Function at 0x658540
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x570
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, ecx
cmp edi, ebx
mov eax, 0x104
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
je 0x65881b
cmp edx, 0xa
jl 0x65881b
mov ecx, edx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00655400
cmp eax, 1
jne 0x658804
mov edx, 0x64
lea ecx, [esp + 0xa8]
call fcn.0064eb10
mov edx, 0x64
lea ecx, [esp + 0x110]
call fcn.0064f030
mov edx, 0x64
lea ecx, [esp + 0x40]
call fcn.0064eea0
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0xb4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65880e
cmp dword [esp + 0x18], ebx
je 0x65880e
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x658620
mov edx, dword [esp + 0x1c]
cmp edx, 0xff
jae 0x6587f9
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18c]
push eax
push edx
push ecx
mov dword [esp + 0x48], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0x1c]
mov esi, eax
inc ecx
cmp esi, 0x103
mov dword [esp + 0x1c], ecx
je 0x6587f9
cmp esi, ebx
jne 0x6587ed
cmp dword [esp + 0x28], ebx
je 0x658620
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x184]
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658620
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x658620
mov ecx, 0x7d
lea edi, [esp + 0x388]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38c]
push ecx
lea eax, [esp + 0x28]
push eax
push ebx
push 0x6b93e6
push edx
mov dword [esp + 0x44], 0x1f3
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
jne 0x6587e2
cmp dword [esp + 0x20], 1
jne 0x6587e2
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38c]
push edx
call fcn.006968ed
add esp, 8
test eax, eax
jne 0x6587e2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x11c]
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6587d2
cmp dword [esp + 0x14], ebx
je 0x6587d2
xor esi, esi
nop
cmp esi, 0xff
jae 0x6587c7
mov edx, dword [esp + 0x14]
push ebx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x284]
rep stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x294]
push ecx
push esi
push edx
mov dword [esp + 0x44], 0x105
call ebp
inc esi
cmp eax, 0x103
je 0x6587c7
cmp eax, ebx
jne 0x658760
mov edx, dword [esp + 0x24]
cmp edx, ebx
je 0x658760
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x288]
call fcn.00657cb0
jmp 0x658760
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658620
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x658620
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret