Function at 0x658930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b0
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
je 0x658bf9
cmp edx, 0xa
jl 0x658bf9
mov ecx, edx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.006519b0
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.00651450
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.006515e0
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.006518d0
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x16c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658bec
mov edx, dword [esp + 0x18]
cmp edx, ebp
je 0x658bec
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
lea eax, [esp + 0x1c]
push eax
push ebp
lea ecx, [esp + 0xa0]
push ecx
mov dword [esp + 0x28], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x658a9e
cmp dword [esp + 0x14], 1
jne 0x658a9e
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x658a9e
cmp eax, 0x1f4
jb 0x658a52
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.006571a0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x658a9e
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
jle 0x658a96
mov edx, dword [esp + 0x24]
mov eax, esi
lea esi, [esp + 0x1c8]
sub esi, edx
cmp ecx, edi
jge 0x658a96
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [esp + 0x1c]
inc ecx
inc eax
cmp ecx, edx
jl 0x658a83
mov dword [esp + 0x20], 1
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x108]
push eax
push ecx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x658bcb
cmp dword [esp + 0x14], 1
jne 0x658bcb
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x658bcb
cmp ecx, 0x1f4
jb 0x658b0d
mov ecx, 0x1f3
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x28]
xor esi, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x658b16
sub eax, edi
sub ecx, eax
je 0x658b81
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x658b30
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + esi + 0x1d0]
push eax
call fcn.00698b47
add esp, 0xc
test eax, eax
je 0x658b75
lea eax, [esp + 0x28]
inc esi
lea edx, [eax + 1]
jmp 0x658b60
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x658b60
mov ecx, dword [esp + 0x10]
sub eax, edx
sub ecx, eax
cmp esi, ecx
jb 0x658b23
jmp 0x658b81
mov byte [esp + esi + 0x1c8], 0
mov dword [esp + 0x10], esi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.006571a0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x658bcb
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
test ebp, ebp
jle 0x658bc3
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1c8]
sub esi, eax
cmp ecx, edi
jge 0x658bc3
mov bl, byte [eax]
mov dl, byte [eax + esi]
add bl, dl
inc ecx
mov byte [eax], bl
inc eax
cmp ecx, ebp
jl 0x658bb0
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
dec eax
neg eax
sbb eax, eax
and eax, 0x360
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret