Function at 0x77d15ade
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
test word [ebp + 0x14], 0x200
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc2c], esi
mov dword [ebp - 0xc38], ebx
je 0x77d15b21
push ebx
push esi
call fcn.77d15938
test eax, eax
jne 0x77d15b21
xor eax, eax
jmp 0x77d15d4b
test word [ebp + 0x14], 0x400
jne 0x77d15b31
xor eax, eax
inc eax
jmp 0x77d15d4b
test byte [ebp + 0x14], 0x80
je 0x77d15b79
and dword [ebp - 0xc20], 0
and dword [ebp - 0xc24], 0
lea eax, [ebp - 0xc20]
push eax
push esi
call fcn.77cd9344
test eax, eax
jl 0x77d15b1a
lea eax, [ebp - 0xc24]
push eax
push ebx
call fcn.77cd9344
test eax, eax
jl 0x77d15b1a
test byte [ebp - 0xc20], 2
jne 0x77d15b79
test byte [ebp - 0xc24], 2
je 0x77d15b29
and dword [ebp - 0xc20], 0
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
push edi
lea eax, [ebp - 0xc28]
push eax
mov edi, 0xc16
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push 0
jmp 0x77d15c3c
mov eax, dword [ebp - 0xc0c]
shr eax, 1
lea eax, [ebp + eax*2 - 0xc08]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d15c47
and word [eax], 0
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test word [ebp + 0x14], 0x100
je 0x77d15c01
push 0xc
lea eax, [ebp - 0xc08]
push 0x77d15d98
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d15c01
cmp dword [ebp - 0xc10], 2
jbe 0x77d15c1f
test byte [ebp + 0x14], 0x20
jne 0x77d15c1f
lea eax, [ebp - 0xc34]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
test eax, eax
jne 0x77d15c1f
dec dword [ebp - 0xc20]
inc dword [ebp - 0xc20]
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push dword [ebp - 0xc20]
push ebx
call esi
test eax, eax
jge 0x77d15ba4
and dword [ebp - 0xc20], 0
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push dword [ebp - 0xc20]
push dword [ebp - 0xc2c]
call esi
mov ebx, eax
cmp ebx, 0x80000005
jne 0x77d15c89
push 0x77d15d5c
push 1
push 0x68
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0xc
test ebx, ebx
jl 0x77d15d47
mov eax, dword [ebp - 0xc0c]
shr eax, 1
lea eax, [ebp + eax*2 - 0xc08]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d15d47
movzx ebx, word [eax]
and word [eax], 0
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test word [ebp + 0x14], 0x100
je 0x77d15cf1
push 0xc
lea eax, [ebp - 0xc08]
push 0x77d15d98
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d15cf1
cmp dword [ebp - 0xc10], 2
jbe 0x77d15d38
mov eax, dword [ebp - 0xc0c]
shr eax, 1
mov word [ebp + eax*2 - 0xc08], bx
push dword [ebp - 0xc10]
mov eax, dword [ebp - 0xc14]
lea eax, [ebp + eax - 0xc1c]
push eax
push dword [ebp - 0xc18]
lea eax, [ebp - 0xc34]
push dword [ebp - 0xc1c]
push eax
push dword [ebp - 0xc38]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
jl 0x77d15d43
inc dword [ebp - 0xc20]
jmp 0x77d15c4e
xor eax, eax
jmp 0x77d15d4a
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x10