Function at 0x77cb439b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push dword [ebp - 0x308]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cb44fa
push 0x77cb4388
jmp 0x77cb44a5
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x304], eax
xor edi, edi
mov eax, 0x220
push eax
mov dword [ebp - 0x308], edi
mov dword [ebp - 0x2f4], edi
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x2f8], eax
mov eax, dword [ecx + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, edi
je 0x77cceda2
lea eax, [ebp - 0x234]
mov dword [ebp - 0x310], eax
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x328], eax
push 0x77cb41e4
lea eax, [ebp - 0x314]
mov word [ebp - 0x314], di
mov word [ebp - 0x32c], di
mov edi, dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
push eax
mov word [ebp - 0x312], 0x208
mov word [ebp - 0x32a], 0x28
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cb44e0
lea eax, [ebp - 0x32c]
push eax
push 0xa
push dword [ebp + 0x14]
call dword [sym.imp.ntdll.dll_RtlIntegerToUnicodeString]
mov ebx, eax
test ebx, ebx
jl 0x77cb44e0
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov ebx, eax
test ebx, ebx
jl 0x77cb44e0
mov eax, dword [ebp + 0x18]
dec eax
je 0x77cb437c
dec eax
je 0x77cb4544
dec eax
jne 0x77ccedac
push 0x77cb4530
lea eax, [ebp - 0x314]
push eax
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cb44e0
lea eax, [ebp - 0x308]
push eax
push 0
push 0x20019
push dword [ebp - 0x310]
push dword [ebp - 0x304]
push dword [ebp + 0xc]
call fcn.77cb6edb
mov ebx, eax
test ebx, ebx
jge 0x77cb49e0
cmp dword [ebp - 0x2f4], 0
jne 0x77ccf295
cmp dword [ebp - 0x308], 0
jne 0x77cb436b
cmp dword [ebp - 0x30c], 0
jne 0x77ccf2a6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.77cd6011
leave
ret 0x14
push 0x77cb4550
jmp 0x77cb44a5
and dword [ebp - 0x304], 0
mov edi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
jmp 0x77cb4a08
test eax, eax
jge 0x77cb4b65
jmp 0x77cb4c0d
and dword [ebp - 0x2c0], 0
jmp 0x77ccf284
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
push esi
push 0
push dword [ebp - 0x304]
push dword [ebp - 0x308]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
mov ebx, eax
test ebx, ebx
jl 0x77cb4c2b
lea eax, [esi + 0x10]
mov dword [ebp - 0x31c], eax
mov ax, word [esi + 0xc]
push 0xb8
mov word [ebp - 0x320], ax
mov word [ebp - 0x31e], ax
lea eax, [ebp - 0x2ec]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.ntdll.dll_RtlGUIDFromString]
test eax, eax
jl 0x77cb4c20
xor ebx, ebx
cmp dword [ebp - 0x2ec], ebx
je 0x77ccee27
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2ec]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ntdll.dll_RtlLookupElementGenericTable]
test eax, eax
jne 0x77cb4c20
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x320]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x344]
push eax
push 0x20019
lea eax, [ebp - 0x2f4]
push eax
mov dword [ebp - 0x344], 0x18
mov dword [ebp - 0x338], 0x40
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x330], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test ebx, ebx
jl 0x77cb44e0
mov eax, dword [ebp + 0x18]
dec eax
jne 0x77ccee50
push 0x77cb41d0
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
mov ebx, eax
test ebx, ebx
jl 0x77ccf218
mov eax, dword [esi]
cmp eax, 1
je 0x77cb4b75
cmp eax, 2
jne 0x77cb4c0d
xor ecx, ecx
cmp eax, 2
sete cl
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x2c8]
push eax
mov dword [ebp - 0x2cc], ecx
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x77cb4c0d
push 0x77cb52ac
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cb49fc
cmp dword [esi], 4
jne 0x77cb49fc
cmp dword [esi + 4], 4
jne 0x77cb49fc
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c0], eax
test ebx, ebx
jl 0x77cb4c0d
push 0
push 0xb8
lea eax, [ebp - 0x2ec]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ntdll.dll_RtlInsertElementGenericTable]
push dword [ebp - 0x2f4]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x2f4], 0
inc dword [ebp - 0x304]
jmp 0x77cb4a08
cmp ebx, 0x80000005
jne 0x77cb44e0
jmp 0x77ccedb6
mov eax, 0xc0000017
jmp 0x77cb451f
mov ebx, 0xc000000d
jmp 0x77cb44e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2f0]
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp - 0x2f0]
push 0
push dword [eax + 0x18]
mov dword [ebp - 0x2f8], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x77ccf28b
lea eax, [ebp - 0x2f0]
push eax
push ebx
push esi
push 0
push dword [ebp - 0x304]
push dword [ebp - 0x308]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
