Function at 0x61776ff6
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6177d2e0]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0xec]
push eax
push 0x20019
push ebx
mov esi, 0x61771d08
push esi
push 0x80000002
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
je 0x6177707c
cmp dword [0x6177d38c], ebx
mov dword [ebp - 0xd0], esi
jbe 0x61777122
push edi
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e84
jmp 0x61777115
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xec]
call fcn.61776e81
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xd4], edi
je 0x617770bd
push dword [ebp - 0xec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61777056
mov eax, dword [ebp - 0x100]
push 0x120
push 8
push dword [0x6177d39c]
mov dword [0x6177d364], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [0x6177d3e8], eax
jne 0x61777129
push dword [ebp - 0xec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x6177d38c], ebx
mov edi, eax
mov dword [ebp - 0xd0], esi
jbe 0x61777122
push edi
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e86
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
mov eax, edi
jmp 0x6177776e
cmp dword [ebp - 0x100], ebx
mov dword [ebp - 0xf4], ebx
jbe 0x6177772d
xor esi, esi
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xf4]
mov dword [ebp - 0x108], 0x64
push dword [ebp - 0xec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0xd4], eax
je 0x61777186
cmp eax, 0xea
jne 0x617775a5
lea eax, [ebp - 0xe8]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xec]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov dword [ebp - 0xd4], eax
jne 0x617775d4
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xe8]
call fcn.61776e81
cmp eax, ebx
mov dword [ebp - 0xd4], eax
jne 0x617775d4
mov eax, dword [ebp - 0xe4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add eax, 2
push eax
push 8
push dword [0x6177d39c]
call edi
push dword [ebp - 0xe4]
mov dword [ebp - 0xe0], eax
push 8
push dword [0x6177d39c]
call edi
push dword [ebp - 0xe4]
mov dword [ebp - 0xf0], eax
push 8
push dword [0x6177d39c]
call edi
mov ecx, dword [ebp - 0xf0]
cmp ecx, ebx
mov dword [ebp - 0xfc], eax
je 0x617776b5
cmp eax, ebx
je 0x617776b5
mov edx, dword [ebp - 0xe0]
cmp edx, ebx
je 0x617776b5
cmp dword [0x6177d180], ebx
mov dword [0x6177d194], eax
lea eax, [ebp - 0xfc]
mov dword [0x6177d198], eax
lea eax, [ebp - 0xe0]
mov dword [0x6177d1a8], eax
lea eax, [ebp - 0xf0]
mov dword [0x6177d1a4], edx
mov dword [0x6177d1b4], ecx
mov dword [0x6177d1b8], eax
mov dword [ebp - 0xdc], ebx
je 0x6177738f
mov eax, 0x6177d180
mov edi, 0x6177d18c
mov ecx, dword [edi]
push 4
pop edx
cmp ecx, edx
jne 0x617772b8
mov dword [ebp - 0xf8], edx
jmp 0x617772cc
cmp ecx, 1
mov ecx, dword [ebp - 0xe4]
jne 0x617772c6
add ecx, 2
mov dword [ebp - 0xf8], ecx
lea ecx, [ebp - 0xf8]
push ecx
push dword [edi - 8]
lea ecx, [ebp - 0x110]
push ecx
push ebx
push dword [eax]
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp - 0xd4], eax
je 0x617772fb
cmp eax, 2
jne 0x61777345
cmp dword [ebp - 0xd4], 2
je 0x6177730c
cmp dword [ebp - 0xf8], ebx
jne 0x6177732f
cmp dword [edi], 4
je 0x61777345
push dword [edi - 8]
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi - 4]
mov dword [eax], ebx
mov dword [edi - 8], ebx
mov dword [ebp - 0xd4], ebx
inc dword [ebp - 0xdc]
add edi, 0x10
lea eax, [edi - 0xc]
cmp dword [eax], ebx
jne 0x617772a7
jmp 0x61777383
mov eax, dword [ebp - 0xdc]
shl eax, 4
cmp dword [0x6177d38c], ebx
mov eax, dword [eax + 0x6177d180]
mov dword [ebp - 0xd0], eax
jbe 0x61777383
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
cmp dword [ebp - 0xd4], ebx
jne 0x617776fe
cmp dword [ebp - 0xe0], ebx
je 0x61777605
push ebx
push ebx
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x61777647
lea edi, [eax + eax]
lea eax, [edi + edi]
push eax
push 8
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0xd8], eax
je 0x61777647
push edi
push eax
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x61777647
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0xc], eax
mov eax, dword [0x6177d3e8]
mov eax, dword [esi + eax + 0xc]
cmp eax, ebx
je 0x6177766e
push 0x617713e8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x61777693
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x74], 0x61778ece
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x78], 0x61778f12
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x7c], 0x61778f4d
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x80], 0x61778fdd
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x84], 0x6177908f
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x88], 0x617790f6
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 0x8c], 0x6177922c
push dword [ebp - 0xfc]
xor ecx, ecx
cmp dword [0x6177d360], 2
sete cl
push ecx
mov ecx, dword [0x6177d3e8]
lea ecx, [esi + ecx + 0x10]
push ecx
call eax
cmp eax, ebx
mov dword [ebp - 0xd4], eax
jne 0x6177769f
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
jne 0x617774df
mov eax, dword [0x6177d3e8]
mov dword [esi + eax + 4], ebx
mov eax, dword [0x6177d3e8]
mov dword [esi + eax + 8], ebx
jmp 0x617774f9
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 4], eax
mov eax, dword [ebp - 0xe4]
mov ecx, dword [0x6177d3e8]
mov dword [esi + ecx + 8], eax
mov eax, dword [0x6177d3e8]
mov dword [esi + eax], 1
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xdc], 0x10
mov edi, dword [ebp - 0xdc]
lea edi, [edi + 0x6177d184]
mov eax, dword [edi]
cmp eax, ebx
je 0x61777551
push eax
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 0x6177d188]
mov dword [eax], ebx
mov dword [edi], ebx
add dword [ebp - 0xdc], 0x10
cmp dword [ebp - 0xdc], 0x30
jb 0x61777521
cmp dword [ebp - 0xd8], ebx
je 0x61777582
push dword [ebp - 0xd8]
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xd8], ebx
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
add esi, 0x90
cmp eax, dword [ebp - 0x100]
jb 0x6177713d
jmp 0x617776f6
cmp dword [0x6177d38c], ebx
mov dword [ebp - 0xd0], 0x61771d08
jbe 0x617776f6
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e86
jmp 0x617776e9
cmp dword [0x6177d38c], ebx
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
jbe 0x617776f6
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e84
jmp 0x617776e9
cmp dword [0x6177d38c], ebx
mov dword [ebp - 0xd0], 0x61771b98
mov dword [ebp - 0xd4], 2
jbe 0x617776fe
push 2
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x617776fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x6177d38c], ebx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], ecx
jbe 0x617776f6
push eax
jmp 0x617776db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x6177d38c], ebx
mov dword [ebp - 0xd4], eax
jbe 0x617776f6
push eax
lea eax, [ebp - 0xd8]
push eax
push 1
push 0x4e87
jmp 0x617776e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd4], eax
push eax
lea eax, [ebp - 0xd8]
push eax
push 1
push 0x4e87
call sub.rtutils.dll_LogErrorW
jmp 0x617776f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x6177d38c], ebx
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
jbe 0x617776f6
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
cmp dword [ebp - 0xd4], ebx
je 0x6177772d
push 0x10
pop edi
lea esi, [edi + 0x6177d184]
mov eax, dword [esi]
cmp eax, ebx
je 0x61777725
push eax
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0x6177d188]
mov dword [eax], ebx
mov dword [esi], ebx
add edi, 0x10
cmp edi, 0x40
jb 0x61777701
cmp dword [ebp - 0xd8], ebx
je 0x61777748
push dword [ebp - 0xd8]
push ebx
push dword [0x6177d39c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xe8], ebx
je 0x6177775c
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.6177afa9
leave
ret