Function at 0x5011813
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov eax, 0x504de08
call fcn.05040548
sub esp, 0x460
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
cmp esi, ebx
mov dword [ebp - 0x10], esp
je 0x5011868
push str.DISPLAY
push esi
call fcn.050405b0
pop ecx
test eax, eax
pop ecx
je 0x5011865
push str.display
push esi
call fcn.050405b0
pop ecx
test eax, eax
pop ecx
je 0x5011865
push str.Display
push esi
call fcn.050405b0
pop ecx
test eax, eax
pop ecx
jne 0x5011868
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5011b01
cmp dword [ebp - 0x1b0], 2
jne 0x501189d
cmp dword [ebp - 0x1bc], 5
jae 0x5011b05
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.05007eb6
test al, al
je 0x5011b01
cmp dword [esi + 0xa4], ebx
je 0x5011afa
cmp dword [esi + 0xa0], ebx
je 0x5011afa
push str.user32.dll
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x13], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x50119b4
push str.EnumDisplayDevicesA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x50119a3
mov esi, 0xa8
lea eax, [ebp - 0x12c]
push esi
push ebx
push eax
mov byte [ebp - 0x12], 1
call fcn.05040640
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], esi
xor esi, esi
push ebx
push eax
push ebx
push ebx
call edi
test eax, eax
je 0x50119a3
cmp dword [ebp + 0x10], ebx
jne 0x5011943
mov eax, dword [ebp - 0x88]
shr eax, 2
and al, 1
mov byte [ebp - 0x11], al
jmp 0x501195d
push dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push eax
call fcn.050405b0
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp - 0x11], al
cmp al, bl
jne 0x501196d
lea eax, [ebp - 0x12c]
inc esi
push ebx
push eax
push esi
jmp 0x5011927
mov esi, 0x1a8
lea eax, [ebp - 0x368]
push esi
push ebx
push eax
call fcn.05040640
add esp, 0xc
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], esi
push ebx
push eax
lea eax, [ebp - 0x128]
push ebx
push eax
call edi
test eax, eax
je 0x50119a3
mov byte [ebp - 0x13], 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x13], bl
jne 0x50119f4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.05007f9a
cmp byte [ebp - 0x12], bl
je 0x50119df
cmp byte [ebp - 0x11], bl
jne 0x50119df
cmp dword [ebp + 0x10], ebx
je 0x50119df
lea eax, [ebp - 0x30]
push 0x5055ec8
push eax
mov dword [ebp - 0x30], 0x7061726d
call fcn.05040567
lea eax, [ebp - 0x2c]
push 0x5055ec8
push eax
mov dword [ebp - 0x2c], 0x67656e20
call fcn.05040567
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov edi, 0x104
push dword [ebp + 0xc]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x1c], edi
push ebx
call eax
test eax, eax
je 0x5011a2a
push 0x505fc08
push dword [ebp + 0xc]
call fcn.0500a7cb
pop ecx
mov byte [ebp - 0x11], 1
test al, al
pop ecx
jne 0x5011a2d
mov byte [ebp - 0x11], bl
push 0x54
lea eax, [ebp - 0x84]
pop esi
push esi
push ebx
push eax
call fcn.05040640
add esp, 0xc
cmp byte [ebp - 0x11], bl
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], 0x200
mov dword [ebp - 0x7c], 0x21
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x60], 0x6d6e7472
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x12], bl
je 0x5011ad8
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x28]
mov eax, dword [eax + 0xa4]
push ecx
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 0x84]
push ecx
push ebx
call eax
cmp eax, ebx
setne byte [ebp - 0x11]
jmp 0x5011ab0
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x11], bl
je 0x5011ad8
cmp dword [ebp - 0x18], 1
jb 0x5011ad8
lea eax, [ebp - 0x46c]
push eax
push dword [ebp + 0xc]
call fcn.0500a7cb
pop ecx
mov byte [ebp - 0x11], 1
test al, al
pop ecx
jne 0x5011adb
mov byte [ebp - 0x11], bl
mov ecx, dword [ebp + 8]
call fcn.05007f9a
cmp byte [ebp - 0x12], bl
jne 0x5011b05
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, esi
call fcn.05007f9a
xor al, al
jmp 0x5011aeb
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x5011b11
mov eax, str.DISPLAY
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
cmp esi, ebx
je 0x5011b46
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x104
push eax
push esi
call dword [sym.imp.GDI32.dll_GetICMProfileA]
test eax, eax
push esi
setne bl
call dword [sym.imp.GDI32.dll_DeleteDC]
mov al, bl
jmp 0x5011aeb
lea eax, [ebp - 0x20]
push 0x5055ec8
push eax
mov dword [ebp - 0x20], 0x7061726d
call fcn.05040567