Function at 0x402ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a8
mov eax, dword [0x424010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, str.Driver_
mov edx, eax
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x58c], 0x348
sub edx, ecx
mov dword [ebp - 0x5a0], 0
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402b10
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x58c]
push esi
mov esi, dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
push 0
push eax
push ebx
push 0
call esi
test eax, eax
je 0x402b61
lea ecx, [ecx]
mov eax, dword [ebp - 0x448]
inc ebx
test al, 1
je 0x402b4f
test al, 8
je 0x402b74
push 0
lea eax, [ebp - 0x58c]
push eax
push ebx
push 0
call esi
test eax, eax
jne 0x402b40
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
xor ecx, ecx
jmp 0x402b80
movzx eax, word [ebp + ecx - 0x320]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x186], ax
test ax, ax
jne 0x402b80
push edi
lea edi, [ebp - 0x184]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402ba2
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x184]
mov ecx, 9
mov esi, str.VolatileSettings
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000002
call edi
test eax, eax
jne 0x402db6
push 0x100
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x598], 0x100
push eax
call fcn.00407e30
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x598]
add esp, 0xc
push eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x5a0]
push eax
push 0
push str.5b45201d_f2f2_4f3b_85bb_30ff1f953599
push dword [ebp - 0x590]
call esi
push dword [ebp - 0x590]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x184]
mov ecx, 0x20
mov edi, edi
cmp word [eax], 0x23
jne 0x402c59
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x402c50
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x184]
push str.___ws__ws__ws
push eax
call fcn.00408022
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x184]
push str.SystemCurrentControlSetEnum_ws_ws_ws
push eax
call fcn.00403970
add esp, 0x28
lea eax, [ebp - 0x590]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x184]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x402ea2
push 0x80
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x598], 0x80
push eax
call fcn.00407e30
add esp, 0xc
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x5a0]
push eax
push 0
push str.Service
push dword [ebp - 0x590]
call esi
push dword [ebp - 0x590]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402d6a
lea edx, [ebp - 0x84]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402d32
mov edi, dword [ebp - 0x594]
sub edx, esi
add edi, 0xfffffffe
jmp 0x402d50
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402d50
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [section..data], 4
ja 0x402ea2
push 0x5c
push str.DevUtil.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x402d9e
push dword [ebp - 0x594]
inc eax
push ebx
push str._d.__ws
push 0x5e
jmp 0x402f34
push dword [ebp - 0x594]
mov eax, str.DevUtil.cpp
push ebx
push str._d.__ws
push 0x5e
jmp 0x402f34
lea eax, [ebp - 0x344]
push 0x5c
push eax
call fcn.00407ec0
mov esi, eax
push str.Video
push esi
call fcn.00403970
add esp, 0x10
mov dword [ebp - 0x5a8], 0
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x320]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x402eb5
push 0x80
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x5a4], 0x80
push eax
call fcn.00407e30
add esp, 0xc
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x5a8]
push eax
push 0
push str.Service
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x59c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402ea2
lea edx, [ebp - 0x84]
mov esi, edx
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402e70
mov ecx, dword [ebp - 0x594]
sub edx, esi
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x402e86
mov edi, ecx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x344]
push 0x5c
push eax
call fcn.00407ec0
add esp, 8
test eax, eax
je 0x402f57
lea edx, [eax + 2]
mov esi, edx
jmp 0x402ee0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402ee0
mov edi, dword [ebp - 0x594]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402ef6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [section..data], 4
ja 0x402ea2
push dword [ebp - 0x594]
push ebx
push str._d.__ws
push 0x7d
push str.DevUtil.cpp
call fcn.00401680
add esp, 4
push eax
push str.RsupS
push 4
call fcn.004024a0
add esp, 0x1c
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407810
mov esp, ebp
pop ebp
ret
push 0x5c
push str.DevUtil.cpp
call fcn.00406f30
add esp, 8
test eax, eax
je 0x402f6d
inc eax
jmp 0x402f72
mov eax, str.DevUtil.cpp
push str.cant_find_driver_name_n
push 0x81
push eax
push str.RsupS
push 6
call fcn.004024a0
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00407810
mov esp, ebp
pop ebp
ret