Function at 0x40be70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0xd2
xor ebp, ebp
sub esp, 0x6dc
lea ebx, [esp + 0x388]
mov esi, dword [esp + 0x6f0]
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x6f4]
mov dword [esp + 0x388], 0x348
mov edi, dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
mov dword [eax], 0
mov eax, dword [esp + 0x6f8]
mov dword [eax], 0
jmp 0x40bed4
mov eax, dword [esp + 0x4cc]
and eax, 3
cmp eax, 3
je 0x40bef0
add ebp, 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
jne 0x40bec2
xor ebx, ebx
cmp word [esp + 0x4d0], 0
jne 0x40bf10
add esp, 0x6dc
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x4d0]
mov dword [esp + 4], 0x5c
mov dword [esp], ebp
call fcn.005e72d0
lea edi, [eax + 2]
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call fcn.005e72d0
sub eax, edi
mov dword [esp + 4], edi
lea edi, [esp + 0x180]
mov esi, eax
lea eax, [esp + 0x5c]
sar esi, 1
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.005e7290
xor eax, eax
mov word [esp + esi*2 + 0x5c], ax
mov dword [esp], ebp
mov esi, 0x71b5dc
mov dword [esp + 4], 0x5c
call fcn.005e72d0
mov ecx, 0x13
lea ebp, [eax + 2]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x6e
mov word [esp + 0x1ce], dx
movzx eax, word [esi]
lea esi, [esp + 0x180]
mov word [edi], ax
lea edi, [esp + 0x1d0]
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x5c
mov dword [esp], ebp
call fcn.005e72d0
sub eax, ebp
mov dword [esp + 4], ebp
mov dword [esp], esi
sar eax, 1
mov dword [esp + 8], eax
call fcn.005e7298
mov dword [esp + 4], 0x5c
mov dword [esp], ebp
call fcn.005e72d0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp], 0x80000002
mov dword [esp + 0x24], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x40c121
mov dword [esp + 0x34], 0x104
lea ebp, [esp + 0x40]
lea edi, [esp + 0x34]
jmp 0x40c033
add ebx, 1
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
jne 0x40c111
lea eax, [esp + 0x38]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [esp + 0x24]
sub esp, 0x14
test eax, eax
jne 0x40c030
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x71b58e
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40c100
mov eax, dword [esp + 0x28]
mov dword [esp], esi
add eax, 2
mov dword [esp + 4], eax
call fcn.005e72c8
test eax, eax
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40c130
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call edx
sub esp, 4
jmp 0x40c030
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x6dc
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], 0x71b59c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [esp + 0x24]
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x40c100
lea eax, [esp + 0x80]
mov dword [esp + 0x34], 0x100
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0x71b5c0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c291
movsx eax, byte [esp + 0x88]
movzx ecx, byte [esp + 0x89]
mov dword [esp + 4], 0x71b5ca
mov edx, eax
sar edx, 2
and edx, 0x1f
add edx, 0x40
mov word [esp + 0x4a], dx
lea edx, [eax*8]
mov eax, ecx
shr eax, 5
and eax, 7
and edx, 0x18
or edx, eax
mov eax, ecx
add edx, 0x40
and eax, 0x1f
mov word [esp + 0x4c], dx
movzx edx, byte [esp + 0x8a]
add eax, 0x40
mov word [esp + 0x4e], ax
movzx eax, byte [esp + 0x8b]
mov ecx, edx
shr dl, 4
movzx edx, dl
and ecx, 0xf
mov dword [esp + 0x10], edx
mov edx, eax
shr al, 4
and edx, 0xf
movzx eax, al
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea edx, [esp + 0x4a]
lea eax, [esp + 0x50]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x5c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005e72c8
test eax, eax
jne 0x40c291
movzx eax, byte [esp + 0x96]
mov edx, dword [esp + 0x6f4]
mov ebx, 1
mov dword [edx], eax
movzx eax, byte [esp + 0x95]
mov edx, dword [esp + 0x6f8]
mov dword [edx], eax
jmp 0x40befd
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call edx
sub esp, 4
mov edx, dword [esp + 0x2c]
jmp 0x40c100