Function at 0x413500
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce8
mov eax, dword [0x5d7b20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce8], ecx
mov dword [ebp - 0xcd4], ebx
mov dword [ebp - 0xcd0], ebx
mov dword [ebp - 0xcdc], ebx
mov dword [ebp - 0xcd8], ebx
mov dword [ebp - 0xce0], ebx
cmp eax, ebx
jne 0x41355b
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e1ad
mov esp, ebp
pop ebp
ret
cmp word [eax], bx
je 0x41354a
push 0x802
lea edx, [ebp - 0xc48]
push ebx
push edx
call fcn.0053e550
push 0x200
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.0053e550
push 0x40
lea ecx, [ebp - 0x44]
push ebx
push ecx
call fcn.0053e550
push str.ENUM
lea edx, [ebp - 0x44]
push 0x20
push edx
call fcn.0053eeab
push 0x56825c
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.0053e396
push str.SCSI
lea ecx, [ebp - 0x44]
push 0x20
push ecx
call fcn.0053e396
add esp, 0x48
lea edx, [ebp - 0xcd4]
push edx
lea eax, [ebp - 0x44]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41354a
mov edx, dword [ebp - 0xcd4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x100
lea ecx, [ebp - 0x244]
push ecx
push ebx
push edx
call edi
test eax, eax
jne 0x41374f
push esi
jmp 0x413610
inc dword [ebp - 0xcd8]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xc48]
push 0x401
push ecx
xor esi, esi
call fcn.0053eeab
push 0x56825c
lea edx, [ebp - 0xc48]
push 0x401
push edx
call fcn.0053e396
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0xc48]
push 0x401
push ecx
call fcn.0053e396
mov ecx, dword [ebp - 0xcd4]
add esp, 0x24
lea edx, [ebp - 0xcd0]
push edx
lea eax, [ebp - 0x244]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41370b
mov eax, dword [ebp - 0xcd0]
push 0x100
lea edx, [ebp - 0x444]
push edx
push ebx
push eax
call edi
test eax, eax
jne 0x4136f4
jmp 0x4136a0
mov ecx, dword [ebp - 0xce4]
push ecx
lea edx, [ebp - 0x444]
push edx
inc esi
call fcn.0053ea56
add esp, 8
test eax, eax
je 0x4136da
mov edx, dword [ebp - 0xcd0]
lea eax, [ebp - 0xcdc]
push eax
lea ecx, [ebp - 0x444]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x413731
mov ecx, dword [ebp - 0xcd0]
push 0x100
lea eax, [ebp - 0x444]
push eax
push esi
push ecx
call edi
test eax, eax
je 0x4136a0
mov eax, dword [ebp - 0xcd0]
cmp eax, ebx
je 0x41370b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xcd0], ebx
mov eax, dword [ebp - 0xcd8]
mov ecx, dword [ebp - 0xcd4]
push 0x100
lea edx, [ebp - 0x244]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413610
jmp 0x41374e
mov edx, dword [ebp - 0xcdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xcdc], ebx
mov dword [ebp - 0xce0], 1
pop esi
mov eax, dword [ebp - 0xcd0]
pop edi
cmp eax, ebx
je 0x413767
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xcd0], ebx
mov eax, dword [ebp - 0xcd4]
cmp eax, ebx
je 0x41377e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xcd4], ebx
cmp dword [ebp - 0xce0], ebx
je 0x41354a
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xc48]
push 0x401
push ecx
call fcn.0053eeab
push 0x56825c
lea edx, [ebp - 0xc48]
push 0x401
push edx
call fcn.0053e396
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0xc48]
push 0x401
push ecx
call fcn.0053e396
push 0x56825c
lea edx, [ebp - 0xc48]
push 0x401
push edx
call fcn.0053e396
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0xc48]
push 0x401
push ecx
call fcn.0053e396
lea edx, [ebp - 0xc48]
push edx
push str.Remove_instance_id_key___s
call fcn.00415550
add esp, 0x44
push 3
lea ecx, [ebp - 0xc48]
lea eax, [ebp - 0xcc8]
push ecx
lea ecx, [ebp - 0xccc]
mov dword [ebp - 0xccc], eax
call fcn.0040b3a0
mov edx, dword [ebp - 0xccc]
push ebx
push ebx
push ebx
push edx
push 0x10001
call dword [ebp - 0xce8]
mov eax, dword [ebp - 0xccc]
lea ecx, [ebp - 0xcc8]
cmp eax, ecx
je 0x41385d
push eax
call fcn.0053f854
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0053e1ad
mov esp, ebp
pop ebp
ret