Function at 0x406fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e640
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSet_
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x407110
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x40716c
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [esi*4 + 0x419000]
cmp eax, ebx
je 0x407044
cmp edi, 1
push 1
jne 0x407034
mov edx, dword [esi*4 + 0x41900c]
push edx
push ecx
call fcn.004050c0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
inc esi
jmp 0x40700b
push eax
push ecx
call fcn.004050c0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
inc esi
jmp 0x40700b
push 1
push ebx
push ebx
push ebx
push str.VID_0421PID_01
push str.EnumNMWCD
push ecx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push 1
push 1
push str.USBVID_0421PID_01
push str.MatchingDeviceId
push ebx
push str.ControlClass4f919108_4adf_11d5_882d_00b0d02fe381
push eax
call fcn.004055e0
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push 1
push 1
push str.NMWCDVID_0421PID_01
push str.MatchingDeviceId
push ebx
push str.ControlClass4f919108_4adf_11d5_882d_00b0d02fe381
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push 1
push ebx
push str.4F919108_4ADF_11D5_882D_00B0D02FE381
push str.ClassGuid
push str.VID_0421PID_01
push str.EnumUSB
push edx
call fcn.004055e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
push 1
push ebx
push ebx
push ebx
push str._NMWCDVID_0421PID_01
push str.ControlDeviceClasses4f919102_4adf_11d5_882d_00b0d02fe381
push eax
call fcn.004055e0
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
push 1
push ebx
push ebx
push ebx
push str._USBVID_0421PID_01
push str.ControlDeviceClassesa5dcbf10_6530_11d2_901f_00c04fb951ed
push ecx
call fcn.004055e0
mov edx, dword [ebp - 0x14]
add esp, 0x1c
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40716c
cmp dword [0x41e04c], ebx
je 0x40715b
push str.SYSTEMCurrentControlSet_
push str.USB_Key___ls_not_found_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push ebx
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x41e04c], ebx
je 0x40715b
push str.SYSTEMCurrentControlSet_
push str.USB_Key___ls_open_failed_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push ebx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
jmp 0x407155