Function at 0x405b10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x425476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x39c
push ebx
mov ebx, ecx
push ebp
push edi
lea edi, [ebx + 4]
mov dword [esp + 0x40], ebx
mov ecx, edi
call fcn.00417e6a
xor ebp, ebp
push 0xffffffffffffffff
push ebp
mov ecx, edi
mov dword [esp + 0x3b8], ebp
mov dword [ebx], 0x427260
call fcn.00417f03
push ebp
lea ecx, [esp + 0x58]
call fcn.00409200
mov eax, dword [esp + 0x90]
mov byte [esp + 0x3b0], 1
cmp eax, 1
jne 0x405e80
push esi
mov esi, 0x100
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
call fcn.0041969c
lea ecx, [esp + 0x14]
mov byte [esp + 0x3b4], 2
call fcn.0041969c
lea eax, [esp + 0x18]
mov byte [esp + 0x3b4], 3
push eax
push 0x20019
push ebp
push str.EnumPCI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405e5d
mov bl, 7
push 0
push 0
push 0
lea ecx, [esp + 0x38]
push 0
lea edx, [esp + 0x1bc]
mov eax, ebp
push ecx
push edx
push eax
mov eax, dword [esp + 0x34]
inc ebp
push eax
mov dword [esp + 0x5c], ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
je 0x405e4e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
lea edx, [esp + 0x1b4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405e41
push eax
push eax
push eax
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0xbc]
push ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
je 0x405e32
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
lea edx, [esp + 0xb4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405dfb
lea ecx, [esp + 0x28]
lea edx, [esp + 0x2ac]
push ecx
lea eax, [esp + 0x54]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x5c]
push eax
push ecx
push str.Class
push edx
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ced
lea eax, [esp + 0x2ac]
lea ecx, [esp + 0x4c]
push eax
call fcn.00419855
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3b8], 4
call fcn.004198e0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3b4], 3
call fcn.004197e7
jmp 0x405cf6
lea ecx, [esp + 0x14]
call fcn.00419772
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov esi, str.PCMCIA
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405d2e
test cl, cl
je 0x405d2a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405d2e
add eax, 2
add esi, 2
test cl, cl
jne 0x405d0a
xor eax, eax
jmp 0x405d33
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
test cl, cl
je 0x405df6
push str.PCI_
lea ecx, [esp + 0x4c]
call fcn.00419855
lea edx, [esp + 0x1ac]
mov byte [esp + 0x3b4], 5
push edx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00419a3e
push 0x42e650
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0x3c0], 6
call fcn.00419a3e
lea edx, [esp + 0xac]
mov byte [esp + 0x3b4], bl
push edx
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00419a3e
mov ecx, dword [eax]
mov edx, dword [edi + 8]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x3bc], 8
call fcn.00418056
lea ecx, [esp + 0x38]
mov byte [esp + 0x3b4], bl
call fcn.004197e7
lea ecx, [esp + 0x30]
mov byte [esp + 0x3b4], 6
call fcn.004197e7
lea ecx, [esp + 0x40]
mov byte [esp + 0x3b4], 5
call fcn.004197e7
lea ecx, [esp + 0x48]
mov byte [esp + 0x3b4], 3
call fcn.004197e7
mov esi, 0x100
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push 0
lea edx, [esp + 0xbc]
mov eax, ebp
push ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], esi
push eax
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
jne 0x405c61
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x3c]
cmp ebp, 0x14
mov dword [esp + 0x2c], esi
jb 0x405bd2
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
mov byte [esp + 0x3b4], 2
call fcn.004197e7
lea ecx, [esp + 0x34]
mov byte [esp + 0x3b4], 1
call fcn.004197e7
pop esi
lea ecx, [esp + 0x54]
mov byte [esp + 0x3b0], 0
call fcn.004096b0
mov ecx, dword [esp + 0x3a8]
pop edi
mov eax, ebx
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3a8
ret