Function at 0x40b980
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x758
xor ebx, ebx
lea rsi, [rsp + 0x400]
mov r14, rdx
mov r13, r8
mov rbp, rcx
mov r8d, 0x348
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov dword [r14], 0
mov rdi, qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
mov dword [rsp + 0x400], 0x348
mov dword [r13], 0
jmp 0x40b9f2
mov eax, dword [rsp + 0x544]
and eax, 3
cmp eax, 3
je 0x40ba03
add ebx, 1
xor r9d, r9d
mov r8, rsi
mov edx, ebx
mov rcx, rbp
call rdi
test eax, eax
jne 0x40b9e0
xor eax, eax
cmp word [rsp + 0x548], 0
jne 0x40ba24
add rsp, 0x758
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x148
mov edx, 0x5c
mov rcx, rsi
call sub.msvcrt.dll_wcschr
mov edx, 0x5c
lea rdi, [rax + 2]
mov rcx, rdi
call sub.msvcrt.dll_wcschr
mov rdx, rdi
sub rax, rdi
lea rdi, [rsp + 0x23e]
mov rbx, rax
lea rax, [rsp + 0xc0]
sar rbx, 1
mov r8, rbx
mov rcx, rax
mov qword [rsp + 0x48], rax
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, rsi
mov edx, 0x5c
mov word [rsp + rbx*2 + 0xc0], ax
lea rsi, [rsp + 0x1f0]
call sub.msvcrt.dll_wcschr
mov ecx, 0x37
xor edx, edx
lea rbx, [rax + 2]
mov rax, qword [str.SYSTEMCurrentControlSetEnumDISPLAY_]
mov qword [rsp + 0x1f0], rax
mov rax, qword [0x007f7638]
mov qword [rsp + 0x1f8], rax
mov rax, qword [0x007f7640]
mov qword [rsp + 0x200], rax
mov rax, qword [0x007f7648]
mov qword [rsp + 0x208], rax
mov rax, qword [0x007f7650]
mov qword [rsp + 0x210], rax
mov rax, qword [0x007f7658]
mov qword [rsp + 0x218], rax
mov rax, qword [0x007f7660]
mov qword [rsp + 0x220], rax
mov rax, qword [0x007f7668]
mov qword [rsp + 0x228], rax
mov rax, qword [0x007f7670]
mov qword [rsp + 0x230], rax
mov eax, dword [0x007f7678]
mov dword [rsp + 0x238], eax
movzx eax, word [0x007f767c]
mov word [rsp + 0x23c], ax
xor eax, eax
rep stosq qword [rdi], rax
mov rcx, rbx
mov word [rdi], dx
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
mov rdx, rbx
mov rcx, rsi
sub rax, rbx
mov r8, rax
sar r8, 1
call sub.msvcrt.dll_wcsncat
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_wcschr
xor r8d, r8d
mov rdx, rsi
mov r9d, 0x20019
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov rcx, 0xffffffff80000002
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
jne 0x40bce1
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x7b0], r13
lea rdi, [rsp + 0x7c]
xor ebx, ebx
mov dword [rsp + 0x7c], 0x104
lea r15, [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0xa6]
mov qword [rsp + 0x68], rcx
jmp 0x40bc13
add ebx, 1
mov qword [rsp + 0x38], r15
mov r9, rdi
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r12
test eax, eax
jne 0x40bcd3
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
call rbp
test eax, eax
jne 0x40bc10
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 0x104
mov rcx, qword [rsp + 0x90]
lea rdx, str.Driver
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40bcc4
lea rdx, [r13 + 2]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40bcf0
mov rcx, qword [rsp + 0x90]
call rdx
jmp 0x40bc10
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40ba10
lea rax, [rsp + 0x98]
xor r8d, r8d
mov r9d, 0x20019
mov rcx, qword [rsp + 0x90]
lea rdx, str.Device_Parameters
mov qword [rsp + 0x20], rax
call rbp
mov rdx, qword [rsp + 0x50]
test eax, eax
jne 0x40bcc4
lea rax, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 0x100
mov qword [rsp + 0x28], rdi
lea rdx, str.EDID
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40be30
movsx eax, byte [rsp + 0xf8]
movzx edx, byte [rsp + 0xf9]
movzx r9d, byte [rsp + 0xfb]
mov ecx, eax
shl eax, 3
sar ecx, 2
and eax, 0x18
and ecx, 0x1f
mov r8d, r9d
and r9d, 0xf
add ecx, 0x40
shr r8b, 4
mov word [rsp + 0xa0], cx
mov ecx, edx
and edx, 0x1f
and r8d, 0xf
shr ecx, 5
and ecx, 7
or eax, ecx
mov rcx, qword [rsp + 0x68]
add eax, 0x40
mov word [rsp + 0xa2], ax
lea eax, [rdx + 0x40]
mov word [rsp + 0xa4], ax
movzx eax, byte [rsp + 0xfa]
mov edx, eax
shr al, 4
and edx, 0xf
movzx eax, al
mov dword [rsp + 0x28], edx
lea rdx, str._X_X_X_X
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x40be30
movzx eax, byte [rsp + 0x106]
mov r13, qword [rsp + 0x7b0]
mov dword [r14], eax
movzx eax, byte [rsp + 0x105]
mov dword [r13], eax
mov eax, 1
jmp 0x40ba10
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
call rax
mov rdx, qword [rsp + 0x40]
jmp 0x40bcc4