Function at 0x10025350
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x86c], ecx
mov dword [ebp - 0x434], 0
xor eax, eax
mov word [ebp - 0x228], ax
push 0x1fc
push 0
lea ecx, [ebp - 0x226]
push ecx
call fcn.10092830
add esp, 0xc
mov dword [ebp - 0x864], 0xff
mov dword [ebp - 0x444], 0xff
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x654], 0xf003f
mov dword [ebp - 0x438], str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
call fcn.10024ec0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x868], 0
jmp 0x100253ee
mov edx, dword [ebp - 0x868]
add edx, 1
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + eax + 2]
cmp dword [ebp - 0x868], ecx
jge 0x10025669
cmp dword [ebp - 0x868], 1
jle 0x1002541c
mov edx, dword [ebp - 0x654]
or edx, 0x100
mov dword [ebp - 0x654], edx
lea eax, [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x654]
push ecx
push 0
mov edx, dword [ebp - 0x438]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10025444
jmp 0x100253df
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x864], 0xff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x434]
push edx
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x10025657
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x864], 0xff
lea edx, [ebp - 0x228]
push edx
push 0x10104e54
lea eax, [ebp - 0x650]
push eax
call fcn.10024f80
add esp, 0xc
push 0x1fe
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.10092830
add esp, 0xc
lea edx, [ebp - 0x650]
mov dword [ebp - 0x870], edx
mov eax, dword [ebp - 0x870]
add eax, 2
mov dword [ebp - 0x874], eax
mov ecx, dword [ebp - 0x870]
mov dx, word [ecx]
mov word [ebp - 0x876], dx
add dword [ebp - 0x870], 2
cmp word [ebp - 0x876], 0
jne 0x100254f2
mov eax, dword [ebp - 0x870]
sub eax, dword [ebp - 0x874]
sar eax, 1
mov dword [ebp - 0x87c], eax
jne 0x1002552e
jmp 0x10025458
lea ecx, [ebp - 0x650]
push ecx
mov edx, dword [ebp - 0x438]
push edx
push str._s_s
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0x654]
push edx
push 0
lea eax, [ebp - 0x430]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10025652
mov dword [ebp - 0x444], 4
mov dword [ebp - 0x43c], 0
lea ecx, [ebp - 0x444]
push ecx
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x28]
push eax
push 0
push str.Characteristics
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x43c]
and edx, 4
jne 0x100255c5
jmp 0x10025458
mov dword [ebp - 0x444], 0x208
push 0x208
push 0
lea eax, [ebp - 0x860]
push eax
call fcn.10092830
add esp, 0xc
lea ecx, [ebp - 0x444]
push ecx
lea edx, [ebp - 0x860]
push edx
lea eax, [ebp - 0x28]
push eax
push 0
push str.DriverDesc
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx edx, word [ebp - 0x860]
test edx, edx
je 0x10025652
push 0
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.10024dc0
add esp, 0xc
mov dword [ebp - 0x880], eax
push 1
mov ecx, dword [ebp - 0x880]
call fcn.10002210
push eax
mov ecx, dword [ebp - 0x86c]
call fcn.100250f0
lea ecx, [ebp - 0x20]
call fcn.100018b0
jmp 0x10025458
mov edx, dword [ebp - 0x440]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100253df
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret