Function at 0x4be700
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x50518c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3f4], ecx
push 0x1a8
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.0049c4d0
add esp, 0xc
mov dword [ebp - 0x1b0], 0x1a8
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, dword [ebp - 0x3f4]
call fcn.004be340
test eax, eax
je 0x4be9e3
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.00481430
add esp, 8
add eax, 1
mov dword [ebp - 0x1bc], eax
push 0x5c
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.00481430
add esp, 8
sub eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 8
jb 0x4be7a9
mov dword [ebp - 0x1c0], 7
mov ecx, dword [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1c8]
push eax
call fcn.00481320
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.00481430
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSetEnumDISPLAY_
lea edi, [ebp - 0x2d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xdd
push 0
lea edx, [ebp - 0x2b1]
push edx
call fcn.0049c4d0
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00481430
add esp, 8
sub eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call fcn.00481340
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00481430
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x2d8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4be9e3
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0x104
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4be9d6
lea edx, [ebp - 0x2ec]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4be9c2
mov dword [ebp - 0x2e8], 0x104
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push str.Driver
mov ecx, dword [ebp - 0x2ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4be9b5
mov edx, dword [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x2d8]
push eax
call fcn.0049b800
add esp, 8
test eax, eax
jne 0x4be9b5
lea ecx, [ebp - 0x2f0]
push ecx
push 0x20019
push 0
push str.Device_Parameters
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4be9b5
mov dword [ebp - 0x2e8], pe_nt_image_headers32
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
push 0
push 0
push str.EDID
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4be9a8
lea eax, [ebp - 0x3f0]
push eax
mov ecx, dword [ebp - 0x3f4]
call fcn.004be460
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
jmp 0x4be88f
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0fe3
mov esp, ebp
pop ebp
ret