Function at 0x406160
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x425644
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.0041969c
lea esi, [ebp + 4]
lea eax, [esp + 0xc]
push esi
mov edi, 0x100
push str.Enum_
push eax
mov dword [esp + 0x148], 0
mov dword [esp + 0x24], edi
call fcn.00419ab2
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x140], 1
call fcn.004198e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x13c], 0
call fcn.004197e7
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40666b
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.004196ac
mov ecx, ebp
call fcn.00407630
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x2c], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.Class
push ecx
call edi
test eax, eax
jne 0x40626e
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
call fcn.00419855
lea ebx, [ebp + 0x14]
push eax
mov ecx, ebx
mov byte [esp + 0x144], 2
call fcn.004198e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x140], 0
call fcn.004197e7
jmp 0x406278
lea ebx, [ebp + 0x14]
mov ecx, ebx
call fcn.00419772
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
push edx
push eax
push str.DeviceDesc
push ecx
mov dword [esp + 0x34], 0x100
call edi
test eax, eax
jne 0x406337
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
call fcn.00419855
lea esi, [ebp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x144], 3
call fcn.004198e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x140], 0
call fcn.004197e7
push str._Multi_function_Parent_Device_
mov ecx, esi
call fcn.00417af0
cmp eax, 0xffffffff
je 0x40633f
mov edi, str._Multi_function_Parent_Device_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
not ecx
mov edx, dword [eax - 8]
dec ecx
sub edx, ecx
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.00417a58
push eax
mov ecx, esi
mov byte [esp + 0x144], 4
call fcn.004198e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x140], 0
call fcn.004197e7
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x40633f
lea ecx, [ebp + 0x10]
call fcn.00419772
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
push ecx
push 0x42e638
push edx
mov dword [esp + 0x34], 0x100
call edi
test eax, eax
jne 0x40639d
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
call fcn.00419855
push eax
lea ecx, [ebp + 0xc]
mov byte [esp + 0x144], 5
call fcn.004198e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x140], 0
call fcn.004197e7
jmp 0x4063a5
lea ecx, [ebp + 0xc]
call fcn.00419772
mov edi, dword [ebx]
mov esi, 0x42e6a0
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4063d6
test cl, cl
je 0x4063d2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4063d6
add eax, 2
add esi, 2
test cl, cl
jne 0x4063ae
xor eax, eax
jmp 0x4063db
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
test cl, cl
je 0x406400
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
or ecx, 1
push edx
mov dword [ebp + 8], ecx
mov ecx, ebp
call fcn.004077f0
jmp 0x406627
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x4065d3
mov eax, dword [esp + 0x18]
mov ecx, ebp
push eax
call fcn.00407fe0
lea ecx, [esp + 0x10]
call fcn.0041969c
lea ecx, [esp + 0x14]
mov byte [esp + 0x140], 6
call fcn.0041969c
lea eax, [ebp + 4]
lea ecx, [esp + 0x14]
push eax
mov byte [esp + 0x144], 7
call fcn.004198e0
push 0x5c
lea ecx, [esp + 0x18]
call fcn.00419c5b
cmp eax, 0xffffffff
je 0x40647d
push 0x26
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.00419c5b
push eax
lea ecx, [esp + 0x1c]
call fcn.00419c8e
push 0x5c
lea ecx, [esp + 0x18]
call fcn.00419c5b
cmp eax, 0xffffffff
jne 0x406456
push str.EnumMFCHILD0000_
lea ecx, [esp + 0x28]
call fcn.00419855
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
mov bl, 8
push eax
push edx
mov byte [esp + 0x14c], bl
call fcn.004199d8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 9
call fcn.004198e0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x140], bl
call fcn.004197e7
lea ecx, [esp + 0x24]
mov byte [esp + 0x140], 7
call fcn.004197e7
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x406519
mov ebx, dword [ebp + 8]
mov edx, dword [esp + 0x20]
or ebx, 2
push edx
mov ecx, ebp
mov dword [ebp + 8], ebx
call fcn.00407df0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.EnumMFCHILD0001_
lea ecx, [esp + 0x30]
call fcn.00419855
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
mov bl, 0xa
push eax
push edx
mov byte [esp + 0x14c], bl
call fcn.004199d8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 0xb
call fcn.004198e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x140], bl
call fcn.004197e7
lea ecx, [esp + 0x2c]
mov byte [esp + 0x140], 7
call fcn.004197e7
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x4065af
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x20]
or edi, 1
push edx
mov ecx, ebp
mov dword [ebp + 8], edi
call fcn.004077f0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x140], 6
call fcn.004197e7
lea ecx, [esp + 0x10]
mov byte [esp + 0x140], 0
call fcn.004197e7
jmp 0x406627
mov esi, str.Modem
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x406602
test cl, cl
je 0x4065fe
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x406602
add eax, 2
add esi, 2
test cl, cl
jne 0x4065da
xor eax, eax
jmp 0x406607
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
test cl, cl
je 0x406627
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
or ecx, 2
push edx
mov dword [ebp + 8], ecx
mov ecx, ebp
call fcn.00407df0
lea eax, [ebp + 4]
lea ecx, [ebp + 0x1c]
push eax
call fcn.004198e0
mov ecx, ebp
call fcn.00407450
mov ecx, dword [esp + 0x148]
mov dword [ebp + 0x24], eax
test ecx, ecx
je 0x40665f
test eax, eax
je 0x406655
mov ecx, ebp
call fcn.00408180
jmp 0x40665f
mov dword [ebp + 0x4e0], 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x13c], 0xffffffff
call fcn.004197e7
mov ecx, dword [esp + 0x134]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x134
ret 4