Function at 0x410f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x485ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0xa0], 0x80
mov dword [ebp - 0x98], 0
lea eax, [ebp - 0x9c]
push eax
push 1
push 0
push 0x4756cc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4115c7
mov cx, word [ebp + 8]
mov word [ebp - 0xcc], cx
mov dword [ebp - 0xc8], 0x20
push str.Device_sscdmdm
lea ecx, [ebp - 0xb4]
call fcn.00405580
mov dword [ebp - 4], 0
push str.Device_ssaemdm
lea ecx, [ebp - 0xb0]
call fcn.00405580
mov byte [ebp - 4], 1
push str.Device_ssadmdm
lea ecx, [ebp - 0xac]
call fcn.00405580
mov byte [ebp - 4], 2
push str.Device_ssudmdm
lea ecx, [ebp - 0xa8]
call fcn.00405580
mov dword [ebp - 4], 3
lea edx, [ebp - 0xc4]
push edx
call fcn.00421070
add esp, 4
mov dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x188], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x188]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
cmp dword [ebp - 0xa4], 0x103
je 0x4114fa
mov dword [ebp - 0xc8], 0x20
mov dword [ebp - 0xa0], 0x80
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x94]
push ecx
push 0
push 0
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4114aa
mov byte [ebp - 0x111], 0
mov dword [ebp - 0x118], 0
jmp 0x4110e1
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 0x118], 4
jge 0x4114aa
movzx edx, byte [ebp - 0x111]
cmp edx, 1
jne 0x4110ff
jmp 0x4114aa
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405580
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x118]
lea ecx, [ebp + ecx*4 - 0xb4]
call fcn.00401b80
push eax
lea edx, [ebp - 0x138]
push edx
lea ecx, [ebp - 0x11c]
call fcn.0040efd0
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x190]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x138]
call fcn.00401d80
mov edx, dword [ebp - 0x118]
lea ecx, [ebp + edx*4 - 0xb4]
call fcn.0040fda0
push eax
lea ecx, [ebp - 0x11c]
call fcn.0040ee90
test eax, eax
jne 0x411496
mov byte [ebp - 0x111], 1
lea ecx, [ebp - 0x124]
call fcn.00412950
lea eax, [ebp - 0x8e]
push eax
call fcn.0044ba5a
add esp, 4
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], 0
jmp 0x4111d9
mov ecx, dword [ebp - 0x12c]
add ecx, 1
mov dword [ebp - 0x12c], ecx
mov ecx, dword [ebp - 0x184]
add ecx, 0x10c
call fcn.00411a70
cmp dword [ebp - 0x12c], eax
jge 0x411496
mov edx, dword [ebp - 0x12c]
push edx
mov ecx, dword [ebp - 0x184]
add ecx, 0x10c
call fcn.00411a90
cmp dword [eax], 0xffffffff
je 0x41127a
mov eax, dword [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x184]
add ecx, 0x10c
call fcn.00411a90
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x128]
jne 0x411275
mov dword [ebp - 0x13c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11c]
call fcn.00401d80
mov dword [ebp - 4], 0xffffffff
push fcn.00401d80
push 4
push 4
lea edx, [ebp - 0xb4]
push edx
call fcn.0044bfd9
mov eax, dword [ebp - 0x13c]
jmp 0x4115ca
jmp 0x4111ca
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x184]
call fcn.004115f0
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jle 0x411359
mov ecx, dword [ebp - 0x12c]
cmp ecx, dword [ebp - 0x130]
je 0x411359
mov edx, dword [ebp - 0x130]
push edx
mov ecx, dword [ebp - 0x184]
add ecx, 0x10c
call fcn.00411a90
cmp dword [eax], 0xffffffff
je 0x411354
lea ecx, [ebp - 0x134]
call fcn.00401ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
push str.Slot__d_is_for_COM_d._But_its_busy._Check_it__
lea edx, [ebp - 0x134]
push edx
call fcn.00405150
add esp, 0x10
mov dword [ebp - 0x140], 0xffffffff
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x134]
call fcn.00401d80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11c]
call fcn.00401d80
mov dword [ebp - 4], 0xffffffff
push fcn.00401d80
push 4
push 4
lea eax, [ebp - 0xb4]
push eax
call fcn.0044bfd9
mov eax, dword [ebp - 0x140]
jmp 0x4115ca
jmp 0x4111ca
mov ecx, dword [ebp - 0x12c]
push ecx
mov ecx, dword [ebp - 0x184]
add ecx, 0x10c
call fcn.00411a90
mov edx, dword [ebp - 0x128]
mov dword [eax], edx
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x148]
push ecx
mov ecx, dword [ebp - 0x184]
add ecx, 0x154
call fcn.00412810
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x150]
push ecx
mov ecx, dword [ebp - 0x184]
add ecx, 0x154
call fcn.00411e30
push eax
lea ecx, [ebp - 0x124]
call fcn.004129b0
movzx edx, al
test edx, edx
je 0x411412
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x154], ecx
mov edx, dword [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x158]
push eax
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp - 0x184]
add ecx, 0x154
call fcn.00412030
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x170]
call fcn.004129e0
push eax
lea ecx, [ebp - 0x168]
call fcn.00415c30
lea ecx, [ebp - 0x168]
push ecx
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [ebp - 0x184]
add ecx, 0x154
call fcn.00411e60
push 0
push 0x64
push str.Added__
push 0xfbd
mov eax, dword [ebp - 0x128]
push eax
call fcn.0040fcb0
mov ecx, eax
call fcn.00405040
push eax
call fcn.0040c0a0
add esp, 0x18
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
jmp 0x411496
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11c]
call fcn.00401d80
jmp 0x4110d2
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x194], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x194]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
jmp 0x411062
lea edx, [ebp - 0xbc]
push edx
call fcn.00421070
add esp, 4
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xbc]
push eax
call fcn.004168f0
add esp, 0x10
call fcn.0044fbc0
movsx ecx, ax
movsx edx, word [ebp - 0xcc]
sub edx, ecx
mov word [ebp - 0xcc], dx
movsx eax, word [ebp + 8]
cmp eax, 1
je 0x411561
movsx ecx, word [ebp + 8]
test ecx, ecx
je 0x41159e
movsx edx, word [ebp - 0xcc]
test edx, edx
jg 0x41159e
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x180], ecx
mov dword [ebp - 4], 0xffffffff
push fcn.00401d80
push 4
push 4
lea edx, [ebp - 0xb4]
push edx
call fcn.0044bfd9
mov eax, dword [ebp - 0x180]
jmp 0x4115ca
cmp dword [ebp - 0xa4], 0
jne 0x410ffe
mov dword [ebp - 4], 0xffffffff
push fcn.00401d80
push 4
push 4
lea eax, [ebp - 0xb4]
push eax
call fcn.0044bfd9
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ab88
mov esp, ebp
pop ebp
ret 4