Function at 0x6599a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x570
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, ecx
cmp edi, ebx
mov eax, 0x104
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
je 0x659c7b
cmp edx, 0xa
jl 0x659c7b
mov ecx, edx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00656860
cmp eax, 1
jne 0x659c64
mov edx, 0x64
lea ecx, [esp + 0xa8]
call fcn.0064ff70
mov edx, 0x64
lea ecx, [esp + 0x110]
call fcn.00650490
mov edx, 0x64
lea ecx, [esp + 0x40]
call fcn.00650300
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0xb4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659c6e
cmp dword [esp + 0x18], ebx
je 0x659c6e
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x659a80
mov edx, dword [esp + 0x1c]
cmp edx, 0xff
jae 0x659c59
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18c]
push eax
push edx
push ecx
mov dword [esp + 0x48], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0x1c]
mov esi, eax
inc ecx
cmp esi, 0x103
mov dword [esp + 0x1c], ecx
je 0x659c59
cmp esi, ebx
jne 0x659c4d
cmp dword [esp + 0x28], ebx
je 0x659a80
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x184]
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659a80
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x659a80
mov ecx, 0x7d
lea edi, [esp + 0x388]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38c]
push ecx
lea eax, [esp + 0x28]
push eax
push ebx
push 0x6ba446
push edx
mov dword [esp + 0x44], 0x1f3
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
jne 0x659c42
cmp dword [esp + 0x20], 1
jne 0x659c42
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38c]
push edx
call fcn.00697d4d
add esp, 8
test eax, eax
jne 0x659c42
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x11c]
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659c32
cmp dword [esp + 0x14], ebx
je 0x659c32
xor esi, esi
nop
cmp esi, 0xff
jae 0x659c27
mov edx, dword [esp + 0x14]
push ebx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x284]
rep stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x294]
push ecx
push esi
push edx
mov dword [esp + 0x44], 0x105
call ebp
inc esi
cmp eax, 0x103
je 0x659c27
cmp eax, ebx
jne 0x659bc0
mov edx, dword [esp + 0x24]
cmp edx, ebx
je 0x659bc0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x288]
call fcn.00659110
jmp 0x659bc0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659a80
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x659a80
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret