Function at 0x77d09a36
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x160], eax
je 0x77d09a75
push 0x600
push dword [ebp + 0x10]
push eax
push esi
call fcn.77d09473
lea eax, [ebp - 0x158]
push eax
push 0x11e
lea eax, [ebp - 0x124]
push eax
push 1
push ebx
push esi
mov dword [ebp - 0x130], ebx
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jl 0x77d09cb8
push edi
mov edi, dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, 0xf003f
mov eax, dword [ebp - 0x110]
shr eax, 1
lea eax, [ebp + eax*2 - 0x10c]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d09cb7
mov word [eax], bx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0xe
lea eax, [ebp - 0x10c]
push 0x77ce19f8
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x77d09c82
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x150], 0x18
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
call edi
test eax, eax
jl 0x77d09c82
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x128]
call fcn.77ccb283
test byte [ebp - 0x154], 4
jne 0x77d09c76
cmp eax, ebx
jl 0x77d09c76
push 0xf
lea eax, [ebp - 0x10c]
push 0x77ce19d8
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d09ba0
push dword [ebp - 0x128]
call fcn.77d091c1
test eax, eax
je 0x77d09c76
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x150], 0x18
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x134], ebx
call edi
test eax, eax
jge 0x77d09c29
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x150]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
jl 0x77d09c76
push 2
push dword [ebp - 0x12c]
mov dword [ebp - 0x134], 1
call fcn.77d0918f
jmp 0x77d09c48
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x12c]
call fcn.77ccb283
test byte [ebp - 0x15c], 4
jne 0x77d09c62
cmp eax, ebx
jl 0x77d09c62
push dword [ebp - 0x134]
push dword [ebp + 0x10]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
call fcn.77d09a36
push dword [ebp - 0x128]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x12c]
jmp 0x77d09c7c
push dword [ebp - 0x128]
call dword [sym.imp.ntdll.dll_NtClose]
inc dword [ebp - 0x130]
lea eax, [ebp - 0x158]
push eax
push 0x11e
lea eax, [ebp - 0x124]
push eax
push 1
push dword [ebp - 0x130]
push dword [ebp - 0x138]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jge 0x77d09aac
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.77cc744e
leave
ret 0x10