1

What does mov edi, ds:RegCloseKey actually do ?

Does it call RegCloseKey and the registry is "closed"?

The whole function looks like 

call  ds:RegOpenKeyEXW    
test  eax,eax    
jnz   loc_12345    
push  push 300h    
lea   eax, [ebp-0C64h]
push  eax 
push  esi 
push  dword ptr [rbp-0C64h]
call  ds:RegEnumKeyW
mov   edi ds:RegCloseKey
|improve this question
  • it might use edi to call the function it is an optimisation if the function needs to called several times call edi takes less space than call regclosekey() – blabb Jul 26 '17 at 12:21
  • it's probably not "the whole function", please edit and add the rest. – Igor Skochinsky♦ Jul 27 '17 at 12:24
2

No, it means it's storing the address for later use, what comes after that segment? Something in the line of "CALL EDI" I'm guessing.

|improve this answer
1

It is certainly preparing to call it, we can speculate (why else reference it?).

RegCloseKey is simply used to close an open handle to the registry. It doesn't 'shut down' the registry, as your question seemed to imply (to me anyway). It is just another handle close function, but applies to registry handles. Those that come from any Registry function - RegOpenKey, RegCreateKeyEx, etc..

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.