Function at 0x4095b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.005ca380
mov eax, dword [0x6396a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x1c]
test eax, eax
push ebx
push esi
mov byte [edi + 0xba], 1
jne 0x4095e9
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2f9b
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x1028]
push edx
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.Version
mov ebx, 4
push eax
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x4095d7
cmp dword [ebp - 0x1028], 2
jne 0x4095d7
lea edx, [ebp - 0x101c]
push edx
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0x1024], eax
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.MinVidMemory
push edx
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x4095d7
mov eax, dword [ebp - 0x1024]
cmp eax, dword [edi + 0xb0]
jne 0x4095d7
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x102c]
push edx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0x102c], 0
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x4095d7
mov edx, dword [ebp - 0x102c]
cmp edx, dword [edi + 0xb4]
jne 0x4095d7
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [edi + 0x1c]
lea ecx, [ebp - 0x1018]
push ecx
lea edx, [ebp - 0x1020]
push edx
push 0
push str.DisplayGUID
mov ebx, 0x10
push eax
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], 3
call esi
test eax, eax
jne 0x4095d7
cmp dword [ebp - 0x101c], ebx
jne 0x4095d7
mov eax, ebx
lea ecx, [edi + 0x20]
lea edx, [ebp - 0x1018]
lea esp, [esp]
mov ebx, dword [edx]
cmp ebx, dword [ecx]
jne 0x409748
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x409730
test eax, eax
je 0x4097b1
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x409797
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4097ab
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x409797
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4097ab
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x409797
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4097ab
movzx ecx, byte [ecx]
movzx esi, byte [edx]
sub esi, ecx
je 0x4097ab
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 1
jg 0x4097b3
or eax, 0xffffffff
jmp 0x4097b3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
test eax, eax
jne 0x4095d7
lea edx, [ebp - 0x101c]
push edx
mov edx, dword [edi + 0x1c]
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.FailureReason
mov ebx, 0x1000
push edx
mov dword [ebp - 0x1020], 1
mov dword [ebp - 0x101c], ebx
call esi
test eax, eax
jne 0x4095d7
lea eax, [ebp - 0x1008]
push eax
lea ecx, [edi + 0x78]
call fcn.0043b530
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.Warning
push ecx
mov dword [ebp - 0x1020], 1
mov dword [ebp - 0x101c], ebx
call esi
test eax, eax
jne 0x4095d7
lea edx, [ebp - 0x1008]
push edx
lea ecx, [edi + 0x94]
call fcn.0043b530
cmp dword [edi + 0x8c], 0
mov ecx, dword [ebp - 4]
sete al
pop esi
xor ecx, ebp
mov byte [edi + 0xba], 0
pop ebx
call fcn.005b2f9b
mov esp, ebp
pop ebp
ret