Function at 0x4019f0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x920
mov eax, dword [str.EnumPCI]
mov ecx, dword [0x408940]
mov dl, byte [0x408944]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xa1]
mov byte [esp + 0xa0], dl
mov esi, str.SystemCurrentControlSetcontrolMediaResources_
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xc
lea edi, [esp + 0xe8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x119]
xor ebp, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4099a0
push 8
stosb byte es:[edi], al
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push str.SystemCurrentControlSet_servicesClassMEDIA
push 0x80000002
call edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x401bfd
lea esi, [esp + 0x228]
mov edx, dword [0x4099a0]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push 0
lea ecx, [esp + 0x58]
push eax
push ecx
push ebp
push edx
mov dword [esp + 0x34], 0x50
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x401acd
mov byte [esp + 0x4c], al
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc ebp
add esi, 0x12
jmp 0x401a8b
mov ecx, dword [0x4099a0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
test ebp, ebp
jbe 0x401c03
lea esi, [esp + 0x228]
mov dword [esp + 0x10], ebp
push esi
push str.SystemCurrentControlSet_servicesClassMEDIA
push str._s_s
push 0x409920
call ebx
add esp, 0x10
push 0x4099a0
push 0x20019
push 0
push 0x409920
push 0x80000002
call edi
test eax, eax
jne 0x401beb
xor edi, edi
cmp edi, 0x3e8
jae 0x401bd8
mov ecx, dword [0x4099a0]
mov eax, 0x50
push 0
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push 0
lea edx, [esp + 0x24]
push 0
lea eax, [esp + 0x148]
push edx
push eax
push edi
push ecx
mov byte [esp + 0x158], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, eax
test ebp, ebp
jne 0x401bcf
lea edx, [esp + 0x138]
push str.ProviderName
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401bcf
mov byte [esp + 0x48], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x48]
push eax
push ecx
mov ecx, dword [0x4099a0]
push ebp
lea edx, [esp + 0x24]
push ebp
lea eax, [esp + 0x148]
push edx
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea edx, [esp + 0x48]
push str.C_MEDIA
push edx
mov byte [esp + 0x57], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x401d2d
inc edi
test ebp, ebp
je 0x401b26
mov edx, dword [0x4099a0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
add esi, 0x12
dec eax
mov dword [esp + 0x10], eax
jne 0x401aef
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
push 0x4099a0
push 8
lea eax, [esp + 0xa0]
push ebp
push eax
push 0x80000002
mov dword [esp + 0x24], ebp
call edi
test eax, eax
jne 0x401de8
mov eax, dword [0x4099a0]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x58]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x34], 0x50
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x401d1b
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1d8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x48]
push str.VEN_13F6DEV_01
push eax
mov byte [esp + 0x5f], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401d1b
mov ecx, dword [0x4099a0]
push ecx
call esi
lea edx, [esp + 0x1d8]
lea eax, [esp + 0x98]
push edx
push eax
lea ecx, [esp + 0x190]
push str._s_s
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x188]
push 0x4099a4
push 0x20019
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x401d1b
lea eax, [esp + 0x188]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401dc7
mov ecx, dword [0x4099a0]
push ecx
call esi
push 0x4099a0
push 8
lea edx, [esp + 0xa0]
push 0
push edx
push 0x80000002
call edi
xor ebp, ebp
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
inc ebp
test eax, eax
jne 0x401ddf
jmp 0x401c28
push 0x409920
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [0x4099a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xe8]
push ecx
push str._saux
push 0x409920
call ebx
mov edi, dword [esp + 0x940]
push esi
push edi
call fcn.004020e0
lea edx, [esp + 0xfc]
push edx
push str._smidi
push 0x409920
call ebx
push esi
push edi
call fcn.004020e0
lea eax, [esp + 0x110]
push eax
push str._smixer
push 0x409920
call ebx
push esi
push edi
call fcn.004020e0
lea ecx, [esp + 0x124]
push ecx
push str._swave
push 0x409920
call ebx
add esp, 0x48
push esi
push edi
call fcn.004020e0
add esp, 8
jmp 0x401be5
mov eax, dword [0x4099a0]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x920
ret
mov ecx, dword [0x4099a0]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x20]
push str.EnumVIRTUALSSC_SWMIDI
push edx
call ebx
push 0x4099a0
push 0x20019
lea eax, [esp + 0x28]
push 0
push eax
push 0x80000002
call edi
test eax, eax
jne 0x401e57
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x20]
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x401e45
mov edx, dword [0x4099a0]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x920
ret
mov eax, dword [0x4099a0]
push eax
call esi
mov dword [esp + 0x10], 1
jmp 0x401e5d
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x20]
push str.EnumVIRTUALSSC_DOSEMU
push ecx
call ebx
push 0x4099a0
push 0x20019
lea edx, [esp + 0x28]
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x401ebf
lea eax, [esp + 0x20]
push eax
push 0x80000002
call ebp
test eax, eax
je 0x401eae
mov ecx, dword [0x4099a0]
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x920
ret
mov edx, dword [0x4099a0]
push edx
call esi
mov dword [esp + 0x10], 1
lea eax, [esp + 0x20]
push str.EnumVIRTUALSSC_LEGACY
push eax
call ebx
push 0x4099a0
push 0x20019
lea ecx, [esp + 0x28]
push 0
push ecx
push 0x80000002
call edi
test eax, eax
jne 0x401f20
lea edx, [esp + 0x20]
push edx
push 0x80000002
call ebp
test eax, eax
je 0x401f0f
mov eax, dword [0x4099a0]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x920
ret
mov ecx, dword [0x4099a0]
push ecx
call esi
mov dword [esp + 0x10], 1
lea edx, [esp + 0x20]
push str.EnumVIRTUALSSC_SBEMU
push edx
call ebx
push 0x4099a0
push 0x20019
lea eax, [esp + 0x28]
push 0
push eax
push 0x80000002
call edi
test eax, eax
jne 0x401f81
lea ecx, [esp + 0x20]
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x401f71
mov edx, dword [0x4099a0]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x920
ret
mov eax, dword [0x4099a0]
push eax
call esi
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x20]
push str.EnumVIRTUALSSC_JOYSTK
push ecx
call ebx
push 0x4099a0
push 0x20019
lea edx, [esp + 0x28]
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x4020c2
lea eax, [esp + 0x20]
push eax
push 0x80000002
call ebp
test eax, eax
je 0x401fd6
mov ecx, dword [0x4099a0]
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x920
ret
mov edx, dword [0x4099a0]
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.device_drivers_found_and_removed__n
push 0x409700
call ebx
mov esi, dword [esp + 0x934]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x409700
push 0x69
push esi
call ebp
push 0x4099a0
push 0x20006
push 0
push str.Audio3D
push 0x80000000
call edi
test eax, eax
jne 0x402056
push str.Audio3D
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [0x4099a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.3D_drivers_found_and_removed__n
push 0x409700
call ebx
push 0x409700
push 0x69
push esi
call ebp
lea ecx, [esp + 0x48]
push str.CLSIDD8F1EEE0_F634_11CF_8700_00A0245D918B
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4099a0
push 0x20006
lea edx, [esp + 0x50]
push 0
push edx
push 0x80000000
call edi
test eax, eax
jne 0x4020b5
lea eax, [esp + 0x48]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [0x4099a0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.3D_drivers_found_and_removed__n
push 0x409700
call ebx
push 0x409700
push 0x69
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x920
ret
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401fdf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x920
ret