mov ebx, eax
test ebx, ebx
jge 0x77cb4a34
jmp 0x77cb44e0
cmp dword [ebp - 0x2e8], ebx
jne 0x77cb4a8f
cmp dword [ebp - 0x2e4], ebx
jne 0x77cb4a8f
cmp dword [ebp - 0x2e0], ebx
jne 0x77cb4a8f
jmp 0x77cb4c20
dec eax
je 0x77ccef85
dec eax
jne 0x77cb4c0d
push 0x77cb41d0
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
mov ebx, eax
test ebx, ebx
jge 0x77ccef08
cmp ebx, 0x80000005
jne 0x77cb4bef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2f0]
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp - 0x2f0]
push 0
push dword [eax + 0x18]
mov dword [ebp - 0x2f8], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x77ccf28b
lea eax, [ebp - 0x2f0]
push eax
push ebx
push esi
push 4
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x2f4]
call edi
test eax, eax
jl 0x77cb4c0d
cmp dword [esi], 4
jne 0x77cb4c0d
cmp dword [esi + 4], 4
jne 0x77cb4c0d
mov eax, dword [esi + 8]
mov dword [ebp - 0x2cc], eax
push 0x77cb52ac
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
mov ebx, eax
test ebx, ebx
jl 0x77ccef79
cmp dword [esi], 4
jne 0x77ccef79
cmp dword [esi + 4], 4
jne 0x77ccef79
mov eax, dword [esi + 8]
and eax, 0xfffeffff
mov dword [ebp - 0x2c8], eax
jmp 0x77cb4bef
and dword [ebp - 0x2c8], 0
jmp 0x77ccf284
and dword [ebp - 0x244], 0
and dword [ebp - 0x240], 0
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2f4]
mov dword [ebp - 0x2f0], 0x40
call fcn.77cffeec
test eax, eax
jl 0x77cb4c0d
cmp dword [ebp - 0x318], 0x8003
jne 0x77cb4c0d
cmp dword [ebp - 0x2f0], 0x10
jne 0x77cb4c0d
push 0x77ccf2c8
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x244], 1
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
mov ebx, eax
test ebx, ebx
jge 0x77ccf096
cmp ebx, 0x80000005
jne 0x77cb4bef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2f0]
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp - 0x2f0]
push 0
push dword [eax + 0x18]
mov dword [ebp - 0x2f8], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x77ccf28b
lea eax, [ebp - 0x2f0]
push eax
push ebx
push esi
push 4
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x2f4]
call edi
test eax, eax
jl 0x77cb4c0d
mov eax, dword [esi]
cmp eax, 4
jne 0x77ccf0b4
cmp dword [esi + 4], eax
jne 0x77ccf0b4
mov eax, dword [esi + 8]
and dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2cc], eax
jmp 0x77ccf0d9
cmp eax, 0xb
jne 0x77cb4c0d
cmp dword [esi + 4], 8
jne 0x77cb4c0d
mov eax, dword [esi + 8]
mov dword [ebp - 0x2cc], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c8], eax
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x77cb52ac
lea eax, [ebp - 0x300]
push eax
call ebx
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2f8]
lea eax, [ebp - 0x300]
push esi
push 4
push eax
push dword [ebp - 0x2f4]
call edi
test eax, eax
jl 0x77ccf12b
cmp dword [esi], 4
jne 0x77ccf12b
cmp dword [esi + 4], 4
jne 0x77ccf12b
mov eax, dword [esi + 8]
and eax, 0xfffeffff
mov dword [ebp - 0x23c], eax
jmp 0x77ccf132
and dword [ebp - 0x23c], 0
push 0x77ccf2b8
lea eax, [ebp - 0x320]
push eax
call ebx
mov eax, dword [ebp - 0x2f4]
and dword [ebp - 0x334], 0
and dword [ebp - 0x330], 0
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x320]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x344]
push eax
push 0x20019
lea eax, [ebp - 0x30c]
push eax
mov dword [ebp - 0x344], 0x18
mov dword [ebp - 0x338], 0x40
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test ebx, ebx
jge 0x77ccf1aa
cmp ebx, 0xc0000034
je 0x77ccf284
jmp 0x77cb4bef
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x30c]
mov dword [ebp - 0x2f0], 0x40
call fcn.77cffeec
mov ebx, eax
test ebx, ebx
jl 0x77ccf200
cmp dword [ebp - 0x318], 0x800c
jne 0x77ccf1fb
cmp dword [ebp - 0x2f0], 0x20
jne 0x77ccf1fb
mov dword [ebp - 0x240], 1
jmp 0x77ccf200
mov ebx, 0xc0000001
push dword [ebp - 0x30c]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x30c], 0
jmp 0x77cb4bef
cmp ebx, 0x80000005
jne 0x77cb4bef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2f0]
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp - 0x2f0]
push 0
push dword [eax + 0x18]
mov dword [ebp - 0x2f8], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x77ccf28b
lea eax, [ebp - 0x2f0]
push eax
push ebx
push esi
push 4
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x2f4]
call edi
jmp 0x77cb49ef
xor ebx, ebx
jmp 0x77cb4bef
mov ebx, 0xc0000017
jmp 0x77cb44e0
push dword [ebp - 0x2f4]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cb44ed
push dword [ebp - 0x30c]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cb4507