Function at 0x77d0e12b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
push ebx
push 0x77d0e4c0
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
call dword [esi + 4]
cmp eax, 0xffffffff
mov dword [ebp - 0x254], eax
jne 0x77d0e181
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77d0e473
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x260], ebx
push ebx
jmp 0x77d0e422
push 0x20019
push 1
push ebx
push 1
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call dword [esi + 0x24]
cmp eax, 0xffffffff
mov dword [ebp - 0x24c], eax
je 0x77d0e402
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
push ebx
push 0x77d0e520
push eax
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
je 0x77d0e209
cmp edi, 2
je 0x77d0e3f1
jmp 0x77d0e473
mov dword [ebp - 0x258], ebx
push dword [ebp - 0x258]
lea eax, [ebp - 0x24]
push 0x77d0e50c
push 0x10
push eax
call fcn.77cac57c
add esp, 0x10
cmp eax, ebx
jl 0x77d0e451
lea eax, [ebp - 0x250]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegOpenKeyExW
mov edi, eax
cmp edi, ebx
je 0x77d0e260
cmp edi, 2
je 0x77d0e3d9
jmp 0x77d0e473
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push 0x77d0e4f4
push dword [ebp - 0x250]
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
jne 0x77d0e473
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push 0x77d0e4d0
push dword [ebp - 0x250]
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
jne 0x77d0e473
push 0x104
lea eax, [ebp - 0x22c]
push eax
push 0xd
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
push esi
call fcn.77d0d53b
mov edi, eax
cmp edi, ebx
jne 0x77d0e473
lea eax, [ebp - 0x264]
push eax
push 0x104
lea eax, [ebp - 0x22c]
push eax
call fcn.77d085ca
cmp eax, ebx
jl 0x77d0e451
mov edi, dword [ebp - 0x264]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edi, [edi + edi + 2]
mov dword [ebp - 0x278], edi
add edi, 0x30
push edi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x77d0e46a
mov eax, dword [ebp - 0x258]
push dword [ebp - 0x278]
mov word [esi + 6], 0xb17
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x274]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x264]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [esi + 0x30]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [esi + 0x2c]
add esp, 0xc
push esi
mov word [esi + eax*2 + 0x30], bx
movzx eax, word [ebp + 0xc]
add edi, 0xffffffe0
push edi
push 4
push eax
call dword [sym.imp.ntdll.dll_NtTraceEvent]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x250]
call sym.ADVAPI32.dll_RegCloseKey
mov esi, dword [ebp - 0x268]
mov dword [ebp - 0x250], ebx
inc dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x270]
jbe 0x77d0e20f
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegCloseKey
mov dword [ebp - 0x24c], ebx
inc dword [ebp - 0x260]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x254]
mov dword [ebp - 0x248], 0x1c
call dword [esi + 0xc]
test eax, eax
jne 0x77d0e1a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x103
jne 0x77d0e473
xor edi, edi
jmp 0x77d0e473
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x77d0e17a
movzx edi, ax
jmp 0x77d0e473
mov esi, dword [ebp - 0x268]
push 0xe
pop edi
cmp dword [ebp - 0x250], ebx
je 0x77d0e486
push dword [ebp - 0x250]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x24c], ebx
je 0x77d0e499
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x254], 0xffffffff
je 0x77d0e4ab
push dword [ebp - 0x254]
call dword [esi + 0x14]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 8