Function at 0x658da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b0
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
je 0x659069
cmp edx, 0xa
jl 0x659069
mov ecx, edx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.00651e20
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.006518c0
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.00651a50
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.00651d40
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x16c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65905c
mov edx, dword [esp + 0x18]
cmp edx, ebp
je 0x65905c
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
lea eax, [esp + 0x1c]
push eax
push ebp
lea ecx, [esp + 0xa0]
push ecx
mov dword [esp + 0x28], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x658f0e
cmp dword [esp + 0x14], 1
jne 0x658f0e
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x658f0e
cmp eax, 0x1f4
jb 0x658ec2
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.00657610
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x658f0e
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
jle 0x658f06
mov edx, dword [esp + 0x24]
mov eax, esi
lea esi, [esp + 0x1c8]
sub esi, edx
cmp ecx, edi
jge 0x658f06
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [esp + 0x1c]
inc ecx
inc eax
cmp ecx, edx
jl 0x658ef3
mov dword [esp + 0x20], 1
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x108]
push eax
push ecx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x65903b
cmp dword [esp + 0x14], 1
jne 0x65903b
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x65903b
cmp ecx, 0x1f4
jb 0x658f7d
mov ecx, 0x1f3
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x28]
xor esi, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x658f86
sub eax, edi
sub ecx, eax
je 0x658ff1
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x658fa0
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + esi + 0x1d0]
push eax
call fcn.00698fb7
add esp, 0xc
test eax, eax
je 0x658fe5
lea eax, [esp + 0x28]
inc esi
lea edx, [eax + 1]
jmp 0x658fd0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x658fd0
mov ecx, dword [esp + 0x10]
sub eax, edx
sub ecx, eax
cmp esi, ecx
jb 0x658f93
jmp 0x658ff1
mov byte [esp + esi + 0x1c8], 0
mov dword [esp + 0x10], esi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.00657610
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x65903b
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
test ebp, ebp
jle 0x659033
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1c8]
sub esi, eax
cmp ecx, edi
jge 0x659033
mov bl, byte [eax]
mov dl, byte [eax + esi]
add bl, dl
inc ecx
mov byte [eax], bl
inc eax
cmp ecx, ebp
jl 0x659020
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
dec eax
neg eax
sbb eax, eax
and eax, 0x360
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret