Function at 0x77304c58
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 9
pop ecx
mov dword [esi], 0x7730106c
lea eax, [esi + 0x3c]
mov dword [esi + 4], 0x77301194
mov dword [esi + 8], 0x77301140
mov dword [esi + 0xc], 0x7730115c
mov dword [esi + 0x10], 0x77301184
mov dword [esi + 0x14], 0x77301174
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [eax], ebx
lea eax, [eax + 8]
sub ecx, 1
jne 0x77304c9b
xor eax, eax
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x334], 0x3e8
mov dword [esi + 0x338], 0x32
mov dword [esi + 0x320], 0x7a120
mov dword [esi + 0x324], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x360], ebx
mov word [esi + 0x348], ax
mov dword [esi + 0x328], ebx
mov dword [esi + 0x330], ebx
mov dword [esi + 0x37c], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf8], 0x1312d00
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x2f0], ebx
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f8], ebx
mov dword [esi + 0x2fc], ebx
mov dword [esi + 0x32c], ebx
mov dword [esi + 0x344], 1
mov dword [esi + 0x36c], ebx
mov dword [esi + 0x370], 6
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x358], ebx
mov dword [esi + 0x35c], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x34c], ebx
mov dword [esi + 0x354], 0xa
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov word [esi + 0x380], bx
lock inc dword [0x7732e06c]
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x20019
push ebx
push 0x773020a4
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x77304e6f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x773020dc
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x77304e66
mov eax, dword [ebp - 0xc]
cmp eax, 2
jb 0x77304e59
push 0x64
pop ecx
cmp eax, ecx
ja 0x77304e60
cmp eax, 2
jae 0x77304e5e
push 2
pop ecx
jmp 0x77304e60
mov ecx, eax
mov dword [esi + 0x354], ecx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [esi + 0x24c]
mov dword [esi + 0x230], ebx
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 1
lea eax, [esi + 0x264]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 2
lea eax, [esi + 0x27c]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 4
lea eax, [esi + 0x294]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 0x10
lea eax, [esi + 0x2ac]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 0x20
lea eax, [esi + 0x234]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 0x200
lea eax, [esi + 0x2c4]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
or dword [esi + 0x230], 0x100
lea eax, [esi + 0x15c]
push 0xd4
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esi + 0x40]
mov dword [eax], ebx
inc ebx
lea eax, [eax + 8]
cmp ebx, 9
jb 0x77304f1f
mov ecx, esi
call fcn.77304f37
mov eax, esi
pop esi
pop ebx
leave
ret