Function at 0x6101ee3e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x404
mov eax, 0x6103f25e
call fcn.6102ab31
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x400], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3dc], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.6100d224
mov byte [ebp - 4], 2
push dword [ebp + 8]
push 0x61005048
push 1
call fcn.6101b077
add esp, 0xc
push 0x6100502c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x3f4], eax
jne 0x6101eeb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6101f2dc
push 0x61005014
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x3f8], eax
jne 0x6101eed3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6101f2d0
lea eax, [ebp - 0x3e8]
push eax
push ebx
push 0x104
lea eax, [ebp - 0x3a8]
push eax
push 8
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
jne 0x6101f2b9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x50
jne 0x6101f2b9
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3cc]
call fcn.6100d7a2
lea ecx, [ebp - 0x3dc]
call fcn.61019194
mov edi, dword [ebp - 0x3dc]
push 4
push ebx
push ebx
push ebx
mov ecx, edi
call fcn.61010a05
test eax, eax
je 0x6101f2cb
lea ecx, [ebp - 0x3c4]
push ecx
mov dword [ebp - 0x3c4], 0x1c
mov eax, dword [edi + 8]
push ebx
push eax
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e4], ebx
mov dword [ebp - 0x3e0], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
jmp 0x6101f29d
inc dword [ebp - 0x3e0]
or dword [ebp - 0x3d4], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.6100d224
mov byte [ebp - 4], 3
mov eax, dword [edi + 8]
push ebx
push 0xc8
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x3c4]
push ecx
push eax
mov dword [ebp - 0x3f0], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x6101efc4
call esi
mov esi, eax
jmp 0x6101f239
mov eax, dword [edi + 8]
push 0x20019
push 2
push ebx
push 1
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, 0xffffffff
mov dword [ebp - 0x3d8], eax
jne 0x6101f03d
call esi
mov esi, eax
mov eax, 0xe0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
mov eax, esi
jne 0x6101f009
and eax, 0xffff
or eax, 0x800f0000
jmp 0x6101f017
cmp esi, ebx
jle 0x6101f017
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x800f0204
je 0x6101f271
lea eax, [ebp - 0x1a0]
push eax
push 0x61004fc0
push 2
call fcn.6101b077
add esp, 0xc
jmp 0x6101f239
push 0x104
lea ecx, [ebp - 0x3c8]
call fcn.61011c47
lea ecx, [ebp - 0x3fc]
push ecx
push eax
push ebx
push ebx
push 0x61004b94
push dword [ebp - 0x3d8]
mov dword [ebp - 0x3fc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6101f0a2
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
mov esi, eax
call fcn.61011701
lea eax, [ebp - 0x1a0]
push eax
push 0x61004f68
push 2
call fcn.6101b077
add esp, 0xc
jmp 0x6101f225
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
call fcn.61011701
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x3cc]
call fcn.6101348f
test eax, eax
jne 0x6101f20e
lea eax, [ebp - 0x1a0]
push eax
push 0x61004ee8
push 1
call fcn.6101b077
add esp, 0xc
push ebx
push dword [ebp - 0x3b0]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x3f0], 1
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
cmp eax, 0xd
je 0x6101f1a1
cmp eax, 0x25
je 0x6101f1a1
lea eax, [ebp - 0x1a0]
push eax
push 0x61004e40
push 1
call fcn.6101b077
add esp, 0xc
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
cmp eax, 0xffffffff
mov dword [ebp - 0x3d4], eax
jne 0x6101f147
call esi
mov esi, eax
jmp 0x6101f225
push dword [ebp - 0x400]
lea eax, [ebp - 0x1a0]
push dword [ebp - 0x3f8]
push ecx
mov ecx, esp
mov dword [ebp - 0x408], esp
push eax
call fcn.6100d970
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3cc]
call fcn.610116e0
push ecx
mov ecx, esp
mov dword [ebp - 0x410], esp
push eax
call fcn.6100d970
mov byte [ebp - 4], 5
push dword [ebp - 0x3d4]
mov byte [ebp - 4], 3
call fcn.6101e446
mov esi, eax
cmp esi, ebx
jne 0x6101f210
jmp 0x6101f20e
lea eax, [ebp - 0x1a0]
push eax
push 0x61004db0
push 1
call fcn.6101b077
add esp, 0xc
push ebx
push 4
lea ecx, [ebp - 0x3d0]
push ecx
push ebx
push 0xa
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x3d0], ebx
mov eax, dword [edi + 8]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x6101f13e
or dword [ebp - 0x3d0], 0x20
mov eax, dword [edi + 8]
push 4
lea ecx, [ebp - 0x3d0]
push ecx
push 0xa
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyW]
test eax, eax
je 0x6101f13e
xor esi, esi
cmp dword [ebp - 0x3d4], 0xffffffff
je 0x6101f225
push dword [ebp - 0x3d4]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp dword [ebp - 0x3d8], ebx
je 0x6101f239
push dword [ebp - 0x3d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x6101f271
cmp dword [ebp - 0x3f0], ebx
je 0x6101f267
lea eax, [ebp - 0x1a0]
push eax
push 0x61004d58
push 3
call fcn.6101b077
add esp, 0xc
mov dword [ebp - 0x3ec], 1
jmp 0x6101f271
mov dword [ebp - 0x3e4], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c8]
call fcn.6100d179
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x3c4]
push ecx
push dword [ebp - 0x3e0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6101ef77
call esi
cmp eax, 0x103
je 0x6101f2b5
call esi
jmp 0x6101eecc
xor esi, esi
jmp 0x6101f2d0
push dword [ebp + 8]
push 0x61004ce8
push 3
call fcn.6101b077
add esp, 0xc
mov esi, 0x65b
push dword [ebp - 0x3f4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
jne 0x6101f311
cmp dword [ebp - 0x3ec], ebx
je 0x6101f2fb
push 0x61004c38
push 3
call fcn.6101b077
mov esi, 0x643
jmp 0x6101f30f
cmp dword [ebp - 0x3e4], ebx
je 0x6101f311
push 0x61004ba8
push 2
call fcn.6101b077
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.6100d179
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x6101f334
mov ecx, edi
call fcn.6100cc28
mov dword [ebp - 0x3dc], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d179
mov eax, esi
call fcn.6102abc3
ret 8