Function at 0x402830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e348
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5a6f30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00421f47
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.004266c7
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x402911
call fcn.0041359d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40289c
push 0x80004005
call fcn.004022a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x28], esi
push 0x65
mov dword [ebp - 4], 0
call fcn.004269a6
test eax, eax
je 0x4028c9
push 0x65
push eax
lea ecx, [ebp - 0x28]
call fcn.00403ae0
mov esi, dword [ebp - 0x28]
cmp dword [esi - 0xc], 0
je 0x4028f0
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [ebp - 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402911
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0x12c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0x12c]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push 0
push 0x80
push 0x40000
mov ecx, ebx
call fcn.00412df1
lea eax, [ebp - 0x28]
push eax
push 0x20219
push 0
push str.SYSTEMCurrentControlSetServicesNamSvcVideo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4029bc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.video_x
push dword [ebp - 0x28]
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4029b7
call esi
push dword [ebp - 0x28]
call edi
lea eax, [ebp - 0x28]
push eax
push 0x20219
push 0
push str.SYSTEMCurrentControlSetServicesNamSvcVideo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a1e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.video_y
push dword [ebp - 0x28]
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402a19
call esi
push dword [ebp - 0x28]
call edi
lea eax, [ebp - 0x28]
push eax
push 0x20219
push 0
push str.SYSTEMCurrentControlSetServicesNamSvcVideo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a80
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push str.video_time
push dword [ebp - 0x28]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402a7b
call esi
push dword [ebp - 0x28]
call edi
push 0
push 0
push 0xc00000
mov ecx, ebx
call fcn.00412dc7
push 0
push 0
push 1
mov ecx, ebx
call fcn.00412dc7
push 0x26
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x20]
push 0
push 0
push 0
call fcn.0041310f
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
add eax, 3
imul eax, eax, 0x3e8
push 0
push eax
push 1
push dword [ebx + 0x20]
call esi
push 0
push 0x3e8
push 2
push dword [ebx + 0x20]
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052710c
mov esp, ebp
pop ebp
ret