Function at 0x1000f6f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [str.LPT1]
mov cl, byte [0x10024020]
mov edx, dword [str.LPT2]
mov dword [0x1002fda0], eax
mov al, byte [0x10024028]
mov byte [0x1002fda4], cl
mov ecx, dword [str.LPT3]
mov byte [0x1002fea9], al
mov eax, dword [str.DOS_LPT1]
mov dword [0x1002fea5], edx
mov dl, byte [0x10024030]
mov dword [0x10032920], eax
mov eax, dword [str.DOS_LPT2]
mov dword [0x1002ffaa], ecx
mov ecx, dword [0x10024038]
mov byte [0x1002ffae], dl
mov dl, byte [0x1002403c]
mov dword [0x10032a25], eax
mov eax, dword [str.DOS_LPT3]
mov dword [0x10032924], ecx
mov ecx, dword [0x10024044]
mov byte [0x10032928], dl
mov dl, byte [0x10024048]
mov dword [0x10032b2a], eax
lea eax, [ebp - 0x20]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x10032a29], ecx
mov ecx, dword [0x10024050]
mov byte [0x10032a2d], dl
mov dl, byte [0x10024054]
push eax
push str.SystemCurrentControlSetControlDeviceClasses
push connect
mov dword [0x10031220], 3
mov dword [0x10032b2e], ecx
mov byte [0x10032b32], dl
call esi
test eax, eax
jne 0x1000fba9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
push 0x105
push 0x100312a0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000fb9d
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
push edx
push 0x100312a0
push eax
call esi
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
push 0x105
push 0x100314e0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000fb83
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
push 0x100314e0
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x10031600
push eax
push 0
mov edi, 1
push str.DeviceInstance
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x105
call ebx
mov al, byte [0x10031600]
cmp al, 0x55
jne 0x1000f883
cmp byte [0x10031601], 0x53
jne 0x1000fb69
cmp byte [0x10031602], 0x42
je 0x1000f8e3
jmp 0x1000fb69
cmp al, 0x53
jne 0x1000f8a2
cmp byte [0x10031601], 0x42
jne 0x1000fb69
cmp byte [0x10031602], 0x50
je 0x1000f8e3
jmp 0x1000fb69
cmp al, 0x45
jne 0x1000f8c1
cmp byte [0x10031601], 0x50
jne 0x1000fb69
cmp byte [0x10031602], 0x53
je 0x1000f8e3
jmp 0x1000fb69
cmp al, 0x31
jne 0x1000fb69
cmp byte [0x10031601], 0x33
jne 0x1000fb69
cmp byte [0x10031602], 0x39
jne 0x1000fb69
mov edx, dword [ebp - 0xc]
push 0x105
push 0x100313c0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000fb69
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push 0x100313c0
push ecx
call esi
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x100348c0
push eax
push 0
push str.SymbolicLink
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x105
call ebx
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
push edx
push str.Control
push eax
call esi
test eax, eax
jne 0x1000fb5f
mov eax, 4
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 8]
push edx
push eax
push 0
push str.Linked
push ecx
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000fb55
mov eax, dword [0x10031220]
cmp eax, 0x14
jge 0x1000fb55
mov edx, eax
mov ecx, 0x41
shl edx, 6
add edx, eax
mov esi, 0x100348c0
mov byte [0x100348c2], 0x2e
push 0x10031600
lea eax, [eax + edx*4]
lea edi, [eax + 0x1002fda0]
rep movsd dword es:[edi], dword [esi]
cmp dword [0x10023c38], 3
movsb byte es:[edi], byte [esi]
jne 0x1000f9c8
lea eax, [eax + 0x10032920]
push str.SystemCurrentControlSetEnum_s
push eax
jmp 0x1000f9d4
lea ecx, [eax + 0x10032920]
push str.Enum_s
push ecx
call fcn.1000fd5e
mov eax, dword [0x10031220]
add esp, 0xc
mov ecx, eax
lea edx, [ebp - 0x10]
shl ecx, 6
add ecx, eax
push edx
lea edx, [eax + ecx*4 + 0x10032920]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000fb13
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push 0x100348c0
push ecx
push 0
mov edi, 1
mov esi, 0x105
push str.DeviceDesc
push edx
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x1000fad6
mov eax, dword [0x10031220]
push 0x100348c0
mov edx, eax
shl edx, 6
add edx, eax
lea ecx, [eax - 3]
push ecx
push str._d:_s
lea eax, [eax + edx*4 + 0x10032920]
push eax
call fcn.1000fd5e
mov eax, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ebp - 4]
lea edx, [ebp - 8]
push ecx
push 0x10034780
push edx
push 0
push str.LocationInformation
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x1000fab6
mov eax, dword [0x10031220]
push 0x10034780
mov edx, eax
push 0x100348c0
shl edx, 6
add edx, eax
lea ecx, [eax - 3]
push ecx
push str._d:_s:_s
lea eax, [eax + edx*4 + 0x10032920]
push eax
call fcn.1000fd5e
add esp, 0x14
mov eax, dword [0x10031220]
mov ecx, eax
shl ecx, 6
add ecx, eax
mov byte [eax + ecx*4 + 0x1003293e], 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000fb44
mov eax, dword [0x10031220]
mov byte [0x10031614], 0
mov ecx, eax
shl ecx, 6
lea edx, [eax - 3]
add ecx, eax
push edx
push 0x10031600
lea edx, [eax + ecx*4 + 0x10032920]
push 0x10024118
push edx
call fcn.1000fd5e
mov eax, dword [ebp - 0x10]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000fb44
mov eax, dword [0x10031220]
mov byte [0x10031614], 0
mov edx, eax
shl edx, 6
lea ecx, [eax - 3]
add edx, eax
push ecx
push 0x10031600
lea eax, [eax + edx*4 + 0x10032920]
push str._s__d
push eax
call fcn.1000fd5e
add esp, 0x10
mov eax, dword [0x10031220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
inc eax
mov dword [0x10031220], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x18], eax
jl 0x1000f807
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x28], eax
jl 0x1000f7d4
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret