Function at 0x471a70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x46c
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x468], eax
push ebp
push edi
mov edi, ecx
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
jg 0x472b32
push ebx
push esi
push 0x206
lea ecx, [esp + 0x276]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x3c], 1
mov dword [esp + 0x28], ebp
mov word [esp + 0x27c], ax
call fcn.00477820
push 0x206
lea eax, [esp + 0x7a]
xor edx, edx
push ebp
push eax
mov word [esp + 0x80], dx
call fcn.00477820
add esp, 0x18
lea ecx, [esp + 0x20]
push ecx
push 0x20019
xor eax, eax
push ebp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x48], 0
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov byte [esp + 0x59], al
mov dword [esp + 0x28], ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x472145
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x284]
push eax
push ebp
push ecx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x47211f
nop
mov ecx, dword [esp + 0x20]
inc dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebp
lea eax, [esp + 0x27c]
push eax
push ecx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4720f4
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push ebp
push 0x49627c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4720f4
cmp dword [esp + 0x1c], ebp
jbe 0x4720f4
cmp esi, ebp
je 0x471bcd
push esi
call fcn.0047754e
add esp, 4
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004776e1
mov esi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.00477820
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push 0
push str.ServiceName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4720f4
push esi
push 0x4962ac
lea edx, [esp + 0x70]
push 0x104
push edx
call fcn.00463bb0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 3
push 0x80
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4720dd
push 0
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x38]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10114
call ebx
test eax, eax
je 0x4720d2
cmp dword [esp + 0x2c], 0
jne 0x4720d2
mov ecx, dword [edi]
add ecx, 0xc2
shl ecx, 4
add ecx, edi
push ecx
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea edx, [esp + 0x34]
push edx
push esi
mov ecx, edi
call fcn.004708c0
test eax, eax
jne 0x471cfb
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10205
call ebx
test esi, esi
je 0x471d0a
push esi
call fcn.0047754e
add esp, 4
xor esi, esi
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x4962bc
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
mov dword [edi + ecx*2 + 0x16c], edx
lea eax, [edi + ecx*2 + 0x16c]
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
mov byte [eax + 0x10], dl
add esp, 0x20
xor eax, eax
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010101
call ebx
test eax, eax
je 0x471e13
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x4962dc
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
lea eax, [edi + ecx*2 + 4]
mov dword [eax], edx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], dl
xor eax, eax
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010102
call ebx
test eax, eax
je 0x471eb6
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x4962fc
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
lea eax, [edi + ecx*2 + 0xb8]
mov dword [eax], edx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], dl
push 0
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x17000e
push ebp
mov dword [esp + 0x30], 0xd010702
call ebx
test eax, eax
je 0x471eec
push 0x49631c
call fcn.00478735
add esp, 4
push 0
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x17000e
push ebp
mov dword [esp + 0x30], 0xd010314
call ebx
test eax, eax
je 0x471f22
push 0x496324
call fcn.00478735
add esp, 4
push 0
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x17000e
push ebp
mov dword [esp + 0x30], 0xd01031e
call ebx
test eax, eax
je 0x471f58
push str.no1_n
call fcn.00478735
add esp, 4
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x38]
push ecx
push 0
push 0x496334
push edx
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x472006
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x472006
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004776e1
mov esi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.00477820
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push 0
push str.Description
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x1c]
mov ecx, dword [edi]
lea eax, [edx + edx]
push eax
shl ecx, 8
lea edx, [ecx + edi + 0x220]
push esi
push edx
call fcn.004779c0
add esp, 0xc
test esi, esi
je 0x472086
push esi
call fcn.0047754e
add esp, 4
jmp 0x472084
push 0x208
lea eax, [esp + 0x6c]
push 0
push eax
mov dword [esp + 0x1c], 0x1010d
call fcn.00477820
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x208
lea edx, [esp + 0x74]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push 0x170002
push ebp
call ebx
test eax, eax
je 0x472086
cmp dword [esp + 0x14], 0
jbe 0x472086
lea ecx, [esp + 0x68]
push ecx
call fcn.00463270
mov esi, eax
add esp, 4
test esi, esi
je 0x472086
mov edx, dword [esp + 0x14]
mov ecx, dword [edi]
lea eax, [edx + edx]
push eax
shl ecx, 8
lea edx, [ecx + edi + 0x220]
push esi
push edx
call fcn.004779c0
push esi
call fcn.0047754e
add esp, 0x10
xor esi, esi
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010e
call ebx
test eax, eax
je 0x4720c3
test byte [esp + 0x2c], 0x20
je 0x4720c3
mov eax, dword [edi]
mov dword [edi + eax*4 + 0x10d0], 1
test ebp, ebp
je 0x4720ce
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [edi]
jmp 0x4720dd
test ebp, ebp
je 0x4720dd
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4720f4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x28]
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x284]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x471b60
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x472132
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x472145
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebp
mov eax, dword [edi]
cmp eax, ebp
jg 0x472b30
lea edx, [esp + 0x20]
push edx
push 0x20019
push ebp
push 0x496368
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47257e
mov edx, dword [esp + 0x20]
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x284]
push ecx
push ebp
push edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x472554
inc dword [esp + 0x28]
lea eax, [esp + 0x270]
push eax
push 0x4963e4
lea ecx, [esp + 0x70]
push 0x104
push ecx
mov dword [esp + 0x34], 0x104
call fcn.00463bb0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 3
push 0x80
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x472527
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10114
call ebx
test eax, eax
je 0x47251c
cmp dword [esp + 0x2c], 0
jne 0x47251c
mov eax, dword [edi]
add eax, 0xc2
shl eax, 4
add eax, edi
push eax
lea ecx, [esp + 0x274]
push ecx
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x274]
push eax
mov ecx, edi
call fcn.004708c0
test eax, eax
jne 0x47229d
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x12
lea edx, [esp + 0x40]
push edx
push 4
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x24]
push eax
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10205
call ebx
movzx ecx, byte [esp + 0x39]
movzx edx, byte [esp + 0x38]
movzx eax, byte [esp + 0x37]
push ecx
movzx ecx, byte [esp + 0x3a]
push edx
movzx edx, byte [esp + 0x3d]
push eax
movzx eax, byte [esp + 0x40]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
push 0x4963f4
push ecx
call fcn.004786b8
mov eax, dword [edi]
mov ecx, dword [esp + 0x68]
lea edx, [eax + eax*8]
mov dword [edi + edx*2 + 0x16c], ecx
lea eax, [edi + edx*2 + 0x16c]
mov edx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov cl, byte [esp + 0x78]
mov byte [eax + 0x10], cl
add esp, 0x20
xor eax, eax
push eax
lea edx, [esp + 0x18]
push edx
push 0x12
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x40]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010101
call ebx
test eax, eax
je 0x4723a8
movzx edx, byte [esp + 0x39]
movzx eax, byte [esp + 0x38]
movzx ecx, byte [esp + 0x37]
push edx
movzx edx, byte [esp + 0x3a]
push eax
movzx eax, byte [esp + 0x3d]
push ecx
movzx ecx, byte [esp + 0x40]
push edx
push eax
push ecx
lea edx, [esp + 0x60]
push 0x496414
push edx
call fcn.004786b8
mov eax, dword [edi]
mov ecx, dword [esp + 0x68]
lea eax, [eax + eax*8]
mov dword [edi + eax*2 + 4], ecx
mov edx, dword [esp + 0x6c]
lea eax, [edi + eax*2 + 4]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov cl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], cl
xor eax, eax
push eax
lea edx, [esp + 0x18]
push edx
push 0x12
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x40]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010102
call ebx
test eax, eax
je 0x472450
movzx edx, byte [esp + 0x39]
movzx eax, byte [esp + 0x38]
movzx ecx, byte [esp + 0x37]
push edx
movzx edx, byte [esp + 0x3a]
push eax
movzx eax, byte [esp + 0x3d]
push ecx
movzx ecx, byte [esp + 0x40]
push edx
push eax
push ecx
lea edx, [esp + 0x60]
push 0x496434
push edx
call fcn.004786b8
mov eax, dword [edi]
mov ecx, dword [esp + 0x68]
lea eax, [eax + eax*8]
mov dword [edi + eax*2 + 0xb8], ecx
mov edx, dword [esp + 0x6c]
lea eax, [edi + eax*2 + 0xb8]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov cl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], cl
push 0x208
lea edx, [esp + 0x6c]
push 0
push edx
mov dword [esp + 0x1c], 0x1010d
call fcn.00477820
add esp, 0xc
push 0
lea eax, [esp + 0x18]
push eax
push 0x208
lea ecx, [esp + 0x74]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
call ebx
test eax, eax
je 0x4724d0
cmp dword [esp + 0x14], 0
jbe 0x4724d0
lea eax, [esp + 0x68]
push eax
call fcn.00463270
mov esi, eax
add esp, 4
test esi, esi
je 0x4724d0
mov ecx, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [ecx + ecx]
push edx
shl eax, 8
lea ecx, [eax + edi + 0x220]
push esi
push ecx
call fcn.004779c0
push esi
call fcn.0047754e
add esp, 0x10
xor esi, esi
push 0
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x38]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010e
call ebx
test eax, eax
je 0x47250d
test byte [esp + 0x2c], 0x20
je 0x47250d
mov edx, dword [edi]
mov dword [edi + edx*4 + 0x10d0], 1
test ebp, ebp
je 0x472518
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [edi]
jmp 0x472527
test ebp, ebp
je 0x472527
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x28]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x284]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4721a3
mov eax, dword [esp + 0x18]
xor ebp, ebp
cmp eax, ebp
je 0x472569
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x47257c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebp
xor ebp, ebp
mov eax, dword [edi]
cmp eax, ebp
jg 0x472b30
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push str.SYSTEMCurrentControlSetCONTROLCLASS4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472b2e
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x284]
push eax
push ebp
push ecx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x472b0c
lea esp, [esp]
mov ecx, dword [esp + 0x20]
inc dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebp
lea eax, [esp + 0x27c]
push eax
push ecx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472ae1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push ebp
push 0x496014
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x472ae1
cmp dword [esp + 0x1c], ebp
jbe 0x472ae1
cmp esi, ebp
je 0x47264d
push esi
call fcn.0047754e
add esp, 4
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004776e1
mov esi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.00477820
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push 0
push 0x4964f4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x472ae1
push esi
push 0x496518
lea edx, [esp + 0x70]
push 0x104
push edx
call fcn.00463bb0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 3
push 0x80
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x472700
mov eax, dword [esp + 0x18]
test eax, eax
je 0x472ae1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
jmp 0x472ae1
push 0
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x38]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10114
call ebx
test eax, eax
je 0x472ad6
cmp dword [esp + 0x2c], 0
jne 0x472ad6
mov ecx, dword [edi]
add ecx, 0xc2
shl ecx, 4
add ecx, edi
push ecx
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea edx, [esp + 0x34]
push edx
push esi
mov ecx, edi
call fcn.004708c0
test eax, eax
jne 0x472797
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x10205
call ebx
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x496528
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
mov dword [edi + ecx*2 + 0x16c], edx
lea eax, [edi + ecx*2 + 0x16c]
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
mov byte [eax + 0x10], dl
add esp, 0x20
xor eax, eax
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010101
call ebx
test eax, eax
je 0x4728a0
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x496548
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
lea eax, [edi + ecx*2 + 4]
mov dword [eax], edx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], dl
xor eax, eax
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x18]
push eax
push 0x12
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010102
call ebx
test eax, eax
je 0x472943
movzx eax, byte [esp + 0x39]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x37]
push eax
movzx eax, byte [esp + 0x3a]
push ecx
movzx ecx, byte [esp + 0x3d]
push edx
movzx edx, byte [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x60]
push 0x496568
push eax
call fcn.004786b8
mov eax, dword [edi]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
lea eax, [edi + ecx*2 + 0xb8]
mov dword [eax], edx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 0x78]
add esp, 0x20
mov byte [eax + 0x10], dl
mov dword [esp + 0x1c], 0
test esi, esi
je 0x47295a
push esi
call fcn.0047754e
add esp, 4
xor esi, esi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x38]
push ecx
push 0
push 0x496588
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x472a03
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x472a03
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004776e1
mov esi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.00477820
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push 0
push str.DriverDesc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x1c]
mov ecx, dword [edi]
lea eax, [edx + edx]
push eax
shl ecx, 8
lea edx, [ecx + edi + 0x220]
push esi
push edx
call fcn.004779c0
add esp, 0xc
test esi, esi
je 0x472a83
push esi
call fcn.0047754e
add esp, 4
jmp 0x472a81
push 0x208
lea eax, [esp + 0x6c]
push 0
push eax
mov dword [esp + 0x1c], 0x1010d
call fcn.00477820
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x208
lea edx, [esp + 0x74]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push 0x170002
push ebp
call ebx
test eax, eax
je 0x472a83
cmp dword [esp + 0x14], 0
jbe 0x472a83
lea ecx, [esp + 0x68]
push ecx
call fcn.00463270
mov esi, eax
add esp, 4
test esi, esi
je 0x472a83
mov edx, dword [esp + 0x14]
mov ecx, dword [edi]
lea eax, [edx + edx]
push eax
shl ecx, 8
lea edx, [ecx + edi + 0x220]
push esi
push edx
call fcn.004779c0
push esi
call fcn.0047754e
add esp, 0x10
xor esi, esi
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push 0x170002
push ebp
mov dword [esp + 0x30], 0x1010e
call ebx
test eax, eax
je 0x472ac0
test byte [esp + 0x2c], 0x20
je 0x472ac0
mov eax, dword [edi]
mov dword [edi + eax*4 + 0x10d0], 1
inc dword [edi]
test ebp, ebp
je 0x4726e0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4726e0
test ebp, ebp
je 0x472ae1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x284]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4725e0
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x472b1f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x472b2e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
pop edi
pop ebp
xor ecx, esp
call fcn.004771de
add esp, 0x46c
ret