Function at 0x4cdd80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x518334]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3f4], ecx
push 0x1a8
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.00497210
add esp, 0xc
mov dword [ebp - 0x1b0], 0x1a8
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, dword [ebp - 0x3f4]
call fcn.004cd9c0
test eax, eax
je 0x4ce063
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.004918e0
add esp, 8
add eax, 1
mov dword [ebp - 0x1bc], eax
push 0x5c
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.004918e0
add esp, 8
sub eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 8
jb 0x4cde29
mov dword [ebp - 0x1c0], 7
mov ecx, dword [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1c8]
push eax
call fcn.004918a0
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.004918e0
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSetEnumDISPLAY_
lea edi, [ebp - 0x2d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xdd
push 0
lea edx, [ebp - 0x2b1]
push edx
call fcn.00497210
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.004918e0
add esp, 8
sub eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call fcn.004918c0
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.004918e0
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x2d8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce063
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0x104
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4ce056
lea edx, [ebp - 0x2ec]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce042
mov dword [ebp - 0x2e8], 0x104
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push str.Driver
mov ecx, dword [ebp - 0x2ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce035
mov edx, dword [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x2d8]
push eax
call fcn.00497180
add esp, 8
test eax, eax
jne 0x4ce035
lea ecx, [ebp - 0x2f0]
push ecx
push 0x20019
push 0
push str.Device_Parameters
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce035
mov dword [ebp - 0x2e8], pe_nt_image_headers32
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
push 0
push 0
push str.EDID
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce028
lea eax, [ebp - 0x3f0]
push eax
mov ecx, dword [ebp - 0x3f4]
call fcn.004cdae0
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
jmp 0x4cdf0f
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c88a
mov esp, ebp
pop ebp
ret