Function at 0x61777983
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x6177d2e0]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [0x6177d364], ebx
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2e8], ebx
jbe 0x61777e06
push esi
push edi
lea eax, [ebp - 0x324]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2e8]
mov dword [ebp - 0x30c], 0x64
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x2d4], eax
je 0x61777a1d
cmp eax, 0xea
jne 0x61777d67
lea eax, [ebp - 0x2dc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov dword [ebp - 0x2d4], eax
jne 0x61777d9e
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x2dc]
call fcn.61776e81
cmp eax, ebx
mov dword [ebp - 0x2d4], eax
jne 0x61777d9e
push dword [ebp - 0x2f4]
push 8
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x2f0], eax
je 0x61777dc8
mov dword [0x6177d1e4], eax
lea eax, [ebp - 0x2f0]
xor edi, edi
cmp dword [0x6177d1d0], ebx
mov dword [0x6177d1e8], eax
je 0x61777b9e
mov eax, 0x6177d1d0
mov esi, 0x6177d1dc
mov ecx, dword [esi]
push 4
pop edx
cmp ecx, edx
jne 0x61777adb
mov dword [ebp - 0x2ec], edx
jmp 0x61777aef
cmp ecx, 1
mov ecx, dword [ebp - 0x2f4]
jne 0x61777ae9
add ecx, 2
mov dword [ebp - 0x2ec], ecx
lea ecx, [ebp - 0x2ec]
push ecx
push dword [esi - 8]
lea ecx, [ebp - 0x310]
push ecx
push ebx
push dword [eax]
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp - 0x2d4], eax
je 0x61777b1e
cmp eax, 2
jne 0x61777b5f
cmp eax, 2
je 0x61777b2b
cmp dword [ebp - 0x2ec], ebx
jne 0x61777b4e
cmp dword [esi], 4
je 0x61777b5f
push dword [esi - 8]
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi - 4]
mov dword [eax], ebx
mov dword [esi - 8], ebx
mov dword [ebp - 0x2d4], ebx
add esi, 0x10
lea eax, [esi - 0xc]
inc edi
cmp dword [eax], ebx
jne 0x61777aca
jmp 0x61777b92
shl edi, 4
cmp dword [0x6177d38c], ebx
mov ecx, dword [edi + 0x6177d1d0]
mov dword [ebp - 0x2d8], ecx
jbe 0x61777b92
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
cmp dword [ebp - 0x2d4], ebx
jne 0x61777cfd
cmp dword [ebp + 0x14], ebx
mov eax, dword [0x6177d308]
je 0x61777bb1
cmp dword [ebp + 0x14], eax
jne 0x61777cfd
push eax
call fcn.6177ae25
mov edi, eax
cmp edi, 0xffffffff
je 0x61777cfd
push dword [0x6177d308]
mov ecx, dword [0x6177d3e8]
push dword [ebp - 0x2e4]
lea eax, [edi + edi*8]
shl eax, 4
lea esi, [eax + ecx + 0x10]
call fcn.6177aee0
test eax, eax
je 0x61777cfd
lea eax, [ebp - 0x2f8]
push eax
mov eax, dword [ebp - 0x2e4]
push dword [eax + 4]
push dword [eax + 0xc]
push dword [ebp - 0x2f0]
push dword [ebp - 0x2e0]
call dword [esi + 0x10]
cmp eax, ebx
mov dword [ebp - 0x2d4], eax
jne 0x61777ca8
mov eax, dword [ebp - 0x2e4]
test byte [eax + 0x1c], 4
jne 0x61777c93
push 0x202
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x2e0]
mov dword [ebp - 0x300], eax
push dword [0x6177d394]
call sub.MPRAPI.dll_MprConfigGetFriendlyName
test eax, eax
je 0x61777c63
push dword [ebp - 0x2e0]
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push 2
push dword [ebp - 0x2f8]
call dword [esi + 0x28]
cmp dword [0x6177d38c], 2
jbe 0x61777c93
push ebx
lea eax, [ebp - 0x300]
push eax
push 1
push 0x4ed5
push 4
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx + edi*8 + 0x250], eax
jmp 0x61777cfd
cmp dword [0x6177d308], 0x21
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp - 0x308], ecx
mov dword [ebp - 0x304], 0x617717e4
je 0x61777cd1
mov dword [ebp - 0x304], 0x617717dc
cmp dword [0x6177d38c], ebx
jbe 0x61777cf7
push 2
push eax
lea eax, [ebp - 0x308]
push eax
push 2
push 0x4e8a
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventStringW
mov dword [ebp - 0x2d4], ebx
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
mov dword [ebp - 0x2dc], ebx
pop edi
lea esi, [edi + 0x6177d1d4]
mov eax, dword [esi]
cmp eax, ebx
je 0x61777d36
push eax
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0x6177d1d8]
mov dword [eax], ebx
mov dword [esi], ebx
add edi, 0x10
cmp edi, 0x30
jb 0x61777d12
cmp dword [ebp - 0x2d4], ebx
jne 0x61777e04
inc dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [0x6177d364]
jb 0x617779d4
jmp 0x61777e04
cmp eax, 0x103
jne 0x61777d79
mov dword [ebp - 0x2d4], ebx
jmp 0x61777e04
cmp dword [0x6177d38c], ebx
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp - 0x2d8], ecx
jbe 0x61777e04
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push 0x4e86
jmp 0x61777df7
cmp dword [0x6177d38c], ebx
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x2d8], eax
jbe 0x61777e04
push dword [ebp - 0x2d4]
lea eax, [ebp - 0x2d8]
push eax
push 1
push 0x4e84
jmp 0x61777df7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x6177d38c], ebx
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d8], ecx
jbe 0x61777e04
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
pop edi
pop esi
mov eax, dword [0x6177d1e4]
cmp eax, ebx
je 0x61777e1d
push eax
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x2dc], ebx
pop ebx
je 0x61777e32
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2d4]
call fcn.6177afa9
leave
ret 0x10