Function at 0x77d16098
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x160], eax
je 0x77d160d7
push 0x600
push dword [ebp + 0x10]
push eax
push esi
call fcn.77d15ade
lea eax, [ebp - 0x158]
push eax
push 0x11e
lea eax, [ebp - 0x124]
push eax
push 1
push ebx
push esi
mov dword [ebp - 0x130], ebx
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jl 0x77d1631a
push edi
mov edi, dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, 0xf003f
mov eax, dword [ebp - 0x110]
shr eax, 1
lea eax, [ebp + eax*2 - 0x10c]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d16319
mov word [eax], bx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0xe
lea eax, [ebp - 0x10c]
push 0x77cf01f8
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x77d162e4
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x150], 0x18
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
call edi
test eax, eax
jl 0x77d162e4
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x128]
call fcn.77cd9344
test byte [ebp - 0x154], 4
jne 0x77d162d8
cmp eax, ebx
jl 0x77d162d8
push 0xf
lea eax, [ebp - 0x10c]
push 0x77cf01d8
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d16202
push dword [ebp - 0x128]
call fcn.77d1582d
test eax, eax
je 0x77d162d8
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x150], 0x18
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x134], ebx
call edi
test eax, eax
jge 0x77d1628b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
jl 0x77d162d8
push 2
push dword [ebp - 0x12c]
mov dword [ebp - 0x134], 1
call fcn.77cd7dbf
jmp 0x77d162aa
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x12c]
call fcn.77cd9344
test byte [ebp - 0x15c], 4
jne 0x77d162c4
cmp eax, ebx
jl 0x77d162c4
push dword [ebp - 0x134]
push dword [ebp + 0x10]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
call fcn.77d16098
push dword [ebp - 0x128]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x12c]
jmp 0x77d162de
push dword [ebp - 0x128]
call dword [sym.imp.ntdll.dll_NtClose]
inc dword [ebp - 0x130]
lea eax, [ebp - 0x158]
push eax
push 0x11e
lea eax, [ebp - 0x124]
push eax
push 1
push dword [ebp - 0x130]
push dword [ebp - 0x138]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jge 0x77d1610e
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.77cd6011
leave
ret 0x10