Function at 0x642aca
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x94
mov eax, 0x6fe5b6
call fcn.00648b50
mov ebx, ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x6c], ebx
xor edi, edi
mov dword [ebp - 0x98], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
call fcn.00557a39
mov dword [ebx], eax
push 2
push edi
push edi
push 0x71eee0
mov dword [ebp - 4], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov esi, eax
lea ecx, [ebp - 0x44]
push esi
call fcn.005db952
mov byte [ebp - 4], 1
call fcn.00515e26
push eax
lea ecx, [ebp - 0x50]
call fcn.00515c3a
push esi
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push str.enumerator_handle:_0x_Xh
push eax
call fcn.0051647b
mov esi, dword [ebp - 0x50]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x642b54
push dword [esi - 0xc]
lea ecx, [ebp - 0x50]
call fcn.005158ea
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], esi
push eax
push str.Monitor__s
push 0x2bc
call fcn.00519db0
mov ecx, eax
call fcn.00526b8b
lea ecx, [ebp - 0x44]
call fcn.005db9e4
test eax, eax
je 0x642ef7
push 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.005dba03
push 9
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x44]
call fcn.005dba03
mov byte [ebp - 4], 4
lea eax, [ebp - 0x50]
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push str.HardwareId:__s__t_DriverId:__s
push eax
call fcn.0051647b
mov esi, dword [ebp - 0x50]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x642bd3
push dword [esi - 0xc]
lea ecx, [ebp - 0x50]
call fcn.005158ea
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], esi
push eax
push str.Monitor__s
push 0x2bc
call fcn.00519db0
mov ecx, eax
call fcn.00526b8b
mov eax, dword [ebp - 0x48]
cmp dword [eax - 0xc], 0
mov eax, dword [ebp - 0x4c]
je 0x642eca
cmp dword [eax - 0xc], 0
je 0x642eca
call fcn.00515e26
push eax
lea ecx, [ebp - 0x54]
call fcn.00515c3a
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push str._s_s
push eax
call fcn.0051647b
add esp, 0x10
lea ecx, [ebp - 0x54]
call fcn.00535f94
call fcn.00515e26
push eax
lea ecx, [ebp - 0x70]
call fcn.00515c3a
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x44]
call fcn.005dbc42
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x58]
cmp dword [eax - 0xc], 0
jne 0x642c8f
lea ecx, [eax - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
jmp 0x642ecd
lea eax, [ebp - 0x58]
mov edx, str.SYSTEMCurrentControlSetEnum_
push eax
lea ecx, [ebp - 0x90]
call fcn.00534752
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8c]
mov edx, eax
mov dword [esp], str.Device_Parameters
call fcn.005347ac
pop ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 9
call fcn.005154cf
mov ecx, dword [ebp - 0x8c]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x90]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
push 0x20019
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7c]
mov ebx, dword [ebp - 0x70]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0051e4ac
test eax, eax
je 0x642d27
lea ecx, [ebp - 0x7c]
call fcn.0051e50a
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebx - 0x10]
jmp 0x642c74
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], edi
push eax
push edi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 3
push eax
push edi
push str.EDID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x60], 0x80
jb 0x642d0c
push dword [ebp - 0x60]
call fcn.006484f2
mov edi, eax
pop ecx
mov dword [ebp - 0x94], edi
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0xb
push eax
push edi
lea eax, [ebp - 0x64]
push eax
push 0
push str.EDID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x642ddd
call fcn.00515e26
push eax
lea ecx, [ebp - 0x5c]
call fcn.00515c3a
lea ecx, [edi + 0x36]
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x5c]
call fcn.00642a89
test al, al
jne 0x642e0a
lea ecx, [edi + 0x48]
lea edx, [ebp - 0x5c]
call fcn.00642a89
test al, al
jne 0x642e0a
lea ecx, [edi + 0x5a]
lea edx, [ebp - 0x5c]
call fcn.00642a89
test al, al
jne 0x642e0a
lea ecx, [edi + 0x6c]
lea edx, [ebp - 0x5c]
call fcn.00642a89
test al, al
jne 0x642e0a
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
push edi
call fcn.006484ed
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.0051e50a
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx - 0x10]
jmp 0x642ea7
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x6c], eax
call fcn.00515476
add eax, 0x10
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x68], eax
call fcn.00515476
add eax, 0x10
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x84]
push dword [ebp - 0x94]
push eax
push ecx
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0xa0]
push eax
call fcn.00642fa6
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x84]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x68]
call fcn.00515ed6
push edi
call fcn.006484ed
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.0051e50a
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebx - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x6c]
call fcn.00515ed6
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
xor edi, edi
jmp 0x642ee1
lea ecx, [eax - 0x10]
call fcn.00515ed6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebp - 0x44]
call fcn.005db9e4
test eax, eax
jne 0x642b81
mov ebx, dword [ebp - 0x88]
lea ecx, [esi - 0x10]
call fcn.00515ed6
push dword [ebp - 0x44]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
lea ecx, [ebp - 0x20]
call fcn.005a1d9c
mov eax, ebx
call fcn.00648afa
ret