Function at 0x77cd6131
Capabilities:
Query or enumerate registry value

Disassembly:
test eax, eax
je 0x77cd6259
cmp dword [ebp - 0xa8], eax
je 0x77cd6259
cmp dword [ebp - 0x98], 0xc0000034
jne 0x77cd6259
lea ecx, [ebp - 0xb0]
push ecx
push edi
lea ecx, [ebp - 0x94]
push ecx
push 2
push ebx
mov dword [ebp - 0xa8], eax
push eax
jmp 0x77cd623e
test eax, eax
je 0x77cd627d
cmp ecx, dword [ebp - 0xbc]
jne 0x77cea861
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cd627d
push 0x57
jmp 0x77cea869
push dword [ebp - 0xb4]
push esi
push dword [ebp - 0xa0]
push ecx
push edi
push ebx
push eax
call fcn.77ca9383
jmp 0x77cd6318
xor ecx, ecx
cmp dword [ebp - 0xa0], ecx
je 0x77cb9e94
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0x8c]
jb 0x77cd6269
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0xb0]
mov eax, dword [eax + 0x30]
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x77cea867
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x9c]
push edi
push 2
push ebx
push dword [ebp - 0xa8]
call esi
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
jmp 0x77cd626f
push edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x77cd630c
mov dword [ebp - 0x98], ecx
jmp 0x77cd6269
mov dword [ebp - 0x98], 0x80000005
jmp 0x77cd62b7
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0xa0], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], eax
je 0x77c9f90b
movzx edx, word [ebx]
cmp dx, di
mov dword [ebp - 0x9c], edx
je 0x77c9f90b
test dl, 1
jne 0x77c9f90b
cmp esi, edi
je 0x77c9f90b
cmp dword [ebp - 0xb4], edi
je 0x77c9f90b
cmp ecx, edi
je 0x77c9f90b
cmp dword [ebp - 0xa0], edi
je 0x77cd6672
cmp eax, 0x80000004
je 0x77caa4cc
cmp eax, 0x80000050
je 0x77caa4cc
cmp eax, 0x80000060
je 0x77caa4cc
movzx ecx, word [ebx]
cmp cx, di
jbe 0x77cd6207
add ecx, 0xfffffffe
mov word [ebx], cx
test al, 2
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x9c], ecx
jne 0x77cd7303
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp - 0xb0]
push eax
mov edi, 0x90
push edi
lea eax, [ebp - 0x94]
push eax
push 2
push ebx
push dword [ebp - 0xa8]
call esi
cmp dword [ebp - 0xac], 0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
jne 0x77c9f8a9
cmp dword [ebp - 0x98], 0x80000005
je 0x77cb9e00
mov edi, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xac]
test ecx, ecx
jne 0x77c9f8eb
xor eax, eax
cmp dword [ebp - 0x98], eax
jl 0x77cd6652
cmp dword [ebp - 0xa0], eax
je 0x77cd62b7
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xb8]
cmp dword [ecx], eax
jb 0x77cc8164
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0xa0]
call sub.ntdll.dll_memmove
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x98], eax
jl 0x77cd6652
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov ecx, dword [edi + 8]
mov edx, dword [ebp - 0xb8]
mov dword [edx], ecx
cmp dword [ebp - 0x98], eax
jl 0x77cd6645
cmp dword [ebp - 0xa0], eax
je 0x77cd6645
mov ecx, dword [edi + 8]
mov edx, dword [ebp - 0xb4]
mov dword [edx], ecx
lea ecx, [ebp - 0x94]
cmp edi, ecx
jne 0x77cb9e7b
push dword [ebp - 0x98]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x18
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
jmp 0x77cd62fe
cmp dword [ebp - 0x98], 0x80000005
jne 0x77cd62db
jmp 0x77cd62c5
mov dword [esi], edi
jmp 0x77cd61d8
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push 0x2000000
push eax
push edi
call fcn.77cd7150
cmp eax, edi
jl 0x77cea85b
mov eax, dword [ebp - 0xac]
cmp eax, edi
je 0x77cd621b
cmp dword [ebp - 0xa4], edi
je 0x77cd621b
mov dword [ebp - 0xa8], eax
jmp 0x77cd621b
push eax
jmp 0x77cd6312
push ecx
jmp 0x77c9f900
push 0xe
pop eax
jmp 0x77cd6318