Function at 0x439f10
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50912f
push eax
mov eax, 0x241c
mov dword fs:[0], esp
call fcn.004d12b0
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 9
ja 0x43a781
push ebx
call fcn.0043a7a0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x3b4], ax
lea eax, [ebp - 0x3b2]
push eax
call fcn.004cf600
add esp, 0x10
lea eax, [ebp - 0x3b4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x3b4]
push 0x5c
push eax
call fcn.004d28b3
add esp, 8
test eax, eax
je 0x439f98
xor ecx, ecx
mov word [eax], cx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x15f0], ax
lea eax, [ebp - 0x15ee]
push eax
call fcn.004cf600
push str.SynTPCpl.dll
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x15f0]
push 0x5187a4
push eax
call fcn.004d1675
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xdd0], ax
lea eax, [ebp - 0xdce]
push eax
call fcn.004cf600
push ebx
push dword [0x5da9e8]
lea eax, [ebp - 0xdd0]
push str._s_d
push eax
call fcn.004d1675
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x1c08], ax
lea eax, [ebp - 0x1c06]
push eax
call fcn.004cf600
add esp, 0x44
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0x1c08]
push str.Synaptics._s
push eax
call fcn.004d1675
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x9cc], ax
lea eax, [ebp - 0x9ca]
push eax
call fcn.004cf600
push ebx
lea eax, [ebp - 0x15f0]
push eax
lea eax, [ebp - 0x9cc]
push str.rundll32.exe___s__ShowDevicePropPage__d
push eax
call fcn.004d1675
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2428], ax
lea eax, [ebp - 0x2426]
push eax
call fcn.004cf600
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x2428]
push str.__sSynTPEnh.exe___PROFILES
push eax
call fcn.004d1675
add esp, 0x40
lea ecx, [ebp - 0xb0]
call fcn.00439a80
push 0
push ebx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0
call fcn.0043b290
test eax, eax
je 0x43a0d0
or esi, 0xffffffff
jmp 0x43a75b
lea ecx, [ebp - 0xb0]
mov esi, 1
call fcn.0043aa30
test eax, eax
je 0x43a138
push 0
lea ecx, [ebp - 0x78]
call fcn.004b90e0
push 0
push 0
push 0
push str.SoftwareSynapticsSynTPEnh
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.004bcca0
test eax, eax
je 0x43a12c
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push str.DeviceNameFormat
lea ecx, [ebp - 0x74]
call fcn.004cbcf0
test eax, eax
cmovne esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0
call fcn.004b93f0
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c0d90
push 0
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.004b90e0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 0x82
call fcn.0043aa30
test eax, eax
je 0x43a1a9
push 0
push 0
push 0
push str.SoftwareSynapticsSynTPEnh
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xcc]
call fcn.004bcca0
test eax, eax
je 0x43a1a9
push 0
lea eax, [ebp - 0x14]
push eax
push eax
push str.CplEntryTPIconID
lea ecx, [ebp - 0xc8]
call fcn.004cbcf0
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2018], ax
lea eax, [ebp - 0x2016]
push eax
call fcn.004cf600
push dword [ebp - 0x14]
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x2018]
push str._sSynTPRes.dll___d
push eax
call fcn.004d1675
add esp, 0x1c
lea ecx, [ebp - 0xbc8]
push dword [ebx*4 + 0x5da9b8]
call fcn.004399d0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2220], ax
lea eax, [ebp - 0x221e]
push eax
call fcn.004cf600
push str.DeviceDiscoveryEnhancements
push str.SoftwareSynapticsSynTPEnh
lea eax, [ebp - 0x2220]
push 0x5187a4
push eax
call fcn.004d1675
add esp, 0x1c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
push 0x20019
lea eax, [ebp - 0x2220]
mov byte [ebp - 4], 5
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5c]
call fcn.0043aa70
xor eax, eax
xor edi, edi
push 0x206
push eax
mov word [ebp - 0x5bc], ax
lea eax, [ebp - 0x5ba]
push eax
call fcn.004cf600
mov ebx, dword [ebp - 0x5c]
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
test ebx, ebx
je 0x43a4ee
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c4], ax
lea eax, [ebp - 0x7c2]
push eax
call fcn.004cf600
add esp, 0xc
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x7c4]
push eax
push str.Keywords
call fcn.0043ab20
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xfd8], ax
lea eax, [ebp - 0xfd6]
push eax
call fcn.004cf600
push 0x7a7
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0xfd8]
push str.__sSynTPRes.dll___d
push eax
call fcn.004d1675
add esp, 0x1c
lea eax, [ebp - 0x9cc]
lea ecx, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0xfd8]
push eax
call fcn.00439d70
lea ebx, [ebx]
lea eax, [ebp - 0xd4]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5bc]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43a4ee
lea eax, [ebp - 0x5bc]
push str.Link
push eax
call fcn.004d299d
add esp, 8
test eax, eax
je 0x43a4d8
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0x20019
lea eax, [ebp - 0x5bc]
mov byte [ebp - 4], 6
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.0043aa70
test eax, eax
jne 0x43a4b8
push 0x206
push eax
mov word [ebp - 0x1e10], ax
lea eax, [ebp - 0x1e0e]
push eax
call fcn.004cf600
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x1a00], ax
lea eax, [ebp - 0x19fe]
push eax
call fcn.004cf600
add esp, 0x18
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1e10]
push eax
push str.Command
call fcn.0043ab20
mov esi, eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a00]
push eax
push str.Name
call fcn.0043ab20
mov dword [ebp - 0x18], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x11e0], ax
lea eax, [ebp - 0x11de]
push eax
call fcn.004cf600
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x13e8], ax
lea eax, [ebp - 0x13e6]
push eax
call fcn.004cf600
add esp, 0x18
lea eax, [ebp - 0x11e0]
push 0x104
push eax
lea eax, [ebp - 0x1e10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
lea eax, [ebp - 0x13e8]
push eax
lea eax, [ebp - 0x1a00]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test esi, esi
jne 0x43a4b8
cmp dword [ebp - 0x18], esi
jne 0x43a4b8
lea eax, [ebp - 0x11e0]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0x13e8]
push eax
lea ecx, [ebp - 0xbc8]
call fcn.00439d70
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 5
test eax, eax
je 0x43a4d1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
inc edi
mov dword [ebp - 0x1c], 0x104
xor eax, eax
mov word [ebp - 0x5bc], ax
jmp 0x43a330
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x17f8], ax
lea eax, [ebp - 0x17f6]
push eax
call fcn.004cf600
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x17f8]
push edi
push dword [0x5da9e8]
push str._s_d.xml
push eax
call fcn.004d1675
add esp, 0x1c
lea ecx, [ebp - 0x90]
push 0x517e78
call fcn.004158d0
mov esi, eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 7
push eax
call fcn.004c72c0
push esi
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 8
push eax
call fcn.00439870
add esp, 0x10
cmp dword [ebp - 0x3c], 8
jb 0x43a569
push dword [ebp - 0x50]
call fcn.004cf489
add esp, 4
xor eax, eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], 0
mov word [ebp - 0x50], ax
cmp dword [ebp - 0x7c], 8
mov byte [ebp - 4], 0xb
jb 0x43a595
push dword [ebp - 0x90]
call fcn.004cf489
add esp, 4
xor eax, eax
mov dword [ebp - 0x7c], 7
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x74]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
mov dword [ebp - 0x80], 0
call fcn.004158d0
push 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xc
push 0
push eax
call fcn.004c6390
add esp, 0xc
mov byte [ebp - 4], 0xb
test eax, eax
sete al
cmp dword [ebp - 0x60], 8
mov byte [ebp + 0xb], al
jb 0x43a5f4
push dword [ebp - 0x74]
call fcn.004cf489
mov al, byte [ebp + 0xb]
add esp, 4
test al, al
je 0x43a5fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x17f8]
push eax
lea ecx, [ebp - 0x38]
call fcn.00417a50
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0xbc8]
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.0043ad40
lea ecx, [ebp - 0x1ac]
call fcn.00439920
lea eax, [ebp - 0x1c08]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0043b2f0
push dword [0x5da9ec]
lea ecx, [ebp - 0x1ac]
call fcn.0043b340
lea eax, [ebp - 0x9cc]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0043b390
lea eax, [ebp - 0xdd0]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0043b3f0
push dword [edi*4 + 0x5da9b8]
lea ecx, [ebp - 0x1ac]
call fcn.00409260
lea eax, [ebp - 0x2018]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0043b440
push 0x50daec
lea ecx, [ebp - 0x1ac]
call fcn.0043b4a0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ac]
call fcn.0043b4f0
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x1ac]
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.0043b590
lea ecx, [ebp - 0x1ac]
call fcn.0043b5f0
lea ecx, [ebp - 0x1ac]
mov esi, eax
call fcn.00439b70
cmp dword [ebp - 0x24], 8
pop edi
jb 0x43a6fd
push dword [ebp - 0x38]
call fcn.004cf489
add esp, 4
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
test ebx, ebx
je 0x43a71c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xbc8]
mov byte [ebp - 4], 3
call fcn.00439d00
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.004b93f0
mov edx, dword [ebp - 0x20]
or ecx, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43a75b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0xffffffff
call fcn.00417720
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4