Function at 0x659530
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x570
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, ecx
cmp edi, ebx
mov eax, 0x104
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
je 0x65980b
cmp edx, 0xa
jl 0x65980b
mov ecx, edx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.006563f0
cmp eax, 1
jne 0x6597f4
mov edx, 0x64
lea ecx, [esp + 0xa8]
call fcn.0064fb00
mov edx, 0x64
lea ecx, [esp + 0x110]
call fcn.00650020
mov edx, 0x64
lea ecx, [esp + 0x40]
call fcn.0064fe90
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0xb4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6597fe
cmp dword [esp + 0x18], ebx
je 0x6597fe
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x659610
mov edx, dword [esp + 0x1c]
cmp edx, 0xff
jae 0x6597e9
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18c]
push eax
push edx
push ecx
mov dword [esp + 0x48], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0x1c]
mov esi, eax
inc ecx
cmp esi, 0x103
mov dword [esp + 0x1c], ecx
je 0x6597e9
cmp esi, ebx
jne 0x6597dd
cmp dword [esp + 0x28], ebx
je 0x659610
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x184]
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659610
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x659610
mov ecx, 0x7d
lea edi, [esp + 0x388]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38c]
push ecx
lea eax, [esp + 0x28]
push eax
push ebx
push 0x6ba3e6
push edx
mov dword [esp + 0x44], 0x1f3
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
jne 0x6597d2
cmp dword [esp + 0x20], 1
jne 0x6597d2
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38c]
push edx
call fcn.006978dd
add esp, 8
test eax, eax
jne 0x6597d2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x11c]
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6597c2
cmp dword [esp + 0x14], ebx
je 0x6597c2
xor esi, esi
nop
cmp esi, 0xff
jae 0x6597b7
mov edx, dword [esp + 0x14]
push ebx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x284]
rep stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x294]
push ecx
push esi
push edx
mov dword [esp + 0x44], 0x105
call ebp
inc esi
cmp eax, 0x103
je 0x6597b7
cmp eax, ebx
jne 0x659750
mov edx, dword [esp + 0x24]
cmp edx, ebx
je 0x659750
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x288]
call fcn.00658ca0
jmp 0x659750
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659610
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x659610
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret