Function at 0x10002ae0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x5c], eax
xor esi, esi
cmp byte [ebp + 0xc], 1
lea eax, [ebp - 0x48]
push eax
push 0x20019
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
push esi
jne 0x10002b42
push str.SOFTWARECanonScanGear
jmp 0x10002b47
push str.SOFTWARECanonScanGearDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10002b6c
mov eax, 0x21007f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100044a4
mov esp, ebp
pop ebp
ret
xor edi, edi
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10002bdc
push dword [ebp - 0x64]
lea eax, [ebp - 0x40]
push eax
call fcn.10004b3e
add esp, 8
test eax, eax
je 0x10002c1b
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.10008fa0
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
lea eax, [ebp - 0x6c]
inc edi
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10002b91
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
test eax, eax
je 0x10002bf3
push eax
call ebx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x44], 0
test ecx, ecx
je 0x10002bfa
push ecx
call ebx
neg esi
sbb esi, esi
and esi, 0xffdcff81
lea eax, [esi + 0x23007f]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100044a4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10002c6e
mov eax, dword [ebp - 0x44]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10002c4e
push eax
call esi
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10002c58
push eax
call esi
mov eax, 0x24007f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100044a4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x58]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
push str.DriverVersion
push dword [ebp - 0x44]
call esi
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x60]
lea eax, [ebp - 0x4c]
push eax
push 0
push str.DriverVersion
push dword [ebp - 0x44]
call esi
test eax, eax
jne 0x10002c37
lea eax, [ebp - 0x54]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
push str.DriverDate
push dword [ebp - 0x44]
call esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
push eax
push 0
push str.DriverDate
push dword [ebp - 0x44]
call esi
test eax, eax
mov eax, dword [ebp - 0x44]
je 0x10002d0d
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10002ced
push eax
call esi
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10002cf7
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, 0x23007f
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100044a4
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x10002d19
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x10002d2b
push ecx
call ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, 1
jmp 0x10002be2