Function at 0x10005d49
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x100140d4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x444], 0xffffffff
and dword [ebp - 0x440], 0
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 0xc]
push 4
mov dword [ebp - 0x43c], 0x10001840
pop edi
test eax, eax
je 0x10005ffa
lea esi, [eax + 0x100]
cmp byte [esi], 0
je 0x10005ec0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005d9d
sub eax, edx
cmp eax, 0x26
jne 0x10005ec0
mov eax, esi
cmp byte [eax], 0x7b
jne 0x10005db7
inc eax
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x450]
push ecx
lea ecx, [ebp - 0x468]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x44c]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x448]
push ecx
push 0x10001760
push eax
call fcn.1000e0ef
add esp, 0x34
cmp eax, 0xb
jne 0x10005ec0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x30], eax
mov ax, word [ebp - 0x454]
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x470]
mov word [ebp - 0x2a], ax
mov al, byte [ebp - 0x464]
mov byte [ebp - 0x28], al
mov al, byte [ebp - 0x44c]
mov byte [ebp - 0x27], al
mov al, byte [ebp - 0x46c]
mov byte [ebp - 0x26], al
mov al, byte [ebp - 0x45c]
mov byte [ebp - 0x25], al
mov al, byte [ebp - 0x460]
mov byte [ebp - 0x24], al
mov al, byte [ebp - 0x468]
mov byte [ebp - 0x23], al
mov al, byte [ebp - 0x450]
mov byte [ebp - 0x22], al
mov al, byte [ebp - 0x458]
and dword [ebp - 0x43c], 0
mov byte [ebp - 0x21], al
lea eax, [ebx + 0x10]
mov edi, eax
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x40]
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 0xc]
push 0x10
add eax, 0x100
mov dword [ebx + 0x38], 1
pop edi
add esi, 0x110
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x10005eb6
cmp dword [ebx + 0x38], 0
jne 0x10005ffa
mov eax, dword [ebx + 0xc]
lea esi, [eax + 0x200]
cmp byte [esi], 0
je 0x10005ffa
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005ee1
sub eax, edx
cmp eax, 0x26
jne 0x10005ffa
cmp byte [esi], 0x7b
jne 0x10005ef9
inc esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x10001760
push esi
call fcn.1000e0ef
add esp, 0x34
cmp eax, 0xb
jne 0x10005ffa
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x30], eax
mov ax, word [ebp - 0x450]
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x468]
mov word [ebp - 0x2a], ax
mov al, byte [ebp - 0x460]
mov byte [ebp - 0x28], al
mov al, byte [ebp - 0x45c]
mov byte [ebp - 0x27], al
mov al, byte [ebp - 0x46c]
mov byte [ebp - 0x26], al
mov al, byte [ebp - 0x44c]
mov byte [ebp - 0x25], al
mov al, byte [ebp - 0x464]
mov byte [ebp - 0x24], al
mov al, byte [ebp - 0x470]
mov byte [ebp - 0x23], al
mov al, byte [ebp - 0x454]
mov byte [ebp - 0x22], al
mov al, byte [ebp - 0x448]
mov byte [ebp - 0x21], al
lea eax, [ebx + 0x20]
mov edi, eax
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x40]
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 0xc]
xor edi, edi
add eax, 0x200
mov dword [ebx + 0x3c], 1
add esi, 0x310
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x10005ff0
mov eax, dword [ebx + 0x80]
or eax, edi
push eax
push 0
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebx + 0x44], eax
test eax, eax
je 0x10006023
cmp eax, 0xffffffff
jne 0x1000602b
xor eax, eax
inc eax
jmp 0x10006718
push 0x1c
lea edi, [ebx + 0x48]
pop eax
lea esi, [ebx + 0x64]
mov dword [ebp - 0x440], edi
mov dword [edi], eax
mov dword [ebp - 0x458], esi
mov dword [esi], eax
jmp 0x10006052
mov esi, dword [ebp - 0x458]
mov edi, dword [ebp - 0x440]
inc dword [ebp - 0x444]
cmp dword [ebx + 0x38], 0
je 0x10006147
push esi
push dword [ebp - 0x444]
lea eax, [ebx + 0x10]
push eax
push 0
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x10006707
mov eax, dword [ebx + 0x40]
push edi
lea edx, [ebp - 0x438]
push edx
mov ecx, 0x103
push ecx
add eax, 0x80c
push eax
mov dword [eax], 5
push esi
push dword [ebx + 0x44]
mov dword [ebp - 0x438], ecx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
je 0x100066fa
mov edi, dword [ebx + 0x40]
xor eax, eax
add edi, 0x80b
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebx + 0x40]
lea esi, [edi + 0x810]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100060d6
sub eax, ecx
