Function at 0x100028c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
mov eax, dword [0x100140c0]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
push ecx
xor ebx, ebx
push str.USB_d
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 4
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 2
call fcn.1000498d
add esp, 0xc
cmp eax, 1
je 0x10002927
pop esi
mov eax, 0x20000010
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100045aa
add esp, 0x3c
ret 4
mov edx, dword [esp + 8]
add edx, 0xffffffff
cmp edx, 0x7e
ja 0x1000290f
push ebp
push edi
push 0x12
push ebx
push ebx
push 0x100101d4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002acf
lea eax, [esp + 0x2c]
push eax
push ebx
push 0x100101d4
push ebx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x40], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x10002ac4
jmp 0x1000297a
xor ebx, ebx
add dword [esp + 0x18], 1
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
lea edx, [esp + 0x3c]
push edx
push edi
call ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov ebp, eax
mov edx, 5
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100044bb
mov esi, eax
add esp, 4
test esi, esi
je 0x10002a73
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push esi
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esi], 5
call ebx
test eax, eax
je 0x10002a48
lea edx, [esi + 4]
push edx
call fcn.1000f3e5
push str.vid_04b8
push eax
call fcn.10004080
add esp, 0xc
test eax, eax
je 0x10002a48
push 0x20019
push 0
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDeviceInterfaceRegKey]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002a48
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push str.Port_Number
push ebx
mov dword [esp + 0x40], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002a41
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x10]
je 0x10002a94
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10004106
mov eax, dword [esp + 0x1c]
add esp, 4
lea edx, [esp + 0x2c]
push edx
push eax
push 0x100101d4
push 0
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
jne 0x10002978
jmp 0x10002ac4
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop ebp
pop esi
mov eax, 0x20000012
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100045aa
add esp, 0x3c
ret 4
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [esp + 0x20]
push ebx
mov dword [edx + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10004106
add esp, 4
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x48]
sub eax, 0xffffffff
pop edi
neg eax
pop ebp
sbb eax, eax
pop esi
and eax, 0xdfffff00
pop ebx
xor ecx, esp
add eax, 0x20000101
call fcn.100045aa
add esp, 0x3c
ret 4