Function at 0x45aa30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45aa72
xor eax, eax
jmp 0x45acee
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x208], 0x100
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x230], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x234], 0
jne 0x45acdc
lea ecx, [ebp - 0x210]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x204]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45accd
lea ecx, [ebp - 0x22c]
push ecx
push 0x20019
push 0
push str.NdiInterfaces
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45acc0
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push str.LowerRange
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45acb3
push str.ethernet
lea ecx, [ebp - 0x104]
push ecx
call fcn.004652f0
add esp, 8
test eax, eax
je 0x45acb3
mov dword [ebp - 0x208], 0x100
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push str.DriverDesc
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45acb3
push 0xe0
call fcn.004d1fc2
add esp, 4
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x45abf1
mov ecx, dword [ebp - 0x220]
call fcn.004568b0
mov dword [ebp - 0x224], eax
jmp 0x45abfb
mov dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x20c], eax
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x18
call fcn.0043aa30
mov dword [ebp - 0x208], 0x100
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push str.NetCfgInstanceID
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45aca1
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x20c]
add ecx, 0xac
call fcn.0043aa30
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.004608d0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.00460780
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.004648b0
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0x100
jmp 0x45aa86
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret