Function at 0x617781b1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x6177d2e0]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x2dc]
push eax
mov ebx, 0x61771e48
push ebx
xor esi, esi
push 0x80000002
mov dword [ebp - 0x2dc], esi
mov dword [ebp - 0x2d8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
cmp edi, esi
je 0x61778236
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x2d4], ebx
jbe 0x6177822f
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
mov eax, edi
jmp 0x617785d7
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x2dc]
call fcn.61776e81
mov edi, eax
cmp edi, esi
je 0x61778271
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61778205
xor ebx, ebx
cmp dword [ebp - 0x2f4], esi
mov dword [ebp - 0x2d8], esi
jbe 0x617783f8
lea eax, [ebp - 0x30c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xcc]
push eax
push ebx
push dword [ebp - 0x2dc]
mov dword [ebp - 0x2ec], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
je 0x617782c6
cmp edi, 0xea
jne 0x6177836b
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
cmp edi, esi
jne 0x6177838e
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2fc]
push eax
push esi
push 0x61771e28
push dword [ebp - 0x2d8]
mov dword [ebp - 0x2e8], 0x202
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x617783c6
push dword [ebp - 0x2f0]
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x617783f6
push dword [ebp - 0x2d8]
mov edi, 0x389
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [ebp - 0x2f4]
mov dword [ebp - 0x2d8], esi
jb 0x61778285
jmp 0x617783f8
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x2d4], 0x61771e48
jbe 0x617783f8
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e86
jmp 0x617783e7
cmp dword [0x6177d38c], esi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x2d4], eax
jbe 0x617783be
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
mov dword [ebp - 0x2d8], esi
jmp 0x617783f8
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x2d4], 0x61771e28
jbe 0x617783f8
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x617783f8
xor edi, edi
push dword [ebp - 0x2dc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp edi, esi
je 0x61778423
cmp dword [ebp - 0x2d8], esi
je 0x6177822f
push dword [ebp - 0x2d8]
call ebx
jmp 0x6177822f
cmp dword [0x6177d364], esi
mov dword [ebp - 0x2e4], esi
jbe 0x61778509
lea eax, [ebp - 0x30c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2e4]
mov dword [ebp - 0x2ec], 0xc8
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
je 0x6177847b
cmp edi, 0xea
jne 0x6177853b
mov ebx, dword [ebp - 0x2e0]
push ebx
push 0x2001f
push esi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x6177856d
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x2fc]
push eax
push esi
push 0x61771bc0
push dword [ebx]
mov dword [ebp - 0x2e8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x61778592
mov eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp + 0xc]
je 0x6177850f
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x2e4]
mov dword [ebx], esi
cmp eax, dword [0x6177d364]
jb 0x61778435
mov ebx, dword [ebp - 0x2e0]
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
mov eax, dword [ebx]
je 0x617785c9
cmp eax, esi
je 0x6177822f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebx], esi
jmp 0x6177822f
cmp dword [0x6177d38c], esi
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2d4], eax
jbe 0x61778509
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e86
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x61778509
cmp dword [0x6177d38c], esi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x2d4], eax
jbe 0x6177850f
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e84
jmp 0x617785b7
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x2d4], 0x61771bc0
jbe 0x6177850f
push edi
lea eax, [ebp - 0x2d4]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x6177850f
neg eax
sbb eax, eax
and eax, 0xfffffc77
add eax, 0x389
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.6177afa9
leave
ret 0xc