Function at 0x409610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.00581a30
mov eax, dword [0x5d5de8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x1c]
test eax, eax
push ebx
push esi
mov byte [edi + 0xba], 1
jne 0x409649
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005697e2
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x1028]
push edx
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.Version
mov ebx, 4
push eax
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x409637
cmp dword [ebp - 0x1028], 2
jne 0x409637
lea edx, [ebp - 0x101c]
push edx
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0x1024], eax
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.MinVidMemory
push edx
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x409637
mov eax, dword [ebp - 0x1024]
cmp eax, dword [edi + 0xb0]
jne 0x409637
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x102c]
push edx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0x102c], 0
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], ebx
call esi
test eax, eax
jne 0x409637
mov edx, dword [ebp - 0x102c]
cmp edx, dword [edi + 0xb4]
jne 0x409637
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [edi + 0x1c]
lea ecx, [ebp - 0x1018]
push ecx
lea edx, [ebp - 0x1020]
push edx
push 0
push str.DisplayGUID
mov ebx, 0x10
push eax
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1020], 3
call esi
test eax, eax
jne 0x409637
cmp dword [ebp - 0x101c], ebx
jne 0x409637
mov eax, ebx
lea ecx, [edi + 0x20]
lea edx, [ebp - 0x1018]
lea esp, [esp]
mov ebx, dword [edx]
cmp ebx, dword [ecx]
jne 0x4097a8
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x409790
test eax, eax
je 0x409811
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x4097f7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x40980b
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x4097f7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x40980b
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x4097f7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x40980b
movzx ecx, byte [ecx]
movzx esi, byte [edx]
sub esi, ecx
je 0x40980b
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 1
jg 0x409813
or eax, 0xffffffff
jmp 0x409813
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
test eax, eax
jne 0x409637
lea edx, [ebp - 0x101c]
push edx
mov edx, dword [edi + 0x1c]
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1020]
push ecx
push 0
push str.FailureReason
mov ebx, 0x1000
push edx
mov dword [ebp - 0x1020], 1
mov dword [ebp - 0x101c], ebx
call esi
test eax, eax
jne 0x409637
lea eax, [ebp - 0x1008]
push eax
lea ecx, [edi + 0x78]
call fcn.00438a40
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.Warning
push ecx
mov dword [ebp - 0x1020], 1
mov dword [ebp - 0x101c], ebx
call esi
test eax, eax
jne 0x409637
lea edx, [ebp - 0x1008]
push edx
lea ecx, [edi + 0x94]
call fcn.00438a40
cmp dword [edi + 0x8c], 0
mov ecx, dword [ebp - 4]
sete al
pop esi
xor ecx, ebp
mov byte [edi + 0xba], 0
pop ebx
call fcn.005697e2
mov esp, ebp
pop ebp
ret