Function at 0x615152
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x254
mov eax, 0x6e94f5
call fcn.00648bbe
mov esi, ecx
mov dword [ebp - 0x17c], esi
lea eax, [esi + 0xc]
push str.NewTreeVideo::Device::CheckSetupApi
push eax
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x174], eax
call fcn.005a14e8
push 2
pop eax
push eax
xor ebx, ebx
push ebx
push ebx
push 0x71eea0
mov dword [ebp - 4], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov dword [ebp - 0x218], eax
mov eax, fcn.00617d54
mov dword [ebp - method.aim::common::shared_handle_void__.virtual_0], vtable.aim::common::shared_handle_void__.0
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x6151cc
push 2
pop edx
push edx
lea eax, [ebp - 0x208]
push eax
push eax
call fcn.00617d54
add esp, 0xc
mov eax, dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1a4], ecx
cmp eax, ebx
je 0x6151f3
mov dword [ebp - 0x208], eax
mov eax, 0x76f560
or eax, ecx
mov dword [ebp - 0x210], eax
jmp 0x6151f9
mov dword [ebp - 0x210], ebx
push 4
mov byte [ebp - 4], cl
call fcn.006484ac
pop ecx
mov dword [eax], 1
mov dword [ebp - 0x1f0], eax
push 2
pop eax
mov byte [ebp - 4], al
mov ecx, 0x1002
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x194], eax
cmp cx, ax
jne 0x615233
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov esi, dword [ebp - 0x174]
lea edi, [ebp - 0x2c]
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x30], 0x1c
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov edx, ebx
lea ecx, [ebp - 0x30]
mov eax, edx
push ecx
push eax
push dword [ebp - 0x218]
inc edx
mov dword [ebp - 0x174], edx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x6159a8
mov ecx, dword [esi]
push 0x61e
call fcn.005adba9
push ebx
push 4
lea eax, [ebp - 0x1b8]
push eax
push ebx
push 0x15
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x218]
call edi
mov ecx, dword [esi]
call fcn.005adb40
mov ecx, dword [esi]
push 0x622
call fcn.005adba9
push ebx
push 4
lea eax, [ebp - 0x1bc]
push eax
push ebx
push 0x1c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x218]
call edi
mov ecx, dword [esi]
call fcn.005adb40
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
and ecx, 0x1f
and eax, 3
shl ecx, 3
or ecx, eax
mov eax, dword [edx]
mov edx, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x1b8]
jne 0x615252
cmp dword [ebp - 0x1bc], ecx
jne 0x615252
mov ecx, dword [esi]
push 0x62d
call fcn.005adba9
lea eax, [ebp - 0x188]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x218]
call edi
mov ecx, dword [esi]
call fcn.005adb40
mov ecx, dword [esi]
push 0x631
call fcn.005adba9
push dword [ebp - 0x188]
mov ecx, dword [ebp + 0xc]
call fcn.005159ef
push ebx
push dword [ebp - 0x188]
push eax
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x218]
call edi
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov byte [ebp - 4], 3
call fcn.0051d5f9
push 2
pop eax
mov byte [ebp - 4], al
mov ecx, dword [esi]
call fcn.005adb40
mov ecx, dword [esi]
push 0x636
call fcn.005adba9
xor eax, eax
mov edi, 0x20019
push edi
inc eax
push eax
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [ebp - 0x258], eax
mov eax, fcn.00617d18
mov dword [ebp - method.aim::common::shared_handle_struct_HKEY____.virtual_0], vtable.aim::common::shared_handle_struct_HKEY____.0
mov dword [ebp - 0x250], ebx
test eax, eax
je 0x6153d0
push 2
pop eax
push eax
lea eax, [ebp - 0x248]
push eax
push eax
call fcn.00617d18
add esp, 0xc
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6153ef
mov dword [ebp - 0x248], eax
mov eax, 0x76f568
or eax, 1
mov dword [ebp - 0x250], eax
jmp 0x6153f5
mov dword [ebp - 0x250], ebx
push 4
mov byte [ebp - 4], 4
call fcn.006484ac
pop ecx
mov dword [eax], 1
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi]
call fcn.005adb40
lea eax, [ebp - 0x188]
mov dword [ebp - 0x1c0], ebx
push eax
lea eax, [ebp - 0x170]
mov dword [ebp - 0x188], 0x80
push eax
lea eax, [ebp - 0x1c0]
push eax
push ebx
push str.VideoID
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.SYSTEMCurrentControlSetControlVideo_
lea ecx, [ebp - 0x1c4]
call fcn.00515719
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x190]
call fcn.005347ac
pop ecx
mov ecx, dword [ebp - 0x1c4]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x190]
call fcn.0058e340
neg eax
lea ecx, [ebp - 0x1b4]
sbb eax, eax
and eax, 0x100
or eax, edi
push eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0051e4ac
test eax, eax
je 0x6154fb
push eax
push 0x64a
push str.VideoNewTreeVideoDevice.cpp
lea ecx, [ebp - 0x90]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0x90]
push eax
call fcn.00671426
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x180]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x615545
push eax
push 0x64d
push str.VideoNewTreeVideoDevice.cpp
lea ecx, [ebp - 0xf0]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0xf0]
jmp 0x6154f5
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
push 2
inc eax
mov dword [ebp - 0x180], ebx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006484f2
mov esi, eax
pop ecx
mov dword [ebp - 0x224], esi
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x18c]
