Function at 0x61778806
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x6177d2e0]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x278]
push eax
push 0x20019
xor edi, edi
push edi
mov ebx, 0x61771e48
push ebx
push 0x80000002
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x274], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x61778885
cmp dword [0x6177d38c], edi
mov dword [ebp - 0x270], ebx
jbe 0x6177887e
push eax
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
xor eax, eax
jmp 0x61778bb4
push esi
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x278]
call fcn.61776e81
mov esi, eax
cmp esi, edi
je 0x617788f2
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x6177d38c], edi
mov dword [ebp - 0x270], ebx
jbe 0x61778bb1
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x61778bb1
cmp dword [ebp - 0x284], edi
mov dword [ebp - 0x280], edi
jbe 0x61778ba5
mov ebx, 0x6177d48c
lea eax, [ebp - 0x2a4]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x280]
mov dword [ebp - 0x290], 0x32
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, edi
je 0x6177894c
cmp esi, 0xea
jne 0x61778b55
lea eax, [ebp - 0x274]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x61778b78
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x28c]
push eax
push edi
push 0x61771e28
push dword [ebp - 0x274]
mov dword [ebp - 0x288], 0x202
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x61778ad0
cmp dword [ebp - 0x28c], 1
jne 0x61778ad0
cmp dword [ebp - 0x27c], edi
je 0x617789dc
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x61778a31
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
lea eax, [ebp - 0x26c]
push eax
call fcn.617756bf
cmp eax, edi
jne 0x61778a42
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6177d38c], edi
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], eax
jbe 0x61778a31
push 1
push 0x389
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e89
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventStringW
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61778b3b
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call fcn.61777983
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, edi
je 0x61778a99
cmp dword [0x6177d38c], edi
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], eax
jbe 0x61778a97
push 1
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e89
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventStringW
xor esi, esi
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x27c], edi
je 0x61778b3b
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x61778ba5
jmp 0x61778b3b
cmp dword [0x6177d38c], edi
mov dword [ebp - 0x270], 0x61771e28
jbe 0x61778afe
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
cmp dword [0x6177d38c], edi
lea eax, [ebp - 0x68]
mov dword [ebp - 0x270], eax
jbe 0x61778b2d
push 1
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e89
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventStringW
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
inc dword [ebp - 0x280]
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x284]
jb 0x61778909
jmp 0x61778ba5
cmp dword [0x6177d38c], edi
mov dword [ebp - 0x270], 0x61771e48
jbe 0x61778ba5
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e86
jmp 0x61778b98
cmp dword [0x6177d38c], edi
lea eax, [ebp - 0x68]
mov dword [ebp - 0x270], eax
jbe 0x61778ba5
push esi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.6177afa9
leave
ret 8