Function at 0x1003e97
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38c
mov eax, 0x1005dd7
call fcn.010055d3
mov dword [ebp - 0x390], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
or dword [ebp - 0x374], 0xffffffff
mov dword [ebp - 0x38c], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0x378], esi
mov dword [ebp - 0x370], esi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x388], esi
mov dword [ebp - 0x394], esi
mov dword [ebp - 0x384], esi
mov esi, 0x1001bbc
lea edi, [ebp - 0x228]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor edi, edi
push 0x10070bc
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x37c], edi
call fcn.0100341a
mov dword [ebp - 4], edi
mov eax, dword [section..data]
cmp eax, section..data
je 0x1003f55
test byte [eax + 0x1c], 0x10
je 0x1003f55
push dword [ebp + 0x10]
push dword [ebp - 0x38c]
push ebx
push 0x10012d0
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010024bc
lea eax, [ebp - 0x370]
push eax
push 0x10016d4
lea ecx, [ebp - 0x36c]
call fcn.01002ab0
mov byte [ebp - 4], 1
cmp ebx, edi
jne 0x1003f88
mov eax, dword [section..data]
mov dword [ebp - 0x370], 0x80070057
jmp 0x1004350
cmp dword [ebp - 0x38c], edi
je 0x100431e
cmp dword [ebp + 0x10], edi
je 0x100431e
push edi
push edi
push edi
push 0x12
push edi
push edi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsExW]
mov dword [ebp - 0x374], eax
mov esi, 0x80070000
cmp eax, 0xffffffff
jne 0x1003fd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1003fd2
and eax, 0xffff
or eax, esi
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], edi
jge 0x1004017
mov eax, dword [section..data]
cmp eax, section..data
je 0x100432d
test byte [eax + 0x1c], 2
je 0x100432d
push dword [ebp - 0x370]
push 0x10012d0
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001d79
jmp 0x1004328
mov ecx, dword [ebp - 0x390]
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x374]
push ebx
call fcn.01003aee
cmp eax, edi
mov dword [ebp - 0x370], eax
jge 0x1004063
mov eax, dword [section..data]
cmp eax, section..data
je 0x100432d
test byte [eax + 0x1c], 2
je 0x100432d
push dword [ebp - 0x370]
push 0x10012d0
push 0x29
jmp 0x1004007
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x384]
lea eax, [ebp - 0x228]
push eax
xor edi, edi
push edi
push dword [ebp - 0x374]
mov dword [ebp - 0x244], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
cmp eax, 1
je 0x10040bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov ebx, 0xffff
jg 0x10040b9
mov dword [ebp - 0x370], eax
jmp 0x10040c4
and eax, ebx
or eax, esi
jmp 0x10040b1
mov ebx, 0xffff
cmp dword [ebp - 0x370], edi
jl 0x10042e6
push edi
lea eax, [ebp - 0x388]
push eax
push edi
push edi
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
test eax, eax
jne 0x1004145
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
jne 0x100412d
push dword [ebp - 0x388]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], eax
test eax, eax
je 0x10042b8
mov dword [eax], 6
and dword [ebp - 0x370], 0
jmp 0x1004145
call edi
test eax, eax
jle 0x1004137
and eax, ebx
or eax, esi
mov dword [ebp - 0x370], eax
test eax, eax
jl 0x10042c2
cmp dword [ebp - 0x378], 0
je 0x1004283
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x25c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
push eax
push 0
push dword [ebp - 0x388]
lea eax, [ebp - 0x244]
push dword [ebp - 0x378]
mov dword [ebp - 0x260], 0x1c
push eax
push dword [ebp - 0x374]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
cmp eax, 1
jne 0x100426f
mov eax, dword [ebp - 0x378]
add eax, 4
push eax
push dword [ebp - 0x380]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1004283
push 0x20019
push 2
push eax
push 1
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
je 0x10041e2
test edi, edi
jne 0x10041f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10041f0
and eax, ebx
or eax, esi
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
jne 0x1004253
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x394]
push eax
push 0
push 0x10016c0
push edi
mov dword [ebp - 0x398], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004238
jle 0x100424d
and eax, ebx
or eax, esi
jmp 0x100424d
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x38c]
call fcn.01002839
mov dword [ebp - 0x370], eax
cmp edi, 0xffffffff
je 0x1004263
test edi, edi
je 0x1004263
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x370], 0x80070103
jmp 0x1004283
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100427d
and eax, ebx
or eax, esi
mov dword [ebp - 0x370], eax
xor edi, edi
cmp dword [ebp - 0x37c], edi
je 0x10042a5
push dword [ebp - 0x37c]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], edi
cmp dword [ebp - 0x370], edi
jne 0x100430a
inc dword [ebp - 0x384]
jmp 0x1004063
mov dword [ebp - 0x370], 0x8007000e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100432d
test byte [eax + 0x1c], 2
je 0x100432d
push dword [ebp - 0x370]
push 0x10012d0
push 0x2b
jmp 0x1004007
mov eax, dword [section..data]
cmp eax, section..data
je 0x100432d
test byte [eax + 0x1c], 2
je 0x100432d
push dword [ebp - 0x370]
push 0x10012d0
push 0x2a
jmp 0x1004007
cmp dword [ebp - 0x370], 0x80070103
jne 0x1004328
mov dword [ebp - 0x370], edi
jmp 0x1004328
mov dword [ebp - 0x370], 0x80070057
mov eax, dword [section..data]
cmp dword [ebp - 0x374], 0xffffffff
je 0x1004347
push dword [ebp - 0x374]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [section..data]
cmp dword [ebp - 0x370], 0
jge 0x1004375
cmp eax, section..data
je 0x1004375
test byte [eax + 0x1c], 2
je 0x1004375
push dword [ebp - 0x370]
push 0x10012d0
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001d79
mov esi, dword [ebp - 0x370]
lea ecx, [ebp - 0x36c]
call fcn.010021ec
mov ecx, dword [ebp - 0x380]
add ecx, 0xfffffff0
call fcn.010020ec
mov eax, esi
call fcn.01005665
ret 0xc