mov edi, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x184], eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x184]
push eax
push esi
push dword [ebp - 0x180]
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x61591f
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x1cc]
inc dword [ebp - 0x180]
mov edx, str.Registry_key:
inc eax
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x190]
push eax
call fcn.00534752
pop ecx
push 0x741508
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c8]
call fcn.005347ac
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x178]
call fcn.005347ac
pop ecx
mov ecx, dword [ebp - 0x1c8]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1cc]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov eax, 0x1002
cmp ax, word [ebp - 0x194]
jne 0x615640
call fcn.005a79dd
lea eax, [ebp - 0x178]
push eax
call fcn.005a4618
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
push 0x741508
lea edx, [ebp - 0x190]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1d4]
call fcn.005347ac
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1d0]
call fcn.005347ac
pop ecx
mov byte [ebp - 4], 0x13
mov ebx, dword [eax]
call fcn.0058e340
neg eax
lea ecx, [ebp - 0x1a0]
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0051e4ac
mov ecx, dword [ebp - 0x1d0]
test eax, eax
setne bl
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1d4]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
test bl, bl
je 0x6156f8
lea ecx, [ebp - 0x1a0]
call fcn.0051e50a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x178]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
xor ebx, ebx
jmp 0x615586
mov ecx, 0x200
mov dword [ebp - 0x1d8], ecx
push ecx
lea ecx, [edi + 0x90]
call fcn.005159ef
lea ecx, [ebp - 0x1d8]
push ecx
push eax
push str.HardwareInformation.BiosString
lea ecx, [ebp - 0x1a0]
call fcn.005567c2
test eax, eax
setne bl
push 0xffffffffffffffff
lea ecx, [edi + 0x90]
mov byte [ebp - 4], 0x14
call fcn.0051d5f9
mov byte [ebp - 4], 0x11
test bl, bl
jne 0x6156d4
push 8
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [edi + 0x90]
call fcn.00514f5d
push 0x76f324
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0052d86b
mov byte [ebp - 4], 0x11
test eax, eax
mov ecx, dword [ebp - 0x1dc]
sete bl
lea ecx, [ecx - 0x10]
call fcn.00515ed6
test bl, bl
je 0x6157bf
lea ebx, [edi + 0x90]
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax - 0xc]
add eax, 0xfffffff8
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.0058efe6
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x16
call fcn.005154cf
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1e0]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
xor ebx, ebx
lea eax, [ebp - 0x17c]
push eax
push ebx
push ebx
push ebx
push str.HardwareInformation.MemorySize
push dword [ebp - 0x1a0]
mov dword [ebp - 0x17c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x615849
mov eax, 0x1002
cmp ax, word [ebp - 0x194]
jne 0x615827
push str.Retrieving_memory_size_from_registry_fail
lea ecx, [ebp - 0x174]
call fcn.00519ebc
mov byte [ebp - 4], 0x17
call fcn.005a79dd
lea eax, [ebp - 0x174]
push eax
call fcn.005a4618
mov ecx, dword [ebp - 0x174]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebp - 0x1a0]
call fcn.0051e50a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x178]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
jmp 0x615586
cmp dword [ebp - 0x17c], 4
je 0x61587c
cmp dword [ebp - 0x17c], 8
jne 0x6158aa
lea eax, [ebp - 0x17c]
push eax
lea eax, [edi + 0x78]
push eax
push str.HardwareInformation.MemorySize
lea ecx, [ebp - 0x1a0]
call fcn.005567c2
test eax, eax
je 0x6158aa
jmp 0x615827
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x1a8]
push eax
push str.HardwareInformation.MemorySize
lea ecx, [ebp - 0x1a0]
call fcn.005567c2
test eax, eax
jne 0x615827
mov eax, dword [ebp - 0x1a8]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ebx
call fcn.00515e26
push eax
lea ecx, [ebp - 0x174]
call fcn.00515c3a
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x174]
push dword [edi + 0x7c]
push dword [edi + 0x78]
push str.Registry_memory_size:__d_bytes.
push eax
call fcn.0051647b
mov eax, 0x1002
add esp, 0x10
cmp ax, word [ebp - 0x194]
jne 0x6158f8
call fcn.005a79dd
lea eax, [ebp - 0x174]
push eax
call fcn.005a4618
mov ecx, dword [ebp - 0x174]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [ebp - 0x1a0]
call fcn.0051e50a
mov ecx, dword [ebp - 0x178]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
push esi
call fcn.006484ed
pop ecx
lea ecx, [ebp - 0x1b4]
call fcn.0051e50a
jmp 0x615971
mov ecx, dword [ebp - 0x190]
add ecx, 0xfffffff0
call fcn.00515ed6
lea ecx, [ebp - 0x260]
call fcn.00617540
lea ecx, [ebp - 0x220]
call fcn.006174f2
lea ecx, [ebp - 0x1e8]
call fcn.005a1446
mov al, byte [ebp - 0x1a4]
jmp 0x615a01
mov eax, 0x1002
cmp ax, word [ebp - 0x194]
jne 0x6159e9
push str.Didnt_find_anything_in_registry
lea ecx, [ebp - 0x184]
call fcn.00519ebc
mov byte [ebp - 4], 0x1c
call fcn.005a79dd
lea eax, [ebp - 0x184]
push eax
call fcn.005a4618
mov eax, dword [ebp - 0x184]
lea ecx, [eax - 0x10]
call fcn.00515ed6
lea ecx, [ebp - 0x220]
call fcn.006174f2
lea ecx, [ebp - 0x1e8]
call fcn.005a1446
xor al, al
call fcn.00648b0b
ret 8