Function at 0x1001ee5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb04
mov eax, dword [0x1009004]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0xad4], 0xffffffff
or dword [ebp - 0xad8], 0xffffffff
push ebx
push esi
xor ebx, ebx
push 4
push ebx
push ebx
push ebx
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xaf0], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov esi, eax
mov dword [ebp - 0xae0], esi
cmp esi, 0xffffffff
jne 0x1001f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xaec], eax
jmp 0x10028a1
push edi
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov dword [ebp - 0x278], 0x1c
mov dword [ebp - 0xacc], ebx
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xacc]
push esi
call edi
inc dword [ebp - 0xacc]
test eax, eax
jne 0x1001f5e
lea eax, [ebp - 0x278]
push eax
push ebx
push esi
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0x278], 0x1c
mov dword [ebp - 0xad0], ebx
call edi
test eax, eax
je 0x10021d1
mov dword [ebp - 0xae4], ebx
inc dword [ebp - 0xad0]
add dword [ebp - 0xae4], 0x64
cmp dword [0x1009bf4], ebx
jne 0x10021d1
mov eax, dword [ebp - 0xae4]
xor edx, edx
div dword [ebp - 0xacc]
cmp eax, dword [ebp - 0xaf8]
jbe 0x1001ffb
push ebx
push eax
push 0x402
push 0x3f0
push dword [0x10095a0]
mov dword [ebp - 0xaf8], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [ebp - 0x264]
lea eax, [ebp - 0xafc]
push eax
lea eax, [ebp - 0xb00]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
jne 0x100205d
push ebx
push 0x208
lea eax, [ebp - 0x25c]
push eax
push ebx
push 0x16
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x10021b9
lea eax, [ebp - 0x25c]
push 0x1001458
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10021b9
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
mov dword [ebp - 0x4a4], 0x22c
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
je 0x10021b9
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
mov dword [ebp - 0x49c], 0x4000800
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
je 0x10021b9
push 1
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
je 0x10021b9
lea eax, [ebp - 0xac0]
push eax
push ebx
push 1
lea eax, [ebp - 0x278]
push eax
push esi
mov dword [ebp - 0xac0], 0x61c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoW]
test eax, eax
je 0x10021a9
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetSelectedDriverW]
test eax, eax
je 0x10021a9
call dword [sym.imp.SETUPAPI.dll_SetupOpenFileQueue]
mov dword [ebp - 0xae8], eax
cmp eax, 0xffffffff
je 0x10021a9
or dword [ebp - 0x4a0], 8
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
test eax, eax
je 0x100219d
lea eax, [ebp - 0x278]
push eax
push esi
push 0x15
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x100219d
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x274]
push eax
push 0x1001bfd
push ebx
push 0x40
push dword [ebp - 0xae8]
call dword [sym.imp.SETUPAPI.dll_SetupScanFileQueueW]
and dword [ebp - 0x4a0], 0xfffffff7
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x278]
push eax
push esi
mov dword [ebp - 0x48c], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsW]
push dword [ebp - 0xae8]
call dword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
push 1
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xad0]
push esi
call edi
test eax, eax
jne 0x1001fa7
push 0x80000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xae4], eax
cmp eax, ebx
je 0x1002894
lea eax, [ebp - 0x278]
push eax
push ebx
push esi
mov dword [ebp - 0x278], 0x1c
mov dword [ebp - 0xad0], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x10024e8
inc dword [ebp - 0xad0]
cmp dword [0x1009bf4], ebx
jne 0x10024f0
push ebx
push dword [ebp - 0x264]
lea eax, [ebp - 0xafc]
push eax
lea eax, [ebp - 0xb00]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
jne 0x100228b
push ebx
push 0x208
lea eax, [ebp - 0x25c]
push eax
push ebx
push 0x16
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x10024d3
lea eax, [ebp - 0x25c]
push 0x1001458
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10024d3
cmp dword [0x1009bf4], ebx
jne 0x10024d3
push ebx
push 0x208
lea eax, [ebp - 0x25c]
push eax
push ebx
push 4
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x10022d0
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xae4]
call fcn.01001ad5
cmp dword [0x1009bf4], ebx
jne 0x10024d3
mov dword [ebp - 0xacc], ebx
xor eax, eax
cmp dword [ebp - 0xacc], ebx
mov dword [ebp - 0xac4], ebx
setne al
add eax, 0x11
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xac4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xaf8]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov eax, dword [ebp - 0xac4]
cmp eax, ebx
jbe 0x10023b8
add eax, 4
push eax
push 8
pop edi
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
cmp eax, ebx
je 0x100253e
lea ecx, [ebp - 0xac4]
push ecx
push dword [ebp - 0xac4]
push eax
push ebx
push dword [ebp - 0xaf8]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x100239c
mov edi, dword [ebp - 0xac8]
jmp 0x1002397
push edi
push dword [ebp - 0xae4]
call fcn.01001ad5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x1002380
push dword [ebp - 0xac8]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov dword [ebp - 0xac8], ebx
inc dword [ebp - 0xacc]
cmp dword [ebp - 0xacc], 2
jb 0x10022e2
cmp dword [0x1009bf4], ebx
jne 0x10024d3
push 0x20019
push 2
push ebx
push 1
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [ebp - 0xad4], eax
cmp eax, 0xffffffff
je 0x10024d3
