Function at 0x4d9950
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3f4], ecx
push 0x1a8
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.00497490
add esp, 0xc
mov dword [ebp - 0x1b0], 0x1a8
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, dword [ebp - 0x3f4]
call fcn.004d9590
test eax, eax
je 0x4d9c33
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.00495920
add esp, 8
add eax, 1
mov dword [ebp - 0x1bc], eax
push 0x5c
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.00495920
add esp, 8
sub eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 8
jb 0x4d99f9
mov dword [ebp - 0x1c0], 7
mov ecx, dword [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1c8]
push eax
call fcn.004957c0
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.00495920
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSetEnumDISPLAY_
lea edi, [ebp - 0x2d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xdd
push 0
lea edx, [ebp - 0x2b1]
push edx
call fcn.00497490
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00495920
add esp, 8
sub eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call fcn.004957e0
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00495920
add esp, 8
add eax, 1
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x2d8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d9c33
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0x104
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4d9c26
lea edx, [ebp - 0x2ec]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d9c12
mov dword [ebp - 0x2e8], 0x104
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push str.Driver
mov ecx, dword [ebp - 0x2ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d9c05
mov edx, dword [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x2d8]
push eax
call fcn.00498c60
add esp, 8
test eax, eax
jne 0x4d9c05
lea ecx, [ebp - 0x2f0]
push ecx
push 0x20019
push 0
push str.Device_Parameters
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d9c05
mov dword [ebp - 0x2e8], 0x100
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x3f0]
push ecx
push 0
push 0
push str.EDID
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d9bf8
lea eax, [ebp - 0x3f0]
push eax
mov ecx, dword [ebp - 0x3f4]
call fcn.004d96b0
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
jmp 0x4d9adf
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret