The executable is a firmware updater for a specific device.
I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the relevant hardware.
My guess was to look for relevant Imports.GDI32 and USER32 are not interesting because they deal with UI.The third library imported is Kernel32 (promising) and functions imported are the following :
GetObjectA TextOutA CreateCompatibleDC BitBlt SelectObject DeleteObject SetBkMode DeleteDC GetModuleFileNameA WinExec GetTempPathA SetCurrentDirectoryA CloseHandle TerminateProcess ExitProcess SetEndOfFile LoadLibraryA GetProcAddress GetStringTypeW GetStringTypeA CreateFileA FlushFileBuffers HeapFree GetLastError CreateDirectoryA HeapAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion Sleep WriteFile ReadFile HeapDestroy HeapCreate VirtualFree VirtualAlloc SetStdHandle GetEnvironmentStringsW GetCurrentProcess SetFilePointer UnhandledExceptionFilter FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStrings GetOEMCP WideCharToMultiByte GetCPInfo GetACP SetHandleCount GetStdHandle GetFileType RtlUnwind ReleaseDC GetDC CreateWindowExA RegisterClassA DefWindowProcA GetSystemMetrics LoadBitmapA GetAsyncKeyState
It looks like most of them deal with actually communicating with the device, which is not of interest to me. I was not able to find the function allowing the program to look for the appropriate device to be updated. Am I missing something ?
Edit : is the updater looking for the appropriate device in the registry ?