Function at 0x1000169a
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10005ad0
mov ecx, dword [esp + 4]
sub esp, 0x31c
push ebx
lea eax, [esp + 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10005b02
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x330]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea edx, [esp + 0x10]
push edx
push ebp
push ebx
push ebx
push str.DriverDesc
mov edi, 0x104
push eax
mov byte [esp + 0x38], bl
mov byte [esp + 0x13c], bl
mov byte [esp + 0x240], bl
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005b48
mov byte [ebp], bl
mov ebp, dword [esp + 0x344]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebx
push ebx
push str.InfPath
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005b6e
mov byte [ebp], bl
mov ebp, dword [esp + 0x348]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push ebx
push str.InfSection
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005b94
mov byte [ebp], bl
mov ebp, dword [esp + 0x34c]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ebp
push ebx
push ebx
push str.ProviderName
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005bba
mov byte [ebp], bl
mov ebp, dword [esp + 0x340]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebx
push ebx
push 0x10044284
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005be0
mov byte [ebp], bl
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push str.ReleaseVersion
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005c04
mov byte [esp + 0x20], bl
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x22c]
push ecx
push ebx
push ebx
push 0x1004426c
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005c2e
mov byte [esp + 0x228], bl
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push str.Info
push ecx
call ebp
test eax, eax
jne 0x10005c84
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x128]
push eax
push ebx
push ebx
push str.ReleaseVersion
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x10005c79
mov byte [esp + 0x124], bl
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
push str.Default
push ecx
call ebp
test eax, eax
jne 0x10005ccf
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x340]
push edi
push ebx
push ebx
push 0x10044254
push eax
call esi
test eax, eax
je 0x10005cc4
mov byte [edi], bl
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jle 0x10005d0e
mov edx, dword [esp + 0x334]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret
lea eax, [esp + 0x124]
push eax
call esi
test eax, eax
jle 0x10005d42
mov edx, dword [esp + 0x334]
lea ecx, [esp + 0x124]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret
lea eax, [esp + 0x228]
push eax
call esi
test eax, eax
jle 0x10005d76
mov edx, dword [esp + 0x334]
lea ecx, [esp + 0x228]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret
mov eax, dword [esp + 0x334]
pop edi
pop esi
mov byte [eax], bl
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret