Function at 0x77c95007
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, dword [ebp + 0xc]
push edi
push 0x1d
pop ecx
mov esi, 0x77c95668
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push 0xb4
mov dword [ebp - 0x3e4], eax
lea eax, [ebp - 0x1a0]
push esi
push eax
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0xdc], 0x191cd7fa
mov word [ebp - 0xd8], 0xf240
mov word [ebp - 0xd6], 0x4a17
mov byte [ebp - 0xd4], 0x89
mov byte [ebp - 0xd3], 0x86
mov byte [ebp - 0xd2], 0x94
mov byte [ebp - 0xd1], 0xd4
mov byte [ebp - 0xd0], 0x80
mov byte [ebp - 0xcf], 0xa6
mov byte [ebp - 0xce], 0xc8
mov byte [ebp - 0xcd], 0xca
mov dword [ebp - 0xec], 0xd2c34ab2
mov word [ebp - 0xe8], 0x529a
mov word [ebp - 0xe6], 0x46b2
mov byte [ebp - 0xe4], 0xb2
mov byte [ebp - 0xe3], 0x93
mov byte [ebp - 0xe2], 0xfc
mov byte [ebp - 0xe1], 0x85
mov byte [ebp - 0xe0], 0x3f
mov byte [ebp - 0xdf], 0xce
mov byte [ebp - 0xde], 0x72
mov byte [ebp - 0xdd], 0xea
mov dword [ebp - 0x3d0], esi
mov dword [ebp - 0x1a4], esi
call sub.ntdll.dll_memset
push 0x224
lea eax, [ebp - 0x3c8]
push esi
push eax
mov dword [ebp - 0x3cc], esi
call sub.ntdll.dll_memset
add esp, 0x18
cmp dword [ebp - 0x3e4], esi
mov dword [ebp - 0x3e0], esi
je 0x77c954e9
cmp ebx, esi
je 0x77c954e9
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x408]
mov dword [ebx], 1
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push eax
call ebx
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3fc], eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x400]
push eax
push 0x2001f
lea eax, [ebp - 0x3d0]
push eax
mov dword [ebp - 0x400], 0x18
mov dword [ebp - 0x3f4], 0x40
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3ec], esi
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov esi, 0xc0000034
cmp edi, esi
jne 0x77c951d9
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x400]
push eax
push 0x2001f
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov edi, eax
test edi, edi
jl 0x77c954ee
push 0x77cbff3c
lea eax, [ebp - 0x3d8]
push eax
call ebx
mov edi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp - 0x3e0]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call edi
cmp eax, esi
je 0x77c952b1
push 0x77ca6b8c
lea eax, [ebp - 0x3d8]
push eax
call ebx
lea eax, [ebp - 0x3e0]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call edi
cmp eax, esi
je 0x77c952b1
push 0x77cc0318
lea eax, [ebp - 0x3d8]
push eax
call ebx
lea eax, [ebp - 0x3e0]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call edi
cmp eax, esi
je 0x77c952b1
push 0x77c956e0
lea eax, [ebp - 0x3d8]
push eax
call ebx
lea eax, [ebp - 0x3e0]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 2
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call edi
mov edi, eax
cmp edi, esi
jne 0x77c954de
push 0x77cbff3c
lea eax, [ebp - 0x3d8]
push eax
call ebx
mov esi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 0x3dc]
push eax
push 4
push 0
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
mov dword [ebp - 0x3dc], 0x40000
call esi
mov edi, eax
test edi, edi
jl 0x77c954ee
push 0x77ca6b8c
lea eax, [ebp - 0x3d8]
push eax
mov dword [ebp - 0x3dc], 1
call ebx
push 4
lea eax, [ebp - 0x3dc]
push eax
push 4
push 0
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call esi
mov edi, eax
test edi, edi
jl 0x77c954ee
and dword [ebp - 0x3dc], 0
push 0x77cc0318
lea eax, [ebp - 0x3d8]
push eax
call ebx
push 4
lea eax, [ebp - 0x3dc]
push eax
push 4
push 0
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call esi
mov edi, eax
test edi, edi
jl 0x77c954ee
push 0x77c956e0
lea eax, [ebp - 0x3d8]
push eax
call ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0xf8
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [ebp - 0x3e4], eax
je 0x77c954d7
push 0x3e
pop ecx
push 0xf8
push eax
mov edi, eax
mov esi, 0x77ca6bb8
rep movsd dword es:[edi], dword [esi]
push 7
xor esi, esi
push esi
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x3d0]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 0x3e4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
inc eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x184], eax
push 0x77c955c8
lea eax, [ebp - 0x180]
push eax
mov dword [ebp - 0x190], 0x40000
mov dword [ebp - 0x18c], 3
mov dword [ebp - 0x178], esi
call ebx
lea esi, [ebp - 0xdc]
lea edi, [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x3c8], 0x20
inc eax
mov dword [ebp - 0x3cc], eax
lea esi, [ebp - 0xdc]
lea edi, [ebp - 0x3c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
lea ecx, [ebp - 0x3cc]
push ecx
lea ecx, [ebp - 0x1a4]
push ecx
push eax
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], 0x77c955c8
mov word [ebp - 0x3ac], si
call fcn.77cf1898
mov edi, eax
cmp edi, esi
jl 0x77c954ee
push 0x77c95528
lea eax, [ebp - 0x180]
push eax
call ebx
lea esi, [ebp - 0xec]
lea edi, [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xec]
lea edi, [ebp - 0x3c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x3cc]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a4]
push eax
movsd dword es:[edi], dword [esi]
push 1
mov dword [ebp - 0x1ac], 0x77c95528
call fcn.77cf1898
mov edi, eax
jmp 0x77c954ee
mov edi, 0xc0000017
jmp 0x77c954ee
mov eax, dword [ebp - 0x3e8]
and dword [eax], 0
jmp 0x77c954ee
mov edi, 0xc000000d
cmp dword [ebp - 0x3d0], 0
je 0x77c95503
push dword [ebp - 0x3d0]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jl 0x77c9550c
xor eax, eax
inc eax
jmp 0x77c95514
push edi
call fcn.77cc7779
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 8