Function at 0x77c9ba3f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, dword [ebp - 0x20]
lea eax, [edi + 2]
cmp edi, eax
jae 0x77c9c258
cmp dword [ebp - 0x2c], 0
jne 0x77cdd83e
push edi
push 0x51d
push esi
call fcn.77c9e393
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x77c9c250
push eax
jmp 0x77c9bb37
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], ebx
je 0x77c9c22e
cmp esi, 0xffffffff
je 0x77c9c22e
cmp edi, ebx
je 0x77c9c22e
cmp eax, ebx
je 0x77c9c22e
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.77c9ae1b
test eax, eax
jne 0x77cdd80a
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push edi
push esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], ebx
call fcn.77c98b3c
cmp eax, ebx
jne 0x77cdd80f
push 4
pop esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d1a0f0]
mov dword [ebp - 0x20], esi
push dword [ebp - 0x18]
call fcn.77c9b833
test eax, eax
jne 0x77c9c235
cmp dword [ebp - 0x1c], esi
jne 0x77c9c235
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d1a140]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x18]
call fcn.77c9b833
mov esi, 0x77cb4db8
mov ebx, 0xea
cmp eax, ebx
je 0x77c9c1d4
test eax, eax
jne 0x77c9c217
cmp dword [ebp - 0x1c], 1
jne 0x77c9c245
and dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d1a158]
push dword [ebp - 0x18]
call fcn.77c9b833
mov edi, eax
cmp edi, ebx
je 0x77c9ba05
test edi, edi
jne 0x77c9bb99
mov eax, dword [ebp - 0x1c]
dec eax
je 0x77c9bb77
dec eax
jne 0x77cdd851
lea eax, [ebp - 0x2c]
push eax
call fcn.77c9b004
mov edi, eax
test edi, edi
jne 0x77c9bb99
push 1
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push dword [ebp - 0x2c]
push eax
call fcn.77c9bc5d
test eax, eax
mov dword [ebp - 0x30], eax
je 0x77cdd859
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x20], ecx
push dword [ebp - 0x24]
push 0x53f
push esi
call fcn.77c9e3db
push dword [ebp - 0x2c]
push 0x540
push esi
call fcn.77c9e3db
test edi, edi
jne 0x77c9bc2c
mov edi, 0x418
push edi
push 0x544
push esi
call fcn.77c9e393
mov ebx, eax
test ebx, ebx
je 0x77c9c262
and dword [ebp - 0x28], 0
push edi
push 0
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
inc dword [ebp - 0x28]
test eax, eax
jl 0x77c9bc13
push dword [ebp - 0x30]
lea eax, [ebx + 0x10]
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x18]
call fcn.77c9b4e5
jmp 0x77c9bbd8
cmp eax, 0x8000001a
jne 0x77cdd866
xor edi, edi
push ebx
push 0x55c
push esi
call fcn.77c9e3db
push dword [ebp - 0x18]
call fcn.77c98bb1
test edi, edi
jne 0x77cdd874
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 0xc
mov edi, dword [ebp - 0x20]
lea eax, [edi + 2]
cmp edi, eax
jae 0x77c9c217
cmp dword [ebp - 0x24], 0
jne 0x77cdd82b
push edi
push 0x4f8
push esi
call fcn.77c9e393
test eax, eax
mov dword [ebp - 0x24], eax
je 0x77c9c23d
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d1a140]
push dword [ebp - 0x18]
call fcn.77c9b833
jmp 0x77c9bb17
push dword [ebp - 0x24]
push 0x50b
push esi
call fcn.77c9e3db
and dword [ebp - 0x24], 0
jmp 0x77c9bb31
push 0x57
jmp 0x77cdd80c
mov dword [ebp - 0x28], ebx
jmp 0x77c9baf3
push 0xe
pop eax
jmp 0x77c9bb17
cmp dword [ebp - 0x1c], 2
jne 0x77c9c217
jmp 0x77c9bb31
push 0xe
pop edi
jmp 0x77c9bb4f
mov edi, 0x216
jmp 0x77c9bb99
push 0xe
pop edi
jmp 0x77c9bc2c
push 0xd
pop edi
jmp 0x77cdd874
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push esi
call fcn.77c98b3c
mov edi, eax
cmp edi, ebx
je 0x77c9bac2
jmp 0x77cdd874
push dword [ebp - 0x24]
push 0x4f6
push esi
call fcn.77c9e3db
jmp 0x77c9c1e8
push dword [ebp - 0x2c]
push 0x51b
push esi
call fcn.77c9e3db
jmp 0x77c9ba1d
push 0xd
pop edi
jmp 0x77c9bb99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77c9bb99
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
jmp 0x77c9bc20
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77c9bc3c