Function at 0x777981
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using tea
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x50], esi
cmp edi, ebx
je 0x777c6e
cmp ecx, ebx
je 0x777c6e
cmp eax, ebx
je 0x777c6e
push 0xd
lea eax, [ebp - 0x4c]
push ebx
push eax
mov dword [ebp - 0x74], 0x2e3caa29
mov dword [ebp - 0x70], 0x106f454b
mov dword [ebp - 0x6c], 0x3a7ac8e2
mov dword [ebp - 0x68], 0x2b22943d
call fcn.007c3430
push 0xa
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.007c3430
push 9
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.007c3430
push 0xf
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.007c3430
push 0xf
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.007c3430
add esp, 0x3c
lea eax, [ebp - 0x64]
push eax
push 1
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x80000002
mov dword [ebp - 0x20], 0x74737973
mov dword [ebp - 0x1c], 0x735c6d65
mov dword [ebp - 0x18], 0x70757465
mov word [ebp - 0x14], bx
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x30], 0x74737953
mov dword [ebp - 0x2c], 0x72506d65
mov dword [ebp - 0x28], 0x78696665
mov word [ebp - 0x24], bx
mov byte [ebp - 0x22], bl
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x777ab0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x777aa5
mov dword [ebp - 0x10], reloc.ws2_32.dll_WSASetLastError
mov dword [ebp - 0xc], 0x983c8000
mov dword [ebp - 0x50], esi
push dword [ebp - 0x64]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x777ac1
mov dword [ebp - 0x10], reloc.ws2_32.dll_WSASetLastError
mov dword [ebp - 0xc], 0x983c8000
mov dword [ebp - 0x50], esi
xor ecx, ecx
cmp dword [ebp - 0x50], ebx
jbe 0x777aee
movzx eax, byte [ebp + ecx - 0x10]
cdq
push 0x24
pop esi
idiv esi
lea eax, [ebp + ecx - 0x3c]
mov byte [eax], dl
cmp dl, 0x19
jbe 0x777ae3
add dl, 0x16
jmp 0x777ae6
add dl, 0x61
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 0x50]
jb 0x777ac8
push dword [ebp - 0x54]
mov byte [ebp + ecx - 0x3c], bl
call fcn.007c7760
push edi
mov esi, eax
call fcn.007c7760
add esi, dword [ebp - 0x50]
push 1
lea edi, [eax + esi + 1]
push edi
call fcn.00742763
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x7c], esi
cmp esi, ebx
je 0x777c6e
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x54]
lea eax, [edi - 1]
push dword [ebp - 0x58]
push 0x7ecec8
push eax
push esi
call fcn.007e5eb9
push esi
mov byte [edi + esi - 1], bl
call fcn.007c7760
push eax
xor edx, edx
mov ecx, esi
call fcn.00777779
mov dword [ebp - 0x58], eax
lea edi, [ebp - 0x74]
lea eax, [ebp - 0x58]
call fcn.007776a7
push 0xc
push dword [ebp - 0x60]
lea eax, [ebp - 0x4c]
push eax
call fcn.007ca140
lea edi, [ebp - 0x4c]
mov eax, edi
push eax
call fcn.007c7760
movzx eax, ax
add esp, 0x30
cmp ax, bx
jle 0x777bf2
dec ax
shr ax, 3
inc ax
movzx eax, ax
mov dword [ebp - 0x58], eax
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], 0x20
sub dword [ebp - 0x5c], reloc.ws2_32.dll_WSASetLastError
dec dword [ebp - 0x54]
mov edx, ecx
shr edx, 5
add edx, dword [ebp - 0x70]
mov esi, ecx
shl esi, 4
add esi, dword [ebp - 0x74]
xor edx, esi
mov esi, dword [ebp - 0x5c]
add esi, ecx
xor edx, esi
add eax, edx
mov edx, eax
shr edx, 5
add edx, dword [ebp - 0x68]
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0x6c]
xor edx, esi
mov esi, dword [ebp - 0x5c]
add esi, eax
xor edx, esi
add ecx, edx
cmp dword [ebp - 0x54], ebx
ja 0x777b9d
mov dword [edi], eax
mov dword [edi + 4], ecx
add edi, 8
dec dword [ebp - 0x58]
jne 0x777b8e
mov esi, dword [ebp - 0x7c]
push 0xa
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.007c3430
push esi
call fcn.007c9cf8
movzx eax, byte [ebp - 0x4c]
push 0x1a
cdq
pop ecx
idiv ecx
mov edi, dword [ebp - 0x60]
xor esi, esi
push edi
inc esi
add dl, 0x61
mov byte [ebp - 0x3c], dl
call fcn.007c7760
add esp, 0x14
cmp eax, esi
jbe 0x777c58
cmp esi, 9
jae 0x777c58
movzx eax, byte [ebp + esi - 0x4c]
cdq
push 0x24
pop ecx
idiv ecx
lea eax, [ebp + esi - 0x3c]
mov byte [eax], dl
cmp dl, 0x19
jbe 0x777c47
add dl, 0x16
jmp 0x777c4a
add dl, 0x61
push edi
mov byte [eax], dl
inc esi
call fcn.007c7760
pop ecx
cmp esi, eax
jb 0x777c27
push 9
lea eax, [ebp - 0x3c]
push eax
push edi
mov byte [ebp + esi - 0x3c], bl
call fcn.007ca140
add esp, 0xc
mov byte [edi + 9], bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
leave
ret