Function at 0x655aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c4
push ebx
xor ebx, ebx
mov eax, ecx
cmp eax, ebx
mov ecx, 0x52
push esi
push edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
je 0x65606b
cmp dword [ebp + 8], ebx
je 0x65606b
cmp dword [ebp + 0xc], ebx
je 0x65606b
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x65606b
cmp dword [ebp + 0x14], ebx
je 0x65606b
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x65606b
cmp dword [ebp + 0x1c], ebx
je 0x65606b
mov edx, dword [ebp + 0x20]
cmp edx, ebx
je 0x65606b
lea ecx, [eax + 1]
mov dword [esp + 0x1c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x655b28
sub eax, dword [esp + 0x1c]
cmp eax, 0x26
jne 0x65606b
mov eax, dword [esi]
cmp eax, 1
mov dword [esp + 0x38], eax
jl 0x65606b
mov eax, dword [edi]
cmp eax, 1
mov dword [esp + 0x30], eax
jl 0x65606b
mov eax, dword [edx]
cmp eax, 1
mov dword [esp + 0x3c], eax
jl 0x65606b
xor eax, eax
mov dword [esi], 0xffffffff
mov dword [edi], 0xffffffff
mov ecx, 0x14
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x14
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x2e8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x28
lea edi, [esp + 0x390]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x5d8]
mov dword [edx], 0xffffffff
rep stosd dword es:[edi], eax
mov edx, 0x64
lea ecx, [esp + 0x570]
call fcn.006526e0
mov edx, 0x64
lea ecx, [esp + 0x438]
call fcn.00652780
mov edx, 0x64
lea ecx, [esp + 0x4a0]
call fcn.006507c0
mov edx, 0x64
lea ecx, [esp + 0x508]
call fcn.00652830
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x6ba3e6
push ecx
call edi
test eax, eax
je 0x655c62
xor edx, edx
cmp eax, 5
setne dl
dec edx
and edx, 0xfffffffd
add edx, 0x360
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [esp + 0x14]
mov esi, 1
cmp eax, esi
jne 0x65605d
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x65605d
cmp eax, 0x1f3
ja 0x65605d
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x6ba3e6
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x1f4
call edi
test eax, eax
je 0x655cdb
xor ecx, ecx
cmp eax, 5
setne cl
dec ecx
and ecx, 0xfffffffd
add ecx, 0x360
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [esp + 0x14], esi
jne 0x65605d
mov esi, dword [esp + 0x18]
cmp esi, 4
jb 0x65605d
mov dl, byte [esp + 0xf0]
xor edi, edi
test esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0xf], dl
jle 0x655d6e
lea eax, [esp + 0x2e8]
lea ecx, [esp + 0xf0]
sub eax, ecx
mov dword [esp + 0x34], eax
jmp 0x655d20
cmp edi, 0xa2
jae 0x655d76
movsx eax, byte [esp + 0xf]
push eax
call fcn.006988b9
add esp, 4
test eax, eax
je 0x655d66
movsx eax, byte [esp + 0xf]
push eax
call fcn.0069849c
mov edx, dword [esp + 0x38]
add edx, ebx
add esp, 4
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + edx + 0xf0], al
mov al, byte [esp + ebx + 0xf0]
mov byte [esp + 0xf], al
jl 0x655d20
cmp edi, 0xa2
jae 0x655d76
mov byte [esp + edi + 0x2e8], 0
cmp edi, 4
jl 0x655df0
cmp edi, 0xa1
jg 0x655df0
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x655d8f
test al, al
jne 0x655df0
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2f0]
push eax
call fcn.00656cf0
test eax, eax
jne 0x655df0
mov ecx, dword [esp + 0x20]
cmp ecx, 2
jl 0x655df0
cmp ecx, 0x50
jg 0x655df0
cmp dword [esp + 0x38], ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
jge 0x655dd5
mov dword [esp + 0x10], 0x362
jmp 0x655df8
mov edi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x655df8
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x655e30
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x655e16
test al, al
je 0x655e16
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x655e00
jmp 0x655e30
cmp ebx, esi
jge 0x655e30
lea ebx, [ebx]
cmp al, 0x20
jne 0x655e30
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x655e20
mov cl, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], cl
jge 0x655e89
cmp edi, 0xa2
jae 0x655e91
movsx eax, byte [esp + 0xf]
push eax
call fcn.006988b9
add esp, 4
test eax, eax
je 0x655e81
movsx eax, byte [esp + 0xf]
push eax
call fcn.0069849c
mov dl, byte [esp + ebx + 0xf5]
add esp, 4
mov byte [esp + edi + 0x390], al
inc edi
inc ebx
cmp ebx, esi
mov byte [esp + 0xf], dl
jl 0x655e41
cmp edi, 0xa2
jae 0x655e91
mov byte [esp + edi + 0x390], 0
cmp edi, 4
jl 0x655f11
cmp edi, 0xa1
jg 0x655f11
mov al, byte [esp + 0xf]
cmp al, 0x20
je 0x655eaa
test al, al
jne 0x655f11
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x398]
push edx
mov edx, dword [esp + 0x38]
call fcn.00656cf0
test eax, eax
jne 0x655f11
mov ecx, dword [esp + 0x24]
cmp ecx, 2
jl 0x655f11
cmp ecx, 0x50
jg 0x655f11
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
cmp dword [esp + 0x30], ecx
jge 0x655ef3
mov dword [esp + 0x10], 0x362
jmp 0x655f21
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
jmp 0x655f21
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x655f21
mov dword [esp + 0x10], 0x361
cmp ebx, esi
jge 0x655f60
mov al, byte [esp + 0xf]
lea esp, [esp]
cmp al, 0x20
je 0x655f46
test al, al
je 0x655f46
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x655f30
jmp 0x655f60
cmp ebx, esi
jge 0x655f60
lea ebx, [ebx]
cmp al, 0x20
jne 0x655f60
mov al, byte [esp + ebx + 0xf1]
inc ebx
cmp ebx, esi
jl 0x655f50
mov al, byte [esp + ebx + 0xf0]
xor edi, edi
cmp ebx, esi
mov byte [esp + 0xf], al
jge 0x655f95
cmp edi, 0x1f3
jae 0x655f91
test al, al
je 0x655f91
mov byte [esp + edi + 0x5d8], al
mov al, byte [esp + ebx + 0xf1]
inc edi
inc ebx
cmp ebx, esi
jl 0x655f71
mov byte [esp + 0xf], al
lea eax, [esp + 0x570]
push eax
lea ecx, [esp + 0x5dc]
mov byte [esp + edi + 0x5dc], 0
push ecx
inc edi
call fcn.006978dd
add esp, 8
test eax, eax
je 0x65600e
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x5dc]
push eax
call fcn.006978dd
add esp, 8
test eax, eax
je 0x65600e
lea ecx, [esp + 0x4a0]
push ecx
lea edx, [esp + 0x5dc]
push edx
call fcn.006978dd
add esp, 8
test eax, eax
je 0x65600e
lea eax, [esp + 0x508]
push eax
lea ecx, [esp + 0x5dc]
push ecx
call fcn.006978dd
add esp, 8
test eax, eax
jne 0x656050
mov al, byte [esp + 0xf]
test al, al
jne 0x656050
cmp dword [esp + 0x3c], edi
mov edx, dword [ebp + 0x20]
mov dword [edx], edi
jge 0x656036
mov dword [esp + 0x10], 0x362
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, edi
mov edi, dword [ebp + 0x1c]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x5d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 0x361
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 0x1c