push eax
push esi
add edi, 0x710
push edi
mov dword [ebp - 0x438], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 0x438]
mov byte [eax + ecx + 0x810], 0
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 0x438]
mov byte [eax + ecx + 0x710], 0
mov eax, dword [ebx + 0x78]
add esp, 0xc
test al, 4
jne 0x100066fa
mov ecx, dword [ebx + 0x40]
and eax, 1
mov dword [ecx + 0x914], eax
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x914], 0
jne 0x10006165
test byte [ebx + 8], 2
je 0x100066fa
jmp 0x10006165
push edi
push dword [ebp - 0x444]
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x10006707
cmp dword [ebx + 0x3c], 0
jne 0x100062c6
movzx ecx, byte [ebx + 0x5b]
push ecx
movzx ecx, byte [ebx + 0x5a]
push ecx
movzx ecx, byte [ebx + 0x59]
push ecx
movzx ecx, byte [ebx + 0x58]
push ecx
movzx ecx, byte [ebx + 0x57]
push ecx
movzx ecx, byte [ebx + 0x56]
push ecx
movzx ecx, byte [ebx + 0x55]
mov eax, dword [ebx + 0x40]
push ecx
movzx ecx, byte [ebx + 0x54]
push ecx
movzx ecx, word [ebx + 0x52]
push ecx
movzx ecx, word [ebx + 0x50]
push ecx
push dword [ebx + 0x4c]
add eax, 0x310
push 0x10001794
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x34
cmp eax, 0x26
jne 0x100066fa
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x100062c6
add edx, 0x200
cmp byte [edx], 0
mov dword [ebp - 0x43c], edx
je 0x100062c6
mov edi, dword [ebx + 0x40]
add edi, 0x310
push 0
pop esi
push esi
pop ecx
je 0x100062b7
test edx, edx
je 0x100062b7
cmp byte [edx], 0
je 0x100062b0
mov al, byte [esi + edx]
mov byte [ebp - 0x432], al
cmp al, 0x2a
je 0x1000626e
cmp al, 0x3f
je 0x10006260
mov dl, byte [ecx + edi]
test dl, dl
je 0x100066fa
cmp dl, al
je 0x10006256
mov byte [ebp - 0x431], dl
sub dl, 0x61
cmp dl, 0x19
ja 0x1000623e
add byte [ebp - 0x431], 0xe0
mov dl, al
sub dl, 0x61
cmp dl, 0x19
ja 0x1000624a
add al, 0xe0
cmp al, byte [ebp - 0x431]
jne 0x100066fa
mov edx, dword [ebp - 0x43c]
inc ecx
inc esi
jmp 0x100062a6
cmp byte [ecx + edi], 0
je 0x100066fa
inc ecx
inc esi
jmp 0x100062a6
cmp byte [esi + edx + 1], 0x3f
jne 0x100062c6
cmp byte [esi + edx + 2], 0
je 0x100062c6
mov al, byte [ecx + edi]
inc esi
inc esi
test al, al
je 0x1000629a
mov dl, byte [esi + edx]
cmp al, dl
je 0x10006294
inc ecx
mov al, byte [ecx + edi]
test al, al
jne 0x10006288
mov edx, dword [ebp - 0x43c]
cmp byte [ecx + edi], 0
je 0x100066fa
inc esi
inc ecx
cmp byte [esi + edx], 0
jne 0x10006209
xor eax, eax
cmp byte [esi + edx], al
jmp 0x100062bb
xor eax, eax
cmp edi, edx
sete al
test eax, eax
je 0x100066fa
mov eax, dword [ebx + 0x40]
push 0
push pe_nt_image_headers32
mov esi, 0x210
add eax, esi
push eax
push dword [ebp - 0x440]
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
je 0x100066fa
mov eax, dword [ebx + 0x40]
push 8
add eax, esi
push 0x10001834
push eax
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x100066fa
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x100063ed
cmp byte [ecx], al
je 0x100063ed
mov edi, dword [ebx + 0x40]
push eax
add edi, esi
pop esi
je 0x100063de
cmp byte [ecx], al
je 0x100063d7
mov dl, byte [esi + ecx]
mov byte [ebp - 0x432], dl
cmp dl, 0x2a
je 0x10006395
cmp dl, 0x3f
je 0x10006389
mov cl, byte [eax + edi]
test cl, cl
je 0x100066fa
cmp cl, dl
je 0x10006385
mov byte [ebp - 0x431], cl
sub cl, 0x61
cmp cl, 0x19
ja 0x1000636c
add byte [ebp - 0x431], 0xe0
mov cl, dl
sub cl, 0x61
cmp cl, 0x19
ja 0x10006379
add dl, 0xe0
cmp dl, byte [ebp - 0x431]
jne 0x100066fa
inc eax
inc esi
jmp 0x100063ca
cmp byte [eax + edi], 0
je 0x100066fa
jmp 0x10006385
cmp byte [esi + ecx + 1], 0x3f
jne 0x100063ed
cmp byte [esi + ecx + 2], 0
je 0x100063ed
inc esi
inc esi
cmp byte [eax + edi], 0
je 0x100066fa
mov cl, byte [esi + ecx]
cmp byte [eax + edi], cl
je 0x100063be
inc eax
cmp byte [eax + edi], 0
jne 0x100063b2
cmp byte [eax + edi], 0
je 0x100066fa
inc esi
inc eax
mov ecx, dword [ebx + 0xc]
cmp byte [esi + ecx], 0
jne 0x10006335
xor eax, eax
cmp byte [esi + ecx], al
jmp 0x100063e2
xor eax, eax
cmp edi, ecx
sete al
test eax, eax
je 0x100066fa
mov eax, dword [ebx + 0x40]
push 0
push 0xff
add eax, 0x610
push eax
push 0
push 4
push dword [ebp - 0x440]
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x100066fa
mov eax, dword [ebx + 0x40]
or dword [eax + 0x10c], 0xffffffff
mov edi, 0x10001720
jmp 0x10006462
cmp dword [edi], 0xffffffff
je 0x1000646e
mov esi, dword [edi + 4]
jmp 0x1000644c
push eax
mov eax, dword [ebx + 0x40]
add eax, 0x610
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x10006454
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x10006433
jmp 0x1000645f
mov eax, dword [ebx + 0x40]
mov ecx, dword [edi]
mov dword [eax + 0x10c], ecx
add edi, 8
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x10c], 0xffffffff
je 0x10006429
cmp dword [ebx + 0x38], 0
jne 0x100064af
mov eax, dword [ebx + 0x40]
cmp dword [eax + 0x10c], 0xffffffff
jne 0x100064c1
lea edi, [ebx + 0x10]
mov esi, 0x100016f0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x10014008]
lea edx, [eax + 0x110]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x10006498
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x10c], 3
call fcn.100058ad
test eax, eax
je 0x10006707
jmp 0x100066fa
push 1
push 1
push 0
push 1
push dword [ebp - 0x440]
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
test esi, esi
je 0x100066fa
cmp esi, 0xffffffff
je 0x100066fa
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x1000181c
push esi
mov dword [ebp - 0x438], 0x400
call edi
test eax, eax
je 0x100065a4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push 0
push 0x10001808
push esi
call edi
test eax, eax
je 0x10006586
mov ecx, dword [ebx + 0x40]
mov ecx, dword [ecx + 0x10c]
cmp ecx, 1
jne 0x10006727
mov edi, dword [0x10014010]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006558
sub eax, edx
push eax
lea eax, [ebp - 0x430]
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, edi
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006577
sub eax, edi
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov byte [ebp + eax - 0x430], 0
mov byte [ebp + eax - 0x42f], 0
mov byte [ebp + eax - 0x42e], 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x43c], 0
cmp byte [ebp - 0x430], 0
je 0x100066fa
lea esi, [ebp - 0x430]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100065ca
sub eax, edi
mov dword [ebp - 0x438], eax
mov eax, dword [ebx + 0x40]
mov edx, esi
mov esi, 0x110
add eax, esi
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x100065e5
mov eax, dword [ebx + 0x40]
add eax, esi
cmp byte [eax], 0x7b
jne 0x100065fa
inc eax
lea ecx, [ebp - 0x478]
push ecx
lea ecx, [ebp - 0x474]
push ecx
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x44c]
push ecx
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x468]
push ecx
lea ecx, [ebp - 0x450]
push ecx
push 0x10001760
push eax
call fcn.1000e0ef
add esp, 0x34
cmp eax, 0xb
jne 0x100066d4
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x30], eax
mov ax, word [ebp - 0x468]
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x460]
mov word [ebp - 0x2a], ax
mov al, byte [ebp - 0x45c]
mov byte [ebp - 0x28], al
mov al, byte [ebp - 0x46c]
mov byte [ebp - 0x27], al
mov al, byte [ebp - 0x44c]
mov byte [ebp - 0x26], al
mov al, byte [ebp - 0x464]
mov byte [ebp - 0x25], al
mov al, byte [ebp - 0x470]
mov byte [ebp - 0x24], al
mov al, byte [ebp - 0x454]
mov byte [ebp - 0x23], al
mov al, byte [ebp - 0x474]
mov byte [ebp - 0x22], al
mov al, byte [ebp - 0x478]
mov byte [ebp - 0x21], al
lea edi, [ebx + 0x10]
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100058ad
test eax, eax
je 0x10006707
mov ecx, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x438]
lea eax, [ecx + eax + 1]
lea esi, [ebp + eax - 0x430]
cmp byte [esi], 0
mov dword [ebp - 0x43c], eax
jne 0x100065c5
cmp dword [ebp - 0x448], 0
jne 0x10006046
push dword [ebx + 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
cmp dword [ebx + 0x34], eax
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000debd
leave
ret
test ecx, ecx
jne 0x10006766
mov edi, dword [0x10014018]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006736
sub eax, edx
push eax
lea eax, [ebp - 0x430]
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, edi
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006755
sub eax, edi
mov dword [ebp - 0x438], eax
xor eax, eax
test eax, eax
je 0x10006586
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100066fa