Function at 0x4c8700
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3f4], ecx
push 0x1a8
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.004857c0
add esp, 0xc
mov dword [ebp - 0x1b0], 0x1a8
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, dword [ebp - 0x3f4]
call fcn.004c8380
test eax, eax
je 0x4c89e3
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.00481c50
add esp, 8
add eax, 1
mov dword [ebp - 0x1bc], eax
push 0x5c
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.00481c50
add esp, 8
sub eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 8
jb 0x4c87a9
mov dword [ebp - 0x1c0], 7
mov ecx, dword [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1c8]
push eax
call fcn.00481b30
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.00481c50
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSetEnumDISPLAY_
lea edi, [ebp - 0x2d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xdd
push 0
lea edx, [ebp - 0x2b1]
push edx
call fcn.004857c0
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00481c50
add esp, 8
sub eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call fcn.00481b50
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00481c50
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x2d8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c89e3
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0x104
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4c89d6
lea edx, [ebp - 0x2ec]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c89c2
mov dword [ebp - 0x2e8], 0x104
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push str.Driver
mov ecx, dword [ebp - 0x2ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c89b5
mov edx, dword [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x2d8]
push eax
call fcn.00483930
add esp, 8
test eax, eax
jne 0x4c89b5
lea ecx, [ebp - 0x2f0]
push ecx
push 0x20019
push 0
push str.Device_Parameters
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c89b5
mov dword [ebp - 0x2e8], pe_nt_image_headers32
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
push 0
push 0
push str.EDID
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c89a8
lea eax, [ebp - 0x3f0]
push eax
mov ecx, dword [ebp - 0x3f4]
call fcn.004c8460
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
jmp 0x4c888f
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret