Function at 0x654ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c4
push ebx
xor ebx, ebx
mov eax, ecx
cmp eax, ebx
mov ecx, 0x52
push esi
push edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
je 0x65507b
cmp dword [ebp + 8], ebx
je 0x65507b
cmp dword [ebp + 0xc], ebx
je 0x65507b
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x65507b
cmp dword [ebp + 0x14], ebx
je 0x65507b
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x65507b
cmp dword [ebp + 0x1c], ebx
je 0x65507b
mov edx, dword [ebp + 0x20]
cmp edx, ebx
je 0x65507b
lea ecx, [eax + 1]
mov dword [esp + 0x1c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x654b38
sub eax, dword [esp + 0x1c]
cmp eax, 0x26
jne 0x65507b
mov eax, dword [esi]
cmp eax, 1
mov dword [esp + 0x38], eax
jl 0x65507b
mov eax, dword [edi]
cmp eax, 1
mov dword [esp + 0x30], eax
jl 0x65507b
mov eax, dword [edx]
cmp eax, 1
mov dword [esp + 0x3c], eax
jl 0x65507b
xor eax, eax
mov dword [esi], 0xffffffff
mov dword [edi], 0xffffffff
mov ecx, 0x14
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x14
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x2e8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x28
lea edi, [esp + 0x390]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x5d8]
mov dword [edx], 0xffffffff
rep stosd dword es:[edi], eax
mov edx, 0x64
lea ecx, [esp + 0x570]
call fcn.006516f0
mov edx, 0x64
lea ecx, [esp + 0x438]
call fcn.00651790
mov edx, 0x64
lea ecx, [esp + 0x4a0]
call fcn.0064f7d0
mov edx, 0x64
lea ecx, [esp + 0x508]
call fcn.00651840
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x6b93e6
push ecx
call edi
test eax, eax
je 0x654c72
xor edx, edx
cmp eax, 5
setne dl
dec edx
and edx, 0xfffffffd
add edx, 0x360
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [esp + 0x14]
mov esi, 1
cmp eax, esi
jne 0x65506d
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x65506d
cmp eax, 0x1f3
ja 0x65506d
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x6b93e6
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x1f4
call edi
test eax, eax
je 0x654ceb
xor ecx, ecx
cmp eax, 5
setne cl
dec ecx
and ecx, 0xfffffffd
add ecx, 0x360
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [esp + 0x14], esi
jne 0x65506d
mov esi, dword [esp + 0x18]
cmp esi, 4
jb 0x65506d
mov dl, byte [esp + 0xf0]
xor edi, edi
test esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0xf], dl
jle 0x654d7e
lea eax, [esp + 0x2e8]
lea ecx, [esp + 0xf0]
sub eax, ecx
mov dword [esp + 0x34], eax
jmp 0x654d30
cmp edi, 0xa2
jae 0x654d86
movsx eax, byte [esp + 0xf]
push eax
call fcn.006978c9
add esp, 4
test eax, eax
je 0x654d76
movsx eax, byte [esp + 0xf]
push eax
call fcn.006974ac
mov edx, dword [esp + 0x38]
add edx, ebx
add esp, 4
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + edx + 0xf0], al
mov al, byte [esp + ebx + 0xf0]
mov byte [esp + 0xf], al
jl 0x654d30
cmp edi, 0xa2
jae 0x654d86
mov byte [esp + edi + 0x2e8], 0
cmp edi, 4
jl 0x654e00
cmp edi, 0xa1
jg 0x654e00
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x654d9f
test al, al
jne 0x654e00
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2f0]
push eax
call fcn.00655d00
test eax, eax
jne 0x654e00
mov ecx, dword [esp + 0x20]
cmp ecx, 2
jl 0x654e00
cmp ecx, 0x50
jg 0x654e00
cmp dword [esp + 0x38], ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
jge 0x654de5
mov dword [esp + 0x10], 0x362
jmp 0x654e08
mov edi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x654e08
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x654e40
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x654e26
test al, al
je 0x654e26
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x654e10
jmp 0x654e40
cmp ebx, esi
jge 0x654e40
lea ebx, [ebx]
cmp al, 0x20
jne 0x654e40
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x654e30
mov cl, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], cl
jge 0x654e99
cmp edi, 0xa2
jae 0x654ea1
movsx eax, byte [esp + 0xf]
push eax
call fcn.006978c9
add esp, 4
test eax, eax
je 0x654e91
movsx eax, byte [esp + 0xf]
push eax
call fcn.006974ac
mov dl, byte [esp + ebx + 0xf5]
add esp, 4
mov byte [esp + edi + 0x390], al
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + 0xf], dl
jl 0x654e51
cmp edi, 0xa2
jae 0x654ea1
mov byte [esp + edi + 0x390], 0
cmp edi, 4
jl 0x654f21
cmp edi, 0xa1
jg 0x654f21
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x654eba
test al, al
jne 0x654f21
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x398]
push edx
mov edx, dword [esp + 0x38]
call fcn.00655d00
test eax, eax
jne 0x654f21
mov ecx, dword [esp + 0x24]
cmp ecx, 2
jl 0x654f21
cmp ecx, 0x50
jg 0x654f21
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
cmp dword [esp + 0x30], ecx
jge 0x654f03
mov dword [esp + 0x10], 0x362
jmp 0x654f31
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x654f31
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x654f31
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x654f70
mov al, byte [esp + 0xf]
lea esp, [esp]
cmp al, 0x20
je 0x654f56
test al, al
je 0x654f56
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x654f40
jmp 0x654f70
cmp ebx, esi
jge 0x654f70
lea ebx, [ebx]
cmp al, 0x20
jne 0x654f70
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x654f60
mov al, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], al
jge 0x654fa5
cmp edi, 0x1f3
jae 0x654fa1
test al, al
je 0x654fa1
mov byte [esp + edi + 0x5d8], al
mov al, byte [esp + ebx + 0xf1]
inc edi
inc ebx
cmp ebx, esi
jl 0x654f81
mov byte [esp + 0xf], al
lea eax, [esp + 0x570]
push eax
lea ecx, [esp + 0x5dc]
mov byte [esp + edi + 0x5dc], 0
push ecx
inc edi
call fcn.006968ed
add esp, 8
test eax, eax
je 0x65501e
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x5dc]
push eax
call fcn.006968ed
add esp, 8
test eax, eax
je 0x65501e
lea ecx, [esp + 0x4a0]
push ecx
lea edx, [esp + 0x5dc]
push edx
call fcn.006968ed
add esp, 8
test eax, eax
je 0x65501e
lea eax, [esp + 0x508]
push eax
lea ecx, [esp + 0x5dc]
push ecx
call fcn.006968ed
add esp, 8
test eax, eax
jne 0x655060
mov al, byte [esp + 0xf]
test al, al
jne 0x655060
cmp dword [esp + 0x3c], edi
mov edx, dword [ebp + 0x20]
mov dword [edx], edi
jge 0x655046
mov dword [esp + 0x10], 0x362
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, edi
mov edi, dword [ebp + 0x1c]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x5d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0x361
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 0x1c