What does mov edi, ds:RegCloseKey actually do ?

Does it call RegCloseKey and the registry is "closed"?

The whole function looks like

call  ds:RegOpenKeyEXW    
test  eax,eax    
jnz   loc_12345    
push  push 300h    
lea   eax, [ebp-0C64h]
push  eax 
push  esi 
push  dword ptr [rbp-0C64h]
call  ds:RegEnumKeyW
mov   edi ds:RegCloseKey
  • it might use edi to call the function it is an optimisation if the function needs to called several times call edi takes less space than call regclosekey()
    – blabb
    Commented Jul 26, 2017 at 12:21
  • it's probably not "the whole function", please edit and add the rest.
    – Igor Skochinsky
    Commented Jul 27, 2017 at 12:24

2 Answers 2


No, it means it's storing the address for later use, what comes after that segment? Something in the line of "CALL EDI" I'm guessing.


It is certainly preparing to call it, we can speculate (why else reference it?).

RegCloseKey is simply used to close an open handle to the registry. It doesn't 'shut down' the registry, as your question seemed to imply (to me anyway). It is just another handle close function, but applies to registry handles. Those that come from any Registry function - RegOpenKey, RegCreateKeyEx, etc..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.