Function at 0x77d01417
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
push ebx
push 0x77d017ac
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
call dword [esi + 4]
cmp eax, 0xffffffff
mov dword [ebp - 0x254], eax
jne 0x77d0146d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77d0175f
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x260], ebx
push ebx
jmp 0x77d0170e
push 0x20019
push 1
push ebx
push 1
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call dword [esi + 0x24]
cmp eax, 0xffffffff
mov dword [ebp - 0x24c], eax
je 0x77d016ee
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
push ebx
push 0x77d0180c
push eax
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
je 0x77d014f5
cmp edi, 2
je 0x77d016dd
jmp 0x77d0175f
mov dword [ebp - 0x258], ebx
push dword [ebp - 0x258]
lea eax, [ebp - 0x24]
push 0x77d017f8
push 0x10
push eax
call fcn.77c9e2c6
add esp, 0x10
cmp eax, ebx
jl 0x77d0173d
lea eax, [ebp - 0x250]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegOpenKeyExW
mov edi, eax
cmp edi, ebx
je 0x77d0154c
cmp edi, 2
je 0x77d016c5
jmp 0x77d0175f
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push 0x77d017e0
push dword [ebp - 0x250]
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
jne 0x77d0175f
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push 0x77d017bc
push dword [ebp - 0x250]
mov dword [ebp - 0x25c], 4
call sym.ADVAPI32.dll_RegQueryValueExW
mov edi, eax
cmp edi, ebx
jne 0x77d0175f
push 0x104
lea eax, [ebp - 0x22c]
push eax
push 0xd
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
push esi
call fcn.77d00825
mov edi, eax
cmp edi, ebx
jne 0x77d0175f
lea eax, [ebp - 0x264]
push eax
push 0x104
lea eax, [ebp - 0x22c]
push eax
call fcn.77cfb97b
cmp eax, ebx
jl 0x77d0173d
mov edi, dword [ebp - 0x264]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edi, [edi + edi + 2]
mov dword [ebp - 0x278], edi
add edi, 0x30
push edi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x77d01756
mov eax, dword [ebp - 0x258]
push dword [ebp - 0x278]
mov word [esi + 6], 0xb17
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x274]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x264]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [esi + 0x30]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [esi + 0x2c]
add esp, 0xc
push esi
mov word [esi + eax*2 + 0x30], bx
movzx eax, word [ebp + 0xc]
add edi, 0xffffffe0
push edi
push 4
push eax
call dword [sym.imp.ntdll.dll_NtTraceEvent]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x250]
call sym.ADVAPI32.dll_RegCloseKey
mov esi, dword [ebp - 0x268]
mov dword [ebp - 0x250], ebx
inc dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x270]
jbe 0x77d014fb
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegCloseKey
mov dword [ebp - 0x24c], ebx
inc dword [ebp - 0x260]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x254]
mov dword [ebp - 0x248], 0x1c
call dword [esi + 0xc]
test eax, eax
jne 0x77d0148d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x103
jne 0x77d0175f
xor edi, edi
jmp 0x77d0175f
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x77d01466
movzx edi, ax
jmp 0x77d0175f
mov esi, dword [ebp - 0x268]
push 0xe
pop edi
cmp dword [ebp - 0x250], ebx
je 0x77d01772
push dword [ebp - 0x250]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x24c], ebx
je 0x77d01785
push dword [ebp - 0x24c]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x254], 0xffffffff
je 0x77d01797
push dword [ebp - 0x254]
call dword [esi + 0x14]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 8