov dword [ebp - 0x1b0], eax
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, dword [ebp - 0x17c]
push ebx
push ebx
push ebx
sub eax, esi
sar eax, 1
lea edx, [ebp - 0x1c8]
push edx
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1b8]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41103e
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
push edx
push 0x20019
push ebx
push esi
push eax
mov dword [ebp - 0x178], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x178], ebx
je 0x411003
mov eax, 7
mov dword [ebp - 0x160], eax
xor ecx, ecx
mov dword [ebp - 0x144], eax
xor edx, edx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0xf0], eax
xor eax, eax
mov dword [ebp - 0x164], ebx
mov word [ebp - 0x174], cx
mov dword [ebp - 0x148], ebx
mov word [ebp - 0x158], dx
mov dword [ebp - 0x12c], ebx
mov word [ebp - 0x13c], cx
mov dword [ebp - 0x110], ebx
mov word [ebp - 0x120], dx
mov dword [ebp - 0xf4], ebx
mov word [ebp - 0x104], ax
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x178]
push edx
mov ecx, str.CmdLine
mov byte [ebp - 4], 7
call fcn.00410110
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x178]
push ecx
mov ecx, str.Name
call fcn.00410110
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x178]
push eax
mov ecx, str.Desc
call fcn.00410110
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x178]
push edx
mov ecx, str.Icon
call fcn.00410110
add esp, 0x20
cmp dword [ebp - 0x148], ebx
je 0x410fdf
mov ebx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x174]
cmp eax, ebx
jae 0x410f50
mov ecx, eax
cmp esi, ecx
ja 0x410f50
sub ecx, esi
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp ebx, dword [ebp - 0x40]
jne 0x410f38
mov ecx, ebx
sub ecx, esi
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x1d41d40
ja 0x411233
mov edx, dword [ebp - 0x40]
sub edx, esi
mov dword [ebp - 0x1a4], edx
mov eax, 0xea0ea0eb
imul edx
add edx, dword [ebp - 0x1a4]
inc ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jbe 0x410f38
mov edx, eax
shr edx, 1
mov esi, 0x1d41d41
sub esi, edx
cmp esi, eax
jae 0x410f21
xor eax, eax
jmp 0x410f23
add eax, edx
cmp eax, ecx
jae 0x410f29
mov eax, ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.004022d0
mov ebx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
imul edi, edi, 0x8c
add edi, esi
mov byte [ebp - 4], 8
test ebx, ebx
je 0x410fd4
mov ecx, edi
jmp 0x410fcb
mov edi, dword [ebp - 0x40]
cmp ebx, edi
jne 0x410fbd
mov ecx, ebx
sub ecx, esi
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x1d41d40
ja 0x411233
sub edi, esi
mov esi, edi
mov eax, 0xea0ea0eb
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ecx
add eax, edx
cmp ecx, eax
jbe 0x410fbd
mov edx, eax
shr edx, 1
mov esi, 0x1d41d41
sub esi, edx
cmp esi, eax
jae 0x410fa9
xor eax, eax
jmp 0x410fab
add eax, edx
cmp eax, ecx
jae 0x410fb1
mov eax, ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.004022d0
mov ebx, dword [ebp - 0x44]
mov byte [ebp - 4], 9
test ebx, ebx
je 0x410fd4
lea ecx, [ebp - 0x174]
push ebx
call fcn.00402a00
mov ebx, dword [ebp - 0x44]
add ebx, 0x8c
mov dword [ebp - 0x44], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x178]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x174]
mov dword [ebp - 0x178], ebx
call fcn.004011a0
mov esi, dword [ebp - 0x1b4]
mov byte [ebp - 4], 5
cmp esi, ebx
je 0x411014
push esi
call fcn.00403d7c
add esp, 4
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b8], eax
cmp eax, 0x20
jl 0x410cd0
jmp 0x411061
mov byte [ebp - 4], 5
cmp esi, ebx
je 0x41104f
push esi
call fcn.00403d7c
add esp, 4
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov ebx, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x74]
call fcn.00401530
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 0x98], 8
mov dword [ebp - 0x17c], ebx
jb 0x41109c
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.00403d7c
add esp, 4
mov esi, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], dx
cmp esi, ebx
je 0x4110de
mov edi, dword [ebp - 0x44]
cmp esi, edi
je 0x4110d5
call fcn.004011a0
add esi, 0x8c
cmp esi, edi
jne 0x4110c3
mov esi, dword [ebp - 0x48]
push esi
call fcn.00403d7c
add esp, 4
cmp dword [ebp - 0x60], 8
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
jb 0x4110f9
mov eax, dword [ebp - 0x74]
push eax
call fcn.00403d7c
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1a0]
xor ecx, ecx
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x74], cx
cmp eax, ebx
je 0x411120
push eax
call fcn.00403d7c
add esp, 4
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x180], eax
cmp eax, 0x10
jl 0x410b70
jmp 0x411169
cmp esi, ebx
je 0x411157
push esi
call fcn.00403d7c
add esp, 4
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
mov edx, dword [ebp - 0x188]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push edx
lea edi, [esi + 8]
call ebx
mov eax, dword [ebp - 0x190]
push eax
mov dword [ebp - 0x188], esi
call ebx
mov ecx, dword [ebp - 0x18c]
push ecx
mov dword [ebp - 0x190], esi
call ebx
mov dword [ebp - 0x18c], esi
cmp dword [ebp - 0x7c], edi
jb 0x4111b5
mov edx, dword [ebp - 0x90]
push edx
call fcn.00403d7c
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], esi
mov word [ebp - 0x90], ax
cmp dword [ebp - 0x1c], edi
jb 0x4111da
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00403d7c
add esp, 4
xor edx, edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xb4], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x30], dx
mov dword [ebp - 0x20], esi
jb 0x411204
mov eax, dword [ebp - 0xc8]
push eax
call fcn.00403d7c
add esp, 4
mov eax, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1bc]
lea ecx, [ebp - 0xe4]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x1c0], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x410910
jmp 0x4108ed
push str.vector_T__too_long
call fcn.004035b3
int3