Function at 0x77d02dff
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov ebx, 0x2000000
je 0x77d02e50
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push ebx
push 8
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.ADVAPI32.dll_RegOpenKeyExW
cmp eax, esi
jne 0x77d03226
jmp 0x77d02e56
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
lea eax, [ebp - 0x34]
push eax
push 0xc
lea eax, [ebp - 0x60]
push eax
push 5
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, esi
jge 0x77d02eeb
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], esi
je 0x77d02ec5
cmp dword [ebp - 4], esi
je 0x77d02eb8
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0xc], esi
je 0x77d02ec5
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x18], esi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x77d031ac
push dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
jmp 0x77d031ac
test byte [ebp - 0x5c], 2
je 0x77d02efa
mov dword [ebp + 8], 0x57
jmp 0x77d02ea6
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
je 0x77d02f5b
inc dword [ebp - 8]
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x77d02f30
mov dword [ebp + 8], 8
jmp 0x77d02ea6
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov word [ecx + eax*2], si
cmp dword [ebp + 0x10], esi
je 0x77d02f90
xor eax, eax
test byte [ebp - 0x5c], 1
je 0x77d02f69
inc eax
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push ebx
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sym.ADVAPI32.dll_RegCreateKeyExW
cmp eax, esi
mov dword [ebp + 8], eax
je 0x77d03073
jmp 0x77d02ea6
mov eax, dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x34]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
mov dword [ebp - 0xc], eax
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d031a6
cmp dword [ebp - 8], esi
jne 0x77d02fc6
cmp dword [ebp - 0x10], esi
je 0x77d03073
inc dword [ebp - 0x10]
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x77d02ff1
mov dword [ebp + 8], 8
jmp 0x77d02ec5
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ec5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov word [ecx + eax*2], si
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x77d03030
mov dword [ebp + 8], 0x57
jmp 0x77d02ec5
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
lea eax, [ebp - 0x54]
push eax
call ebx
cmp eax, esi
jge 0x77d03052
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
jmp 0x77d02ec5
push dword [ebp - 0x18]
lea eax, [ebp - 0x4c]
push eax
call ebx
cmp eax, esi
jl 0x77d03043
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0x77d03024
cmp dword [ebp - 0x2c], esi
je 0x77d030c7
mov eax, dword fs:[0x18]
push dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x24], eax
je 0x77d02f24
lea ecx, [ebp - 0x2c]
push ecx
push eax
push 4
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegGetKeySecurity
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
push dword [ebp - 0x24]
push 4
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegSetKeySecurity
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
cmp dword [ebp - 0x30], esi
je 0x77d030e9
mov eax, dword fs:[0x18]
push dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x1c], eax
je 0x77d02f24
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x77d03135
inc eax
inc eax
cmp eax, 2
mov dword [ebp - 0x20], eax
jb 0x77d02f24
lea ecx, [eax + 1]
cmp ecx, eax
jbe 0x77d02f24
lea eax, [eax + eax + 2]
cmp eax, 2
jbe 0x77d02f24
mov ecx, dword fs:[0x18]
push eax
mov eax, dword [ecx + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x28], eax
je 0x77d02f24
mov eax, dword [ebp - 0x20]
xor ebx, ebx
cmp dword [ebp - 0x40], esi
ja 0x77d03144
jmp 0x77d02ec5
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegEnumValueW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
mov eax, dword [ebp - 0x38]
mov word [edi + eax*2], si
push dword [ebp - 0x3c]
push dword [ebp - 0x1c]
push dword [ebp - 0x44]
push esi
push edi
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegSetValueExW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d02ea6
inc ebx
cmp ebx, dword [ebp - 0x40]
jae 0x77d02ec5
jmp 0x77d03141
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x14], esi
je 0x77d031c3
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x24], esi
je 0x77d031da
push dword [ebp - 0x24]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x1c], esi
je 0x77d031f1
push dword [ebp - 0x1c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x28], esi
je 0x77d03208
push dword [ebp - 0x28]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp + 0x10], esi
pop edi
je 0x77d03223
cmp dword [ebp + 8], esi
jne 0x77d03223
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 0x14