Function at 0x414130
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x206
lea ecx, [ebp - 0x616]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x620], ebx
mov dword [ebp - 0x61c], ebx
mov word [ebp - 0x618], ax
call fcn.00427b00
push 0x206
lea eax, [ebp - 0x40e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x410], dx
call fcn.00427b00
push 0xfe
lea edx, [ebp - 0x102]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x104], cx
call fcn.00427b00
push 0x103
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call fcn.00427b00
add esp, 0x30
lea ecx, [ebp - 0x620]
push ecx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x62c], 0x104
mov dword [ebp - 0x624], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x414206
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4143d1
mov ecx, dword [ebp - 0x620]
push edi
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x410]
push eax
push ebx
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4143d0
lea edx, [ebp - 0x410]
push edx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push 0x4c8938
lea edx, [ebp - 0x618]
call fcn.00414e80
push 0x208
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00427b00
mov eax, dword [ebp - 0x61c]
add esp, 0x18
cmp eax, ebx
je 0x414279
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x61c], ebx
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x618]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41434e
push 0x100
lea eax, [ebp - 0x104]
push ebx
push eax
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x630], 0x80
call fcn.00427b00
add esp, 0xc
lea ecx, [ebp - 0x630]
push ecx
mov ecx, dword [ebp - 0x61c]
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x628]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41434e
push 0x104
lea edx, [ebp - 0x208]
push ebx
push edx
call fcn.00427b00
lea eax, [ebp - 0x104]
add esp, 0xc
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x414310
push ebx
push ebx
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x208]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x104]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x208]
push esi
push edx
call fcn.004391f0
add esp, 8
test eax, eax
je 0x414383
mov edx, dword [ebp - 0x620]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x410]
push ecx
inc edi
push edi
push edx
mov dword [ebp - 0x62c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x414231
jmp 0x4143d0
lea eax, [ebp - 0x630]
push eax
mov eax, dword [ebp - 0x61c]
lea ecx, [ebp - 0x624]
push ecx
lea edx, [ebp - 0x628]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x624], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4143d0
mov ecx, dword [ebp - 0x624]
and ecx, 0x84
cmp cl, 0x84
jne 0x4143d0
mov dword [ebp - 0x634], 1
pop edi
mov eax, dword [ebp - 0x61c]
cmp eax, ebx
je 0x4143e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x61c], ebx
mov eax, dword [ebp - 0x620]
cmp eax, ebx
pop ebx
je 0x4143fa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x634]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret