Function at 0x655f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c4
push ebx
xor ebx, ebx
mov eax, ecx
cmp eax, ebx
mov ecx, 0x52
push esi
push edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
je 0x6564db
cmp dword [ebp + 8], ebx
je 0x6564db
cmp dword [ebp + 0xc], ebx
je 0x6564db
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x6564db
cmp dword [ebp + 0x14], ebx
je 0x6564db
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x6564db
cmp dword [ebp + 0x1c], ebx
je 0x6564db
mov edx, dword [ebp + 0x20]
cmp edx, ebx
je 0x6564db
lea ecx, [eax + 1]
mov dword [esp + 0x1c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x655f98
sub eax, dword [esp + 0x1c]
cmp eax, 0x26
jne 0x6564db
mov eax, dword [esi]
cmp eax, 1
mov dword [esp + 0x38], eax
jl 0x6564db
mov eax, dword [edi]
cmp eax, 1
mov dword [esp + 0x30], eax
jl 0x6564db
mov eax, dword [edx]
cmp eax, 1
mov dword [esp + 0x3c], eax
jl 0x6564db
xor eax, eax
mov dword [esi], 0xffffffff
mov dword [edi], 0xffffffff
mov ecx, 0x14
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x14
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x2e8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x28
lea edi, [esp + 0x390]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x5d8]
mov dword [edx], 0xffffffff
rep stosd dword es:[edi], eax
mov edx, 0x64
lea ecx, [esp + 0x570]
call fcn.00652b50
mov edx, 0x64
lea ecx, [esp + 0x438]
call fcn.00652bf0
mov edx, 0x64
lea ecx, [esp + 0x4a0]
call fcn.00650c30
mov edx, 0x64
lea ecx, [esp + 0x508]
call fcn.00652ca0
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x6ba446
push ecx
call edi
test eax, eax
je 0x6560d2
xor edx, edx
cmp eax, 5
setne dl
dec edx
and edx, 0xfffffffd
add edx, 0x360
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [esp + 0x14]
mov esi, 1
cmp eax, esi
jne 0x6564cd
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x6564cd
cmp eax, 0x1f3
ja 0x6564cd
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x6ba446
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x1f4
call edi
test eax, eax
je 0x65614b
xor ecx, ecx
cmp eax, 5
setne cl
dec ecx
and ecx, 0xfffffffd
add ecx, 0x360
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [esp + 0x14], esi
jne 0x6564cd
mov esi, dword [esp + 0x18]
cmp esi, 4
jb 0x6564cd
mov dl, byte [esp + 0xf0]
xor edi, edi
test esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0xf], dl
jle 0x6561de
lea eax, [esp + 0x2e8]
lea ecx, [esp + 0xf0]
sub eax, ecx
mov dword [esp + 0x34], eax
jmp 0x656190
cmp edi, 0xa2
jae 0x6561e6
movsx eax, byte [esp + 0xf]
push eax
call fcn.00698d29
add esp, 4
test eax, eax
je 0x6561d6
movsx eax, byte [esp + 0xf]
push eax
call fcn.0069890c
mov edx, dword [esp + 0x38]
add edx, ebx
add esp, 4
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + edx + 0xf0], al
mov al, byte [esp + ebx + 0xf0]
mov byte [esp + 0xf], al
jl 0x656190
cmp edi, 0xa2
jae 0x6561e6
mov byte [esp + edi + 0x2e8], 0
cmp edi, 4
jl 0x656260
cmp edi, 0xa1
jg 0x656260
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x6561ff
test al, al
jne 0x656260
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2f0]
push eax
call fcn.00657160
test eax, eax
jne 0x656260
mov ecx, dword [esp + 0x20]
cmp ecx, 2
jl 0x656260
cmp ecx, 0x50
jg 0x656260
cmp dword [esp + 0x38], ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
jge 0x656245
mov dword [esp + 0x10], 0x362
jmp 0x656268
mov edi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x656268
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x6562a0
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x656286
test al, al
je 0x656286
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x656270
jmp 0x6562a0
cmp ebx, esi
jge 0x6562a0
lea ebx, [ebx]
cmp al, 0x20
jne 0x6562a0
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x656290
mov cl, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], cl
jge 0x6562f9
cmp edi, 0xa2
jae 0x656301
movsx eax, byte [esp + 0xf]
push eax
call fcn.00698d29
add esp, 4
test eax, eax
je 0x6562f1
movsx eax, byte [esp + 0xf]
push eax
call fcn.0069890c
mov dl, byte [esp + ebx + 0xf5]
add esp, 4
mov byte [esp + edi + 0x390], al
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + 0xf], dl
jl 0x6562b1
cmp edi, 0xa2
jae 0x656301
mov byte [esp + edi + 0x390], 0
cmp edi, 4
jl 0x656381
cmp edi, 0xa1
jg 0x656381
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x65631a
test al, al
jne 0x656381
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x398]
push edx
mov edx, dword [esp + 0x38]
call fcn.00657160
test eax, eax
jne 0x656381
mov ecx, dword [esp + 0x24]
cmp ecx, 2
jl 0x656381
cmp ecx, 0x50
jg 0x656381
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
cmp dword [esp + 0x30], ecx
jge 0x656363
mov dword [esp + 0x10], 0x362
jmp 0x656391
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x656391
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x656391
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x6563d0
mov al, byte [esp + 0xf]
lea esp, [esp]
cmp al, 0x20
je 0x6563b6
test al, al
je 0x6563b6
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x6563a0
jmp 0x6563d0
cmp ebx, esi
jge 0x6563d0
lea ebx, [ebx]
cmp al, 0x20
jne 0x6563d0
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x6563c0
mov al, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], al
jge 0x656405
cmp edi, 0x1f3
jae 0x656401
test al, al
je 0x656401
mov byte [esp + edi + 0x5d8], al
mov al, byte [esp + ebx + 0xf1]
inc edi
inc ebx
cmp ebx, esi
jl 0x6563e1
mov byte [esp + 0xf], al
lea eax, [esp + 0x570]
push eax
lea ecx, [esp + 0x5dc]
mov byte [esp + edi + 0x5dc], 0
push ecx
inc edi
call fcn.00697d4d
add esp, 8
test eax, eax
je 0x65647e
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x5dc]
push eax
call fcn.00697d4d
add esp, 8
test eax, eax
je 0x65647e
lea ecx, [esp + 0x4a0]
push ecx
lea edx, [esp + 0x5dc]
push edx
call fcn.00697d4d
add esp, 8
test eax, eax
je 0x65647e
lea eax, [esp + 0x508]
push eax
lea ecx, [esp + 0x5dc]
push ecx
call fcn.00697d4d
add esp, 8
test eax, eax
jne 0x6564c0
mov al, byte [esp + 0xf]
test al, al
jne 0x6564c0
cmp dword [esp + 0x3c], edi
mov edx, dword [ebp + 0x20]
mov dword [edx], edi
jge 0x6564a6
mov dword [esp + 0x10], 0x362
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, edi
mov edi, dword [ebp + 0x1c]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x5d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0x361
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 0x1c