Function at 0x6535863a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x3a4
push ebx
push ebp
mov eax, 0x80000000
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov edi, 0x653c7dd4
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0x3b8]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x27
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x30], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x6a]
push ecx
push ebp
call fcn.653585a9
lea edi, [esp + 0x5c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.Forward]
repne scasb al, byte es:[edi]
mov eax, dword [0x653c7de4]
mov cl, byte [0x653c7de8]
dec edi
mov dword [esp + 0x1c], 0x100
mov dword [edi], edx
lea edx, [esp + 0x1c]
push edx
mov dword [edi + 4], eax
lea eax, [esp + 0xb8]
push eax
mov byte [edi + 8], cl
lea ecx, [esp + 0x64]
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x65368a88
mov edi, str.TypeLib_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x24], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x28]
and ecx, 3
mov dword [esp + 0x28], ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x70]
push 0x28
push ecx
push ebp
call fcn.6535898a
add esp, 0x18
cmp eax, ebx
jne 0x65368af0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x5c]
push edx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x65368afb
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x3c]
push 0xd
push ecx
push ebx
push edx
mov byte [esp + 0x5c], 0
call ebp
test eax, eax
jne 0x65358815
lea eax, [esp + 0x30]
push 0x10
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.65358ab1
mov esi, eax
mov eax, dword [esp + 0x3c]
add esp, 0xc
cmp byte [eax], 0x2e
jne 0x653587f7
push 0x10
inc eax
push 0
push eax
call fcn.65358ab1
mov ecx, dword [esp + 0x44]
add esp, 0xc
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x65368b0b
cmp si, cx
jne 0x653587f7
cmp ax, word [esp + 0x24]
jb 0x653587f7
mov dword [esp + 0x24], eax
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x28], esi
lea edx, [esp + 0x4c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
inc ebx
push 0xd
push ecx
push ebx
push edx
call ebp
test eax, eax
je 0x65358781
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x4c]
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x65368b75
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x65368b19
lea ecx, [esp + 0x5c]
xor esi, esi
push 0x10
push ecx
push esi
push eax
call ebp
test eax, eax
jne 0x65368b75
lea edx, [esp + 0x5c]
push edx
call fcn.65358c48
add esp, 4
test eax, eax
je 0x65368b26
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x5c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x65368b75
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push 0x653c7df8
push eax
call edi
test eax, eax
jne 0x65368b48
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xb4]
push eax
push ecx
mov esi, 0x100
push 0
push edx
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x65368b75
lea eax, [esp + 0x1b4]
push esi
push eax
lea ecx, [esp + 0xbc]
push esi
push ecx
push 1
push 0
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1b4]
push edx
push eax
call sym.OLEAUT32.dll_LoadTypeLib
mov esi, eax
test esi, esi
jne 0x65368b7f
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x3bc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
jne 0x65368b8a
mov ecx, dword [esp + 0x3bc]
mov eax, dword [esp + 0x34]
xor esi, esi
mov dword [ecx], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6535893f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x80000000
je 0x65358953
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, 0x80000000
je 0x65358961
push eax
call edi
mov eax, dword [esp + 0x14]
cmp eax, 0x80000000
je 0x6535896f
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, 0x80000000
je 0x6535897d
push eax
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a4
ret
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1b4]
push eax
push edx
push eax
lea eax, [esp + 0xc0]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x1b4]
push ecx
push edx
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x653586eb
mov eax, dword [esp + 0x3bc]
lea ecx, [esp + 0xa4]
push eax
push ecx
call fcn.6535863a
add esp, 8
test eax, eax
jne 0x653586eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a4
ret
jge 0x65358740
jmp 0x6535897f
mov eax, 0x8002801d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a4
ret
cmp si, cx
jbe 0x653587be
jmp 0x653587ca
mov dword [esp + 0x10], 0x80000000
jmp 0x6535883e
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x5c]
inc esi
push 0x10
push eax
push esi
push ecx
call ebp
test eax, eax
je 0x65358853
mov esi, 0x8002801d
jmp 0x65358931
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x5c]
push 6
push ecx
push 0
push edx
call ebp
test eax, eax
jne 0x65368b75
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x5c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x6535889a
mov esi, 0x8002801d
jmp 0x65358931
jge 0x65358901
jmp 0x65358931
jge 0x65358922
jmp 0x65358931