Function at 0x77c992b5
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xb0
push 0x77c996a0
call fcn.77cc73d0
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x28], ebx
push 0x77c99588
lea eax, [ebp - 0x80]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call esi
push 0x77c99568
lea eax, [ebp - 0x74]
push eax
call esi
mov dword [ebp - 4], ebx
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push 4
pop esi
push esi
push 0x77d1e788
push esi
push esi
push 0x77c995f0
call fcn.77c9a420
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d1e7ac
push esi
push esi
push 0x77c99610
call fcn.77c9a420
mov dword [ebp - 0x24], 0x2710
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d1e7b8
push esi
push esi
push 0x77c99638
call fcn.77c9a420
mov dword [ebp - 0x24], 0x1d4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d1e784
push esi
push esi
push 0x77c99668
call fcn.77c9a420
cmp dword [ebp - 0x34], ebx
je 0x77c9938a
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [0x77d1e664], ebx
jne 0x77c993a2
push 0x77c99690
push ebx
call sym.ADVAPI32.dll_RegisterEventSourceW
mov dword [0x77d1e664], eax
mov word [ebp - 0x20], bx
mov eax, dword [ebp - 0x72]
add eax, 0x202
mov word [ebp - 0x1e], ax
movzx eax, ax
push eax
push 0x52d
mov esi, 0x77c9a6a8
push esi
call fcn.77c9e393
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64], 0x18
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], 0x40
lea eax, [ebp - 0x80]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x64]
push eax
push 0x20019
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov eax, 0x218
push eax
push 0x534
push esi
call fcn.77c9e393
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x4a], 0x200
push 0x200
push 0x537
push esi
call fcn.77c9e393
mov dword [ebp - 0x48], eax
mov word [ebp - 0x6a], 0x100
push 0x100
push 0x539
push esi
call fcn.77c9e393
mov dword [ebp - 0x68], eax
cmp edi, ebx
jl 0x77c9c26a
cmp dword [ebp - 0x1c], ebx
je 0x77c9c26a
cmp dword [ebp - 0x2c], ebx
je 0x77c9c26a
cmp dword [ebp - 0x48], ebx
je 0x77c9c26a
cmp eax, ebx
je 0x77c9c26a
mov dword [ebp - 0x44], ebx
cmp edi, ebx
jl 0x77c9c26a
lea eax, [ebp - 0x78]
push eax
mov eax, 0x218
push eax
push dword [ebp - 0x2c]
push ebx
push dword [ebp - 0x44]
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
inc dword [ebp - 0x44]
cmp eax, ebx
jl 0x77c9c26a
mov ecx, dword [ebp - 0x2c]
movzx eax, word [ecx + 0xc]
lea edx, [eax + 2]
cmp word [ebp - 0x1e], dx
jb 0x77c9955d
mov word [ebp - 0x20], ax
movzx eax, ax
push eax
add ecx, 0x10
push ecx
push dword [ebp - 0x1c]
call sub.ntdll.dll_memmove
add esp, 0xc
movzx eax, word [ebp - 0x20]
shr eax, 1
mov dword [ebp - 0x3c], eax
lea edi, [eax + eax]
mov eax, dword [ebp - 0x1c]
mov word [edi + eax], bx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov dword [ebp - 0x64], 0x18
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], 0x40
lea eax, [ebp - 0x20]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x64]
push eax
push 0x2001f
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jge 0x77c99538
lea eax, [ebp - 0x64]
push eax
push 0x20019
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x77c996bc
mov eax, dword [0x77d1f248]
and al, 0xf
cmp al, 1
jae 0x77cdefdf
cmp dword [ebp - 0x30], 0xc0000034
jne 0x77cdf006
xor edi, edi
jmp 0x77c9946f
mov eax, dword [ebp - 0x1c]
mov word [edi + eax], bx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call fcn.77c99714
cmp eax, ebx
je 0x77c9bff3
cmp byte [eax + 0x1cc], bl
je 0x77c9c003
mov edx, dword [0x77d1e66c]
cmp edx, ebx
je 0x77c9a9aa
mov ecx, dword [ebp - 0x40]
cmp ecx, ebx
je 0x77c9a9c1
mov dword [ecx], eax
mov dword [ebp - 0x40], eax
inc dword [0x77d1e674]
jmp 0x77c9955d
mov dword [0x77d1e66c], eax
mov dword [ebp - 0x40], eax
mov dword [0x77d1e674], 1
jmp 0x77c9955d
mov dword [eax], edx
mov dword [0x77d1e66c], eax
jmp 0x77c99704
mov eax, dword [0x77d1f248]
and al, 0xf
cmp al, 1
jb 0x77c9c003
jmp 0x77cdefba
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77c9955d
mov dword [ebp - 4], 0xfffffffe
call fcn.77c9c281
call fcn.77cc73b0
ret
push ebx
movzx eax, word [ebp - 0x1e]
push eax
push dword [ebp - 0x1c]
push ebx
push 1
push 0x13
push 0x58e
push 0x77ce207c
call fcn.77d1169e
add esp, 0x20
jmp 0x77c9c003
push ebx
movzx eax, word [ebp - 0x1e]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push 1
push 0x13
push 0x599
push 0x77ce207c
call fcn.77d1169e
add esp, 0x20
jmp 0x77c99550
push 0x77d1a5a0
push ebx
mov edi, 0x800007d1
push edi
call fcn.77ccbc5e
test eax, eax
je 0x77c9955d
cmp dword [0x77d1e788], 2
jl 0x77c9955d
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x30]
call fcn.77c9e871
mov dword [ebp - 0xa0], eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
push 2
pop eax
cmp dword [0x77d1e788], eax
jl 0x77cdf05a
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], edx
lea edx, [ebp - 0xa0]
push edx
lea edx, [ebp - 0xc0]
push edx
mov edx, dword [ebp - 0x3c]
shl edx, 2
push edx
push ecx
push ebx
push edi
push ebx
push eax
push dword [0x77d1e664]
call sym.ADVAPI32.dll_ReportEventW
jmp 0x77c9955d