Function at 0x100077a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x101bafec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x544], eax
lea eax, [ebp - 0x52c]
push eax
push str.SYSTEMCurrentControlSetEnumUSB
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x548], ecx
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x528], 0
mov byte [ebx], 0
mov dword [ebp - 0x53c], 0
call esi
test eax, eax
je 0x10007823
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1013fa65
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x53c], 0
jne 0x10007863
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push eax
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x100078ac
cmp eax, 0x103
jne 0x100079ee
cmp dword [ebp - 0x524], 0
jne 0x10007a28
mov eax, dword [ebp - 0x52c]
test eax, eax
je 0x1000787d
push eax
call edi
mov eax, dword [ebp - 0x528]
test eax, eax
je 0x1000788a
push eax
call edi
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x10007897
push eax
call edi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1013fa65
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x52c]
call esi
test eax, eax
jne 0x10007a0b
xor esi, esi
nop dword [eax]
push 0x104
lea eax, [ebp - 0x520]
push eax
push esi
push dword [ebp - 0x528]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1000790f
cmp eax, 0x103
jne 0x1000799c
push dword [ebp - 0x528]
call edi
mov dword [ebp - 0x528], 0
jmp 0x100079e8
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0x528]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000799c
mov byte [ebp - 0x318], al
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x318]
mov dword [ebp - 0x530], 0x104
push eax
lea eax, [ebp - 0x534]
mov dword [ebp - 0x534], 1
push eax
push 0
push str.ParentIdPrefix
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000798a
push dword [ebp - 0x544]
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100079ab
push dword [ebp - 0x524]
call edi
mov dword [ebp - 0x524], 0
inc esi
cmp esi, 0x100
jb 0x100078d0
jmp 0x100079e8
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.10145c5d
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.10145c5d
add esp, 0x18
mov dword [ebp - 0x53c], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp eax, 0x100
jb 0x10007832
jmp 0x10007863
push dword [ebp - 0x52c]
call edi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1013fa65
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x538]
push eax
push str.Device_Parameters
push dword [ebp - 0x524]
call esi
test eax, eax
jne 0x10007a7a
lea eax, [ebp - 0x530]
mov dword [ebp - 0x530], 0x104
push eax
push ebx
lea eax, [ebp - 0x534]
mov dword [ebp - 0x534], 1
push eax
push 0
push str.SymbolicName
push dword [ebp - 0x538]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10007a7d
mov byte [ebx], 0
mov eax, dword [ebp - 0x52c]
test eax, eax
je 0x10007a8a
push eax
call edi
mov eax, dword [ebp - 0x528]
test eax, eax
je 0x10007a97
push eax
call edi
mov eax, dword [ebp - 0x538]
test eax, eax
je 0x10007aa4
push eax
call edi
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x10007ab1
push eax
call edi
cmp byte [ebx], 0
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x524], 0
je 0x10007af6
cmp byte [ebx + 1], 0
je 0x10007af6
cmp byte [ebx + 2], 0
je 0x10007af6
cmp byte [ebx + 3], 0
je 0x10007af6
mov dword [ebx], 0x5c3f5c5c
mov edi, dword [ebp - 0x548]
mov ecx, edi
push ebx
call fcn.10007bb0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test al, al
jne 0x10007b32
lea eax, [ebp - 0x10c]
mov byte [ebp - 0x111], 0
push eax
lea eax, [ebp - 0x214]
mov byte [ebp - 9], 0
push eax
push str._USB_s_s28d78fad_5a12_11d1_ae5b_0000f803a8c2
push ebx
call esi
add esp, 0x10
push ebx
mov ecx, edi
call fcn.10007bb0
test al, al
jne 0x10007b60
mov byte [ebp - 0x111], al
mov byte [ebp - 9], al
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
push str._USB_s_sa5dcbf10_6530_11d2_901f_00c04fb951ed
push ebx
call esi
add esp, 0x10
push ebx
mov ecx, edi
call fcn.10007bb0
test al, al
jne 0x10007b8e
mov byte [ebp - 0x111], al
mov byte [ebp - 9], al
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
push str._USB_s_sf2f40381_f46d_4e51_bce7_62de6cf2d098
push ebx
call esi
add esp, 0x10
push ebx
mov ecx, edi
call fcn.10007bb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1013fa65
mov esp, ebp
pop ebp
ret 8