Function at 0x4777b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1430
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x60b]
push ebx
push eax
mov dword [ebp - 0x141c], ebx
mov byte [ebp - 0x60c], bl
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x507]
push ebx
push ecx
mov byte [ebp - 0x508], bl
call fcn.005dfd60
add esp, 0x18
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 0x141c]
push edx
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x4778bc
lea eax, [ebp - 0x141c]
push eax
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
cmp esi, ebx
jne 0x4778bc
push str._sysdir_.EXE_
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x508]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x141c]
inc eax
push eax
lea eax, [ebp - 0x508]
push eax
push 1
push ebx
lea ecx, [ebp - 0x60c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x141c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x141c]
push ecx
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
mov esi, eax
mov eax, dword [0x72c28c]
cmp eax, ebx
je 0x4778d4
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c28c], ebx
mov ecx, 0x7333f8
call fcn.004fb1f0
cmp dword [0x6873e0], ebx
jne 0x47792e
mov eax, dword [0x72c290]
cmp eax, ebx
je 0x47792e
push eax
call fcn.004dd6c0
add eax, 0x104
push eax
call fcn.005e20e4
add esp, 8
mov dword [0x72c294], eax
cmp eax, ebx
je 0x47791a
mov edx, dword [0x72c290]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x72c290]
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c290], ebx
cmp esi, ebx
jne 0x477c30
push edi
push 0x3ff
lea ecx, [ebp - 0x1013]
push ebx
push ecx
call fcn.005dfd60
push 0x3ff
lea edx, [ebp - 0x403]
push ebx
push edx
call fcn.005dfd60
add esp, 0x18
lea eax, [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1014]
push ecx
mov ecx, dword [ebp - 0x141c]
push ebx
push ebx
lea edx, [ebp - 0x1428]
push edx
lea eax, [ebp - 0x404]
push eax
push ebx
mov edi, 0x400
push ecx
mov dword [ebp - 0x1430], ebx
mov byte [ebp - 0x1014], bl
mov byte [ebp - 0x404], bl
mov dword [ebp - 0x1428], edi
mov dword [ebp - 0x142c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x477c2f
jmp 0x4779c0
cmp byte [ebp - 0x404], bl
je 0x477bd1
push 0x3ff
lea edx, [ebp - 0xa0b]
push ebx
push edx
mov byte [ebp - 0xa0c], bl
call fcn.005dfd60
lea eax, [ebp - 0x404]
push eax
call fcn.004dd6c0
lea ecx, [ebp - 0x404]
dec ecx
add esp, 0x10
cmp byte [eax + ecx], 0x5c
jne 0x477a25
cmp dword [0x685bc8], ebx
je 0x477bd1
push ebx
push 0x2c
lea edx, [ebp - 0x404]
push edx
push 0x72c290
call fcn.004e5820
jmp 0x477bd1
cmp dword [0x685b9c], ebx
je 0x477bd1
push 1
lea eax, [ebp - 0x404]
push eax
call fcn.00515650
lea ecx, [ebp - 0x404]
push 0x5c
push ecx
call fcn.005e0a00
mov esi, eax
add esp, 8
lea ecx, [ebp - 0x404]
cmp esi, ebx
je 0x477a93
movzx edx, byte [esi + 1]
inc esi
push edi
lea eax, [ebp - 0xa0c]
push eax
push ecx
mov byte [ebp - 0x141d], dl
mov byte [esi], bl
call fcn.004e82a0
movzx edx, byte [ebp - 0x141d]
add esp, 0xc
push esi
lea eax, [ebp - 0xa0c]
push eax
mov byte [esi], dl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x477aa1
push ecx
lea edx, [ebp - 0xa0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x11
mov esi, str._sysdir_.EXE___windir_.EXE___sysdir_drivers.SYS__sysdir_.DLL
lea edi, [ebp - 0x1414]
rep movsd dword es:[edi], dword [esi]
push 0x3ba
lea eax, [ebp - 0x13ce]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.005dfd60
push 1
push ebx
push 0x2c
lea ecx, [ebp - 0x1418]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x1414]
push eax
mov dword [ebp - 0x1418], ebx
call fcn.004e1380
or esi, 0xffffffff
add esp, 0x24
cmp dword [ebp - 0x1418], esi
je 0x477b56
lea ebx, [ebx]
push 1
lea ecx, [ebp - 0x404]
push ecx
call fcn.00515650
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0xa0c]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x477ba2
push 1
push ebx
push 0x2c
lea ecx, [ebp - 0x1418]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x1414]
push eax
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x1418], esi
jne 0x477b00
push ebx
push 0x2c
lea ecx, [ebp - 0xa0c]
push ecx
push 0x72c28c
call fcn.004e5820
push 2
lea edx, [ebp - 0xa0c]
push 0x63275c
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x477bd1
cmp byte [ebp - 0xa0a], bl
je 0x477bd1
push 1
push ebx
lea eax, [ebp - 0xa0a]
push eax
mov ecx, 0x7333f8
call fcn.004f2b40
jmp 0x477bd1
lea ecx, [ebp - 0xa0c]
push ecx
lea edx, [ebp - 0xc14]
push str.__s__value_IGNORED___
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0xc14]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [ebp - 0x1430]
lea ecx, [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1014]
push edx
push ebx
push ebx
lea ecx, [ebp - 0x1428]
push ecx
inc eax
lea edx, [ebp - 0x404]
push edx
push eax
mov dword [ebp - 0x1430], eax
mov eax, dword [ebp - 0x141c]
mov edi, 0x400
push eax
mov byte [ebp - 0x1014], bl
mov byte [ebp - 0x404], bl
mov dword [ebp - 0x1428], edi
mov dword [ebp - 0x142c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4779c0
pop edi
mov eax, dword [ebp - 0x141c]
cmp eax, ebx
je 0x477c47
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x141c], ebx
lea ecx, [ebp - 0x1424]
push ecx
mov dword [ebp - 0x1424], ebx
call fcn.0044fc20
mov eax, dword [ebp - 0x1424]
add esp, 4
cmp eax, ebx
je 0x477ced
cmp byte [eax], bl
je 0x477ced
push 1
push ebx
push 0x2c
lea edx, [ebp - 0x1418]
push edx
lea ecx, [ebp - 0xb10]
push ecx
push eax
mov dword [ebp - 0x1418], ebx
call fcn.004e1380
or esi, 0xffffffff
add esp, 0x18
cmp dword [ebp - 0x1418], esi
je 0x477cde
nop
push ebx
push 0x2c
lea edx, [ebp - 0xb10]
push edx
push 0x72c290
call fcn.004e5820
mov edx, dword [ebp - 0x1424]
push 1
push ebx
push 0x2c
lea eax, [ebp - 0x1418]
push eax
lea ecx, [ebp - 0xb10]
push ecx
push edx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x1418], esi
jne 0x477ca0
mov eax, dword [ebp - 0x1424]
push eax
call fcn.005e0865
add esp, 4
cmp dword [0x6873e0], ebx
jne 0x477d51
mov ecx, dword [0x72c290]
mov eax, dword [0x72c294]
cmp ecx, ebx
jne 0x477d08
cmp eax, ebx
je 0x477d47
xor esi, esi
cmp ecx, ebx
jne 0x477d14
cmp eax, ebx
je 0x477d18
jmp 0x477d2b
cmp eax, ebx
je 0x477d4c
push ecx
push eax
call fcn.004dd620
add esp, 8
test eax, eax
mov eax, dword [0x72c294]
je 0x477d30
mov esi, 1
cmp eax, ebx
je 0x477d43
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c294], ebx
cmp esi, ebx
jne 0x477d4c
cmp dword [ebp + 0xc], ebx
je 0x477d51
call fcn.004776e0
cmp dword [0x6873e0], 1
jne 0x477d60
mov dword [0x6873e0], ebx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00467c90
add esp, 4
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret