Function at 0x42b370
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1a96
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x460], edx
mov eax, ecx
mov dword [ebp - 0x45c], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [eax], 0
lea eax, [ebp - 0x444]
push eax
push str.SYSTEMCurrentControlSetEnumDISPLAY
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [edx], 0
call esi
test eax, eax
jne 0x42b696
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x400
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x410]
push eax
push 0
push dword [ebp - 0x444]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x42b68e
lea esp, [esp]
inc dword [ebp - 0x454]
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x444]
call esi
test eax, eax
jne 0x42b668
push 0x400
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x410]
push eax
push 0
push dword [ebp - 0x448]
call ebx
cmp eax, 0x103
je 0x42b660
jmp 0x42b460
inc dword [ebp - 0x458]
cmp byte [ebp - 0x410], 0
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
jne 0x42b48e
xor ecx, ecx
jmp 0x42b4a0
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42b497
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.00403860
push 4
push 0
push str.UID
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0
call fcn.00419240
cmp eax, 0xffffffff
je 0x42b61c
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x448]
call esi
test eax, eax
jne 0x42b61c
push 0x400
lea eax, [ebp - 0x410]
xor esi, esi
push eax
push esi
push dword [ebp - 0x44c]
call ebx
cmp eax, 0x103
je 0x42b60e
jmp 0x42b520
inc esi
mov dword [ebp - 0x414], 0xf
cmp byte [ebp - 0x410], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
jne 0x42b549
xor eax, eax
jmp 0x42b55b
lea eax, [ebp - 0x410]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b552
sub eax, edx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.00403860
push 0x11
push 0
push str.Device_Parameters
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.00419240
cmp eax, 0xffffffff
je 0x42b5d3
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42b5d3
push dword [ebp - 0x460]
mov edx, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x450]
call fcn.0042b280
add esp, 4
push dword [ebp - 0x450]
test al, al
jne 0x42b6b4
call edi
mov byte [ebp - 4], 0
cmp dword [ebp - 0x414], 0x10
jb 0x42b5ee
push dword [ebp - 0x428]
call fcn.004a78e3
add esp, 4
push 0x400
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x44c]
call ebx
cmp eax, 0x103
jne 0x42b520
push dword [ebp - 0x44c]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x42c], 0x10
jb 0x42b63a
push dword [ebp - 0x440]
call fcn.004a78e3
add esp, 4
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x458]
push eax
push dword [ebp - 0x448]
call ebx
cmp eax, 0x103
jne 0x42b460
push dword [ebp - 0x448]
call edi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x454]
push eax
push dword [ebp - 0x444]
call ebx
cmp eax, 0x103
jne 0x42b410
push dword [ebp - 0x444]
call edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
call edi
push dword [ebp - 0x44c]
call edi
push dword [ebp - 0x448]
call edi
push dword [ebp - 0x444]
call edi
cmp dword [ebp - 0x414], 0x10
jb 0x42b6e5
push dword [ebp - 0x428]
call fcn.004a78e3
add esp, 4
cmp dword [ebp - 0x42c], 0x10
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
jb 0x42b717
push dword [ebp - 0x440]
call fcn.004a78e3
add esp, 4
mov al, 1
jmp 0x42b698