Function at 0x77cb4cbc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1d4
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x124]
push ecx
xor ebx, ebx
push ebx
mov esi, 0x20019
push esi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0x10]
push 0x77cb4e00
push eax
push dword [ebp + 0xc]
call fcn.77cb6edb
cmp eax, ebx
mov dword [ebp - 0x134], eax
jge 0x77ce0b49
call fcn.77cb548b
mov dword [ebp - 0x130], eax
xor edi, edi
xor eax, eax
inc eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x160], 0x1000
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], 0x10000
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], 0x20000
mov dword [ebp - 0x148], 0x40000
mov esi, dword [ebp + edi*8 - 0x168]
push esi
push dword [ebp - 0x120]
call fcn.77cb6e85
test eax, eax
jne 0x77cb4ddd
push 0x54
lea eax, [ebp - 0x1d4]
push ebx
push eax
call sub.ntdll.dll_memset
mov al, byte [ebp + edi*8 - 0x164]
mov byte [ebp - 0x1cf], al
mov eax, esi
and eax, dword [ebp - 0x130]
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1d4], esi
mov byte [ebp - 0x1d0], 1
je 0x77cb4e1a
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cb48fc
test eax, eax
lea eax, [ebp - 0x1d4]
jl 0x77cb4e23
push ebx
push 0x54
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlInsertElementGenericTable]
inc edi
cmp edi, 5
jb 0x77cb4d19
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0xc
mov byte [ebp - 0x1cf], 1
jmp 0x77cb4db7
push eax
call fcn.77cb5cfe
jmp 0x77cb4ddd
mov edi, dword [sym.imp.ntdll.dll_NtEnumerateKey]
lea eax, [ebp - 0x130]
push eax
push 0x118
lea eax, [ebp - 0x11c]
push eax
push ebx
mov dword [ebp - 0x128], ebx
push ebx
jmp 0x77ce0cfc
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x138], eax
mov ax, word [ebp - 0x110]
mov word [ebp - 0x13c], ax
lea eax, [ebp - 0x140]
push eax
push 0xa
lea eax, [ebp - 0x13c]
push eax
mov word [ebp - 0x13a], 0x100
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
test eax, eax
jl 0x77ce0cdc
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x180]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x180], 0x18
mov dword [ebp - 0x174], 0x40
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77ce0cdc
push 0x54
lea eax, [ebp - 0x1d4]
push ebx
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp - 0x140]
add esp, 0xc
cmp eax, 0x40000
mov dword [ebp - 0x1d4], eax
je 0x77ce0c49
cmp eax, 0x20000
je 0x77ce0c49
cmp eax, 0x10000
je 0x77ce0c49
cmp eax, 0x1000
je 0x77ce0c49
cmp eax, ebx
mov byte [ebp - 0x1d0], bl
jne 0x77ce0c50
mov byte [ebp - 0x1d0], 1
cmp byte [ebp - 0x1d0], bl
mov byte [ebp - 0x1cf], 1
jne 0x77ce0c85
push ebx
lea eax, [ebp - 0x1d4]
push eax
push 0x77d26b48
push dword [ebp - 0x12c]
push 0x40000000
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
cmp byte [ebp - 0x1d0], bl
je 0x77ce0c95
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cb48fc
test eax, eax
jl 0x77ce0cc4
lea eax, [ebp - 0x1d4]
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlLookupElementGenericTable]
test eax, eax
jne 0x77ce0cc4
push ebx
push 0x54
lea eax, [ebp - 0x1d4]
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlInsertElementGenericTable]
jmp 0x77ce0cd0
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cb5cfe
push dword [ebp - 0x12c]
call dword [sym.imp.ntdll.dll_NtClose]
inc dword [ebp - 0x128]
lea eax, [ebp - 0x130]
push eax
push 0x118
lea eax, [ebp - 0x11c]
push eax
push ebx
push dword [ebp - 0x128]
push dword [ebp - 0x124]
call edi
cmp eax, ebx
mov dword [ebp - 0x134], eax
jge 0x77ce0b6f
push dword [ebp - 0x124]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cb4d0c