Function at 0x45c440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
mov dword [ebp - 0x894], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x620]
push ecx
call fcn.0045e190
add esp, 8
mov ecx, 0xf
mov esi, str.SYSTEMCurrentControlSetEnum_
lea edi, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1b6
push 0
lea edx, [ebp - 0x3da]
push edx
call fcn.00440cf0
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.0045e1d0
add esp, 8
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x45c4f9
push 0x23
lea eax, [ebp - 0x418]
push eax
call fcn.004189a5
add esp, 8
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jne 0x45c4e0
jmp 0x45c4f9
mov ecx, 0x5c
mov edx, dword [ebp - 0x67c]
mov word [edx], cx
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 4], eax
jmp 0x45c4b5
cmp dword [ebp - 4], 0
je 0x45c507
xor ecx, ecx
mov edx, dword [ebp - 4]
mov word [edx], cx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x418]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x45c5ed
mov dword [ebp - 0x684], 0x208
mov dword [ebp - 0x680], 1
lea edx, [ebp - 0x684]
push edx
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x680]
push ecx
push 0
push str.DeviceDesc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3b
lea ecx, [ebp - 0x890]
push ecx
call fcn.004189a5
add esp, 8
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 0
je 0x45c5b2
mov edx, dword [ebp - 0x688]
add edx, 2
mov dword [ebp - 0x898], edx
jmp 0x45c5be
lea eax, [ebp - 0x890]
mov dword [ebp - 0x898], eax
mov ecx, dword [ebp - 0x898]
mov dword [ebp - 0x688], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x688]
push eax
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x894]
mov eax, dword [edx + 4]
call eax
mov dword [ebp + 0xc], eax
jmp 0x45c60c
mov ecx, dword [ebp + 0xc]
push ecx
push str.USB_Root_Hub
mov edx, dword [ebp - 0x894]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x894]
mov edx, dword [eax + 4]
call edx
mov dword [ebp + 0xc], eax
mov eax, dword [str.._]
mov dword [ebp - 0x220], eax
mov ecx, dword [0x474468]
mov dword [ebp - 0x21c], ecx
mov dx, word [0x47446c]
mov word [ebp - 0x218], dx
push 0x1fe
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00440cf0
add esp, 0xc
lea ecx, [ebp - 0x620]
push ecx
push 0x100
lea edx, [ebp - 0x218]
push edx
call fcn.0043f7e4
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x678], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4c
lea edx, [ebp - 0x678]
push edx
push 0x4c
lea eax, [ebp - 0x678]
push eax
push 0x220408
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x45c6ca
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45c6f6
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, byte [ebp - 0x672]
push ecx
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x894]
call fcn.0045c720
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043ea11
mov esp, ebp
pop ebp
ret 8