Function at 0x423fa0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x458d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov eax, dword [esp + 0x254]
lea ecx, [esp + 0x40]
push eax
xor esi, esi
push str.TestForEnumDeviceInRegistry__ENTRY__csRegEnumPath___s_n
push ecx
mov dword [esp + 0x258], esi
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea edx, [esp + 0x40]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov eax, dword [0x471df4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x250], 3
call fcn.0044a149
mov ecx, dword [esp + 0x254]
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push ecx
push 0x80000002
mov byte [esp + 0x260], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424213
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x140]
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x424208
lea ecx, [esp + 0x140]
xor edi, edi
push ecx
lea ecx, [esp + 0x34]
call fcn.0044a442
mov esi, eax
push 0x46a404
lea ecx, [esp + 0x28]
mov byte [esp + 0x250], 5
call fcn.0044a442
push eax
lea edx, [esp + 0x258]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x258], 6
call fcn.0044a5b7
push esi
lea ecx, [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x258], 7
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x250], 8
call fcn.0044a4c1
lea ecx, [esp + 0x38]
mov byte [esp + 0x24c], 7
call fcn.0044a3d4
lea ecx, [esp + 0x34]
mov byte [esp + 0x24c], 6
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x24c], 5
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x24c], 4
call fcn.0044a3d4
lea ecx, [esp + 0x10]
call fcn.0044a88a
push str.USB
lea ecx, [esp + 0x258]
mov esi, 1
call fcn.00449464
cmp eax, 0xffffffff
je 0x42417f
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0044a149
mov ecx, ebx
call fcn.00423cd0
mov esi, eax
xor eax, eax
test esi, esi
setne al
test esi, esi
je 0x4241d8
test eax, eax
je 0x42417f
mov ebp, 1
jmp 0x42419d
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0044a149
mov ecx, ebx
call fcn.00423350
mov ebp, eax
test ebp, ebp
je 0x4241b7
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0044a149
mov ecx, ebx
call fcn.00423be0
mov edi, eax
test esi, esi
je 0x4241d8
test ebp, ebp
je 0x4241d8
test edi, edi
je 0x4241d8
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x14]
push eax
mov dword [esp + 0x20], 1
call fcn.00449c44
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, ecx
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x140]
push 0x104
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x42407b
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [esp + 0x44]
push str.TestForEnumDeviceInRegistry__EXIT__bRetVal___d_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0x40]
mov ecx, 0x475b68
push edx
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x24c], 3
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x24c], 2
call fcn.0044a3d4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24c], 1
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x24c], 0
call fcn.0044a3d4
lea ecx, [esp + 0x254]
mov dword [esp + 0x24c], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x244]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x240
ret 4