Function at 0x100045d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x5a0
mov eax, dword [esp + 0x5a8]
push ebx
push ebp
push esi
push edi
xor edi, edi
push str.Driver_
push eax
mov dword [esp + 0x270], 0x348
mov dword [esp + 0x24], edi
call sub.MSVCRT.dll_wcscpy
mov ebp, dword [esp + 0x5bc]
mov esi, dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
add esp, 8
lea ecx, [esp + 0x268]
mov eax, ebp
inc ebp
push edi
push ecx
push eax
push edi
call esi
test eax, eax
je 0x10004644
mov al, byte [esp + 0x3ac]
test al, 1
je 0x10004630
test al, 8
je 0x10004652
lea edx, [esp + 0x268]
mov eax, ebp
push edi
push edx
push eax
push edi
inc ebp
call esi
test eax, eax
jne 0x10004621
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x5a0
ret
push str.RegistryMachine_
call sub.MSVCRT.dll_wcslen
lea esi, [esp + eax*2 + 0x4b4]
lea eax, [esp + 0xac]
push esi
push eax
call sub.MSVCRT.dll_wcscpy
lea ecx, [esp + 0xb4]
push str.VolatileSettings
push ecx
call sub.MSVCRT.dll_wcscat
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x14
lea edx, [esp + 0x10]
lea eax, [esp + 0xa8]
push edx
push 0x20019
push edi
push eax
push 0x80000002
mov dword [esp + 0x24], edi
call ebx
test eax, eax
jne 0x100047ef
mov ecx, 0x40
lea edi, [esp + 0xa8]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xa8]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.5b45201d_f2f2_4f3b_85bb_30ff1f953599
push ecx
mov dword [esp + 0x2c], 0x100
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xa8]
cmp word [eax], 0x23
jne 0x1000470b
mov word [eax], 0x20
add eax, 2
cmp word [eax], 0
jne 0x10004700
lea eax, [esp + 0x1e8]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x1ac]
push ecx
push edx
lea eax, [esp + 0xb4]
push str.___ws__ws__ws
push eax
call sub.MSVCRT.dll_swscanf
lea ecx, [esp + 0x1fc]
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x1c0]
push edx
push eax
lea ecx, [esp + 0xc8]
push str.SystemCurrentControlSetEnum_ws_ws_ws
push ecx
call sub.MSVCRT.dll_swprintf
add esp, 0x28
lea edx, [esp + 0x10]
lea eax, [esp + 0xa8]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x10004885
mov ecx, 0x20
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.Service
push ecx
mov dword [esp + 0x2c], 0x80
call esi
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10004885
mov ecx, dword [esp + 0x5b8]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5a0
ret
lea edx, [esp + 0x4b0]
push 0x5c
push edx
call sub.MSVCRT.dll_wcsrchr
push str.Video
push eax
call sub.MSVCRT.dll_swprintf
add esp, 0x10
lea eax, [esp + 0x18]
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
push eax
push 0x20019
push edi
push esi
push 0x80000002
call ebx
test eax, eax
jne 0x10004885
mov ecx, 0x20
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
push eax
push 0
push str.Service
push ecx
mov dword [esp + 0x3c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x18]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10004885
mov ecx, dword [esp + 0x5b8]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x5a0
ret