So first off, I'm not the best at masm, and I am still learning a lot about it. I was taking a look back at how tinba hides its registry values, and some things are baffling me here.
So whats I think is going on here is that its taking the dwIndex of the next item in the registry, popading it onto a register, and then putting that index in place of the old index in the registry, thus hiding it? A little bit of insight here would greatly help my skid mind out a bit.Code:; Hide Value (replace by next) inc p2 ; Next dwIndex inc nHdnCount ; Increase counter (for delta) popad jmp @RealRegEnumValue