Function at 0x657940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b0
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
je 0x657c09
cmp edx, 0xa
jl 0x657c09
mov ecx, edx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.006509c0
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.00650460
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.006505f0
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.006508e0
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x16c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657bfc
mov edx, dword [esp + 0x18]
cmp edx, ebp
je 0x657bfc
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
lea eax, [esp + 0x1c]
push eax
push ebp
lea ecx, [esp + 0xa0]
push ecx
mov dword [esp + 0x28], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x657aae
cmp dword [esp + 0x14], 1
jne 0x657aae
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x657aae
cmp eax, 0x1f4
jb 0x657a62
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.006561b0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x657aae
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
jle 0x657aa6
mov edx, dword [esp + 0x24]
mov eax, esi
lea esi, [esp + 0x1c8]
sub esi, edx
cmp ecx, edi
jge 0x657aa6
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [esp + 0x1c]
inc ecx
inc eax
cmp ecx, edx
jl 0x657a93
mov dword [esp + 0x20], 1
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x1c8]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x108]
push eax
push ecx
mov dword [esp + 0x28], 0x1f3
call ebp
test eax, eax
jne 0x657bdb
cmp dword [esp + 0x14], 1
jne 0x657bdb
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x657bdb
cmp ecx, 0x1f4
jb 0x657b1d
mov ecx, 0x1f3
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x28]
xor esi, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x657b26
sub eax, edi
sub ecx, eax
je 0x657b91
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x657b40
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + esi + 0x1d0]
push eax
call fcn.00697b57
add esp, 0xc
test eax, eax
je 0x657b85
lea eax, [esp + 0x28]
inc esi
lea edx, [eax + 1]
jmp 0x657b70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x657b70
mov ecx, dword [esp + 0x10]
sub eax, edx
sub ecx, eax
cmp esi, ecx
jb 0x657b33
jmp 0x657b91
mov byte [esp + esi + 0x1c8], 0
mov dword [esp + 0x10], esi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c8]
call fcn.006561b0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x657bdb
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
test ebp, ebp
jle 0x657bd3
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1c8]
sub esi, eax
cmp ecx, edi
jge 0x657bd3
mov bl, byte [eax]
mov dl, byte [eax + esi]
add bl, dl
inc ecx
mov byte [eax], bl
inc eax
cmp ecx, ebp
jl 0x657bc0
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
dec eax
neg eax
sbb eax, eax
and eax, 0x360
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret