Function at 0x77d09473
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
test word [ebp + 0x14], 0x200
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc2c], esi
mov dword [ebp - 0xc38], ebx
je 0x77d094b6
push ebx
push esi
call fcn.77d092cd
test eax, eax
jne 0x77d094b6
xor eax, eax
jmp 0x77d096e0
test word [ebp + 0x14], 0x400
jne 0x77d094c6
xor eax, eax
inc eax
jmp 0x77d096e0
test byte [ebp + 0x14], 0x80
je 0x77d0950e
and dword [ebp - 0xc20], 0
and dword [ebp - 0xc24], 0
lea eax, [ebp - 0xc20]
push eax
push esi
call fcn.77ccb283
test eax, eax
jl 0x77d094af
lea eax, [ebp - 0xc24]
push eax
push ebx
call fcn.77ccb283
test eax, eax
jl 0x77d094af
test byte [ebp - 0xc20], 2
jne 0x77d0950e
test byte [ebp - 0xc24], 2
je 0x77d094be
and dword [ebp - 0xc20], 0
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
push edi
lea eax, [ebp - 0xc28]
push eax
mov edi, 0xc16
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push 0
jmp 0x77d095d1
mov eax, dword [ebp - 0xc0c]
shr eax, 1
lea eax, [ebp + eax*2 - 0xc08]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d095dc
and word [eax], 0
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test word [ebp + 0x14], 0x100
je 0x77d09596
push 0xc
lea eax, [ebp - 0xc08]
push 0x77d0972c
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d09596
cmp dword [ebp - 0xc10], 2
jbe 0x77d095b4
test byte [ebp + 0x14], 0x20
jne 0x77d095b4
lea eax, [ebp - 0xc34]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
test eax, eax
jne 0x77d095b4
dec dword [ebp - 0xc20]
inc dword [ebp - 0xc20]
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push dword [ebp - 0xc20]
push ebx
call esi
test eax, eax
jge 0x77d09539
and dword [ebp - 0xc20], 0
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
push 1
push dword [ebp - 0xc20]
push dword [ebp - 0xc2c]
call esi
mov ebx, eax
cmp ebx, 0x80000005
jne 0x77d0961e
push 0x77d096f0
push 1
push 0x68
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0xc
test ebx, ebx
jl 0x77d096dc
mov eax, dword [ebp - 0xc0c]
shr eax, 1
lea eax, [ebp + eax*2 - 0xc08]
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x77d096dc
movzx ebx, word [eax]
and word [eax], 0
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test word [ebp + 0x14], 0x100
je 0x77d09686
push 0xc
lea eax, [ebp - 0xc08]
push 0x77d0972c
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d09686
cmp dword [ebp - 0xc10], 2
jbe 0x77d096cd
mov eax, dword [ebp - 0xc0c]
shr eax, 1
mov word [ebp + eax*2 - 0xc08], bx
push dword [ebp - 0xc10]
mov eax, dword [ebp - 0xc14]
lea eax, [ebp + eax - 0xc1c]
push eax
push dword [ebp - 0xc18]
lea eax, [ebp - 0xc34]
push dword [ebp - 0xc1c]
push eax
push dword [ebp - 0xc38]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
jl 0x77d096d8
inc dword [ebp - 0xc20]
jmp 0x77d095e3
xor eax, eax
jmp 0x77d096df
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 0x10