lea eax, [ebp - 0xac4]
push eax
push ebx
lea eax, [ebp - 0xadc]
push eax
push ebx
push 0x1001438
push dword [ebp - 0xad4]
mov dword [ebp - 0xac4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0xac4]
cmp eax, ebx
jbe 0x10024c0
add eax, 4
push eax
push 8
pop edi
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
cmp eax, ebx
je 0x100253e
lea ecx, [ebp - 0xac4]
push ecx
push eax
lea eax, [ebp - 0xadc]
push eax
push ebx
push 0x1001438
push dword [ebp - 0xad4]
mov dword [ebp - 0xadc], 7
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10024a4
mov edi, dword [ebp - 0xac8]
jmp 0x100249f
push edi
call fcn.01001e11
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x100248e
push dword [ebp - 0xac8]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov dword [ebp - 0xac8], ebx
push dword [ebp - 0xad4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0xad4], 0xffffffff
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0xad0]
push dword [ebp - 0xae0]
call edi
test eax, eax
jne 0x1002212
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiBuildClassInfoList]
lea eax, [ebp - 0xaf4]
push eax
push ebx
push ebx
push ebx
mov dword [ebp - 0xaf4], ebx
call edi
mov eax, dword [ebp - 0xaf4]
cmp eax, ebx
jbe 0x1002858
shl eax, 4
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xaf0], eax
cmp eax, ebx
jne 0x1002549
mov dword [ebp - 0xaec], 8
jmp 0x1002858
mov dword [ebp - 0xaec], edi
jmp 0x1002858
lea ecx, [ebp - 0xaf4]
push ecx
push dword [ebp - 0xaf4]
push eax
push ebx
call edi
test eax, eax
je 0x1002826
lea eax, [ebp - 0xad8]
push eax
push 0x20019
push ebx
push 0x10013d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100258a
or dword [ebp - 0xad8], 0xffffffff
mov dword [ebp - 0xae8], ebx
cmp dword [ebp - 0xaf4], ebx
jbe 0x1002826
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xad0], eax
mov esi, dword [ebp - 0xad0]
push 4
pop ecx
mov edi, 0x10012fc
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002801
push 0x20019
push dword [ebp - 0xad0]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xad4], eax
cmp eax, 0xffffffff
je 0x1002730
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xac4], ebx
mov eax, 0x10013b0
cmp dword [ebp - 0xacc], ebx
jne 0x1002604
mov eax, 0x1001394
lea ecx, [ebp - 0xac4]
push ecx
push ebx
lea ecx, [ebp - 0xadc]
push ecx
push ebx
push eax
push dword [ebp - 0xad4]
call edi
mov eax, dword [ebp - 0xac4]
cmp eax, ebx
jbe 0x10026c3
add eax, 4
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
cmp eax, ebx
je 0x10028e6
mov dword [ebp - 0xadc], 7
mov ecx, 0x10013b0
cmp dword [ebp - 0xacc], ebx
jne 0x1002668
mov ecx, 0x1001394
lea edx, [ebp - 0xac4]
push edx
push eax
lea eax, [ebp - 0xadc]
push eax
push ebx
push ecx
push dword [ebp - 0xad4]
call edi
test eax, eax
jne 0x10026a9
mov esi, dword [ebp - 0xac8]
jmp 0x10026a4
push esi
push dword [ebp - 0xae4]
call fcn.01001ad5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x100268d
push dword [ebp - 0xac8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xac8], ebx
inc dword [ebp - 0xacc]
cmp dword [ebp - 0xacc], 2
jb 0x10025ec
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0xadc]
push eax
push ebx
push 0x100137c
push dword [ebp - 0xad4]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xac4], 0x208
call edi
test eax, eax
jne 0x100271d
lea eax, [ebp - 0x25c]
push eax
call fcn.01001e11
push dword [ebp - 0xad4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0xad4], 0xffffffff
cmp dword [ebp - 0xad8], 0xffffffff
je 0x1002801
push 0x27
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xad0]
call sub.SETUPAPI.dll_pSetupStringFromGuid
test eax, eax
jne 0x1002801
lea eax, [ebp - 0xac4]
push eax
push ebx
lea eax, [ebp - 0xadc]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xad8]
mov dword [ebp - 0xac4], ebx
call edi
mov eax, dword [ebp - 0xac4]
cmp eax, ebx
jbe 0x1002801
add eax, 4
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xac8], esi
cmp esi, ebx
je 0x10028e6
lea eax, [ebp - 0xac4]
push eax
push esi
lea eax, [ebp - 0xadc]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xad8]
mov dword [ebp - 0xadc], 7
call edi
test eax, eax
jne 0x10027ec
mov edi, esi
cmp word [esi], bx
je 0x10027ec
push edi
call fcn.01001e11
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x10027d6
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xac8], ebx
inc dword [ebp - 0xae8]
mov eax, dword [ebp - 0xae8]
add dword [ebp - 0xad0], 0x10
cmp eax, dword [ebp - 0xaf4]
jb 0x10025a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 0xad8], 0xffffffff
je 0x1002842
push dword [ebp - 0xad8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0xad8], 0xffffffff
push dword [ebp - 0xaf0]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xaf0], ebx
push dword [ebp - 0xae4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xac8], ebx
je 0x100287c
push dword [ebp - 0xac8]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xaf0], ebx
je 0x1002894
push dword [ebp - 0xaf0]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0xae0]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
cmp dword [ebp - 0xad8], 0xffffffff
pop esi
pop ebx
je 0x10028bf
push dword [ebp - 0xad8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0xad8], 0xffffffff
cmp dword [ebp - 0xad4], 0xffffffff
je 0x10028d4
push dword [ebp - 0xad4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xaec]
xor ecx, ebp
call fcn.01007194
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0xaec], 8
jmp 0x1002858