format PE GUI 4.0
entry start

include '%fasminc%\win32a.inc'

section '.data' data readable writeable
    caption db	 "Parseri testfail!",0
    message rb	 400h
    nameK   db	 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",0
    EndK    rb	 256

    val     db	 "DisplayName",0 ;Searching for Uninstall DisplayName - some have it, others don't
    typ     dd	 ?
   ;dat     dd   ? ;data should be appended to esi that is to [message]
    len     dd	 ?

    res     dd	 ?
    res2    dd	 ?

section '.code' code readable executable
start:
    INT3
    mov    esi,message
    invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,nameK,0,KEY_ALL_ACCESS,res ;Everything allowed until I get this to work
    mov    [EndK-1],"\" ;Joining: nameK + "\" + EndK - the result is a subkey like ...Uninstall\7-Zip
    or	   edi,-1
    xor    ecx,ecx
enum:
    inc    edi
    mov    [EndK],0
    invoke RegEnumKey,[res],edi,EndK,1000h
    cmp    [EndK],0
    je	   exit
    invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,nameK,0,KEY_ALL_ACCESS,res2
    ;Here we have opened another Key that is the long one
    invoke RegQueryValueEx,[res2],val,0,typ,esi,len ;This doesn't return DisplayName's data as it should
    ;Debugging shows that advapi and ntdll are aware of correct unicode strings, but they never make it here.
    cmp    [len],0
    je	   enum
    mov    [esi+ecx],word 0A0Dh
    lea    esi,[esi+ecx+2]
    ror    edi,1
    rcl    edi,1
    jc	   enum
    mov    [esi-2],word 0909h
    jmp    enum
exit:
    ;invoke MessageBox,0,message,caption,0
    invoke ExitProcess,0

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL',\
	  user,'USER32.DLL',\
	  advapi,'ADVAPI32.DLL'

  import kernel,\
	 ExitProcess,'ExitProcess'

  import user,\
	 MessageBox,'MessageBoxA'

  import advapi,\
	 RegOpenKeyEx,'RegOpenKeyExA',\
	 RegEnumKey,'RegEnumKeyA',\
	 RegQueryValueEx,'RegQueryValueExA'