Function at 0x518c80
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x484
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x47c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 2
xor eax, eax
push ebx
push ebx
mov edi, ecx
push 0x586ab0
mov dword [esp + 0x24], edi
mov byte [esp + 0x23], bl
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x518efd
lea eax, [esp + 0x5c]
push eax
push ebx
push esi
mov dword [esp + 0x68], 0x1c
mov dword [esp + 0x28], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x518eda
push 0x206
lea ecx, [esp + 0x7e]
push ebx
push ecx
mov word [esp + 0x84], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push 0x206
lea edx, [esp + 0x80]
push edx
push ebx
push 1
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x518eba
push 3
lea ecx, [esp + 0x7c]
push 0x5a6d54
push ecx
call dword [sym.imp.MSVCR80.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x518eba
mov edx, dword [esp + 0x70]
push ebx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
jne 0x518eba
test dword [esp + 0x24], 0x400
jne 0x518eba
push 0x20019
push 2
push ebx
push 1
lea edx, [esp + 0x6c]
push edx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x518eba
push 0x206
lea eax, [esp + 0x286]
push ebx
push eax
mov word [esp + 0x28c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x284]
push edx
push ebx
push ebx
push str.NetCfgInstanceId
push ebp
mov dword [esp + 0x38], 0x102
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x518eb3
mov ecx, dword [0x586ad4]
mov edx, dword [0x586ad8]
mov eax, dword [0x586ad0]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x54], edx
mov dword [esp + 0x4c], eax
mov eax, dword [0x586adc]
push ecx
lea edx, [esp + 0x284]
push edx
mov dword [esp + 0x60], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [esp + 0x4c]
mov ecx, 0x586ad0
call fcn.00498ad0
test eax, eax
jne 0x518eb3
lea esi, [esp + 0x3c]
call fcn.004f8b40
lea esi, [esp + 0x34]
mov ebx, eax
call fcn.004f8b20
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x3c]
push eax
lea ebx, [esp + 0x60]
call fcn.004f9020
mov edi, dword [esp + 0x28]
add esp, 0x14
lea esi, [esp + 0x44]
call fcn.004f8b40
mov esi, eax
lea edi, [esp + 0x2c]
call fcn.005506a0
test al, al
je 0x518ea9
mov esi, dword [esp + 0x14]
call fcn.0050d5f0
mov edi, esi
jmp 0x518ead
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
xor ebx, ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x5c]
add eax, 1
push ecx
push eax
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x518d07
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x518ef0
mov edx, dword [edi + 8]
sub edx, eax
sar edx, 4
je 0x518ef0
mov byte [esp + 0x13], 1
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov al, byte [esp + 0x13]
jmp 0x518eff
mov al, bl
mov ecx, dword [esp + 0x48c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00569ed6
add esp, 0x484
ret