Function at 0x77cc7461
Capabilities:
Query or enumerate registry value

Disassembly:
push dword [ebp - 0xb4]
push esi
push dword [ebp - 0xa0]
push ecx
push edi
push ebx
push eax
call fcn.77c9e62b
jmp 0x77cc7648
xor ecx, ecx
cmp dword [ebp - 0xa0], ecx
je 0x77ca8db8
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0x8c]
jb 0x77cc7599
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0xb0]
mov eax, dword [eax + 0x30]
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x77cdbfa7
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x9c]
push edi
push 2
push ebx
push dword [ebp - 0xa8]
call esi
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
jmp 0x77cc759f
push edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x77cc763c
mov dword [ebp - 0x98], ecx
jmp 0x77cc7599
mov dword [ebp - 0x98], 0x80000005
jmp 0x77cc75e7
mov dword [esi], edi
jmp 0x77cc7508
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
jmp 0x77cc762e
cmp dword [ebp - 0x98], 0x80000005
jne 0x77cc760b
jmp 0x77cc75f5
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0xa0], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], eax
je 0x77ccb836
movzx edx, word [ebx]
cmp dx, di
mov dword [ebp - 0x9c], edx
je 0x77ccb836
test dl, 1
jne 0x77ccb836
cmp esi, edi
je 0x77ccb836
cmp dword [ebp - 0xb4], edi
je 0x77ccb836
cmp ecx, edi
je 0x77ccb836
cmp dword [ebp - 0xa0], edi
je 0x77cb40c5
cmp eax, 0x80000004
je 0x77c9e94c
cmp eax, 0x80000050
je 0x77c9e94c
cmp eax, 0x80000060
je 0x77c9e94c
movzx ecx, word [ebx]
cmp cx, di
jbe 0x77cc7537
add ecx, 0xfffffffe
mov word [ebx], cx
test al, 2
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x9c], ecx
jne 0x77cc8984
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp - 0xb0]
push eax
mov edi, 0x90
push edi
lea eax, [ebp - 0x94]
push eax
push 2
push ebx
push dword [ebp - 0xa8]
call esi
cmp dword [ebp - 0xac], 0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
jne 0x77ccb7d4
cmp dword [ebp - 0x98], 0x80000005
je 0x77ca8d24
mov edi, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xac]
test ecx, ecx
jne 0x77ccb816
xor eax, eax
cmp dword [ebp - 0x98], eax
jl 0x77cc0ef0
cmp dword [ebp - 0xa0], eax
je 0x77cc75e7
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xb8]
cmp dword [ecx], eax
jb 0x77ca958d
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp - 0xa0]
call sub.ntdll.dll_memmove
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x98], eax
jl 0x77cc0ef0
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov ecx, dword [edi + 8]
mov edx, dword [ebp - 0xb8]
mov dword [edx], ecx
cmp dword [ebp - 0x98], eax
jl 0x77cc0ee3
cmp dword [ebp - 0xa0], eax
je 0x77cc0ee3
mov ecx, dword [edi + 8]
mov edx, dword [ebp - 0xb4]
mov dword [edx], ecx
lea ecx, [ebp - 0x94]
cmp edi, ecx
jne 0x77ca8d9f
push dword [ebp - 0x98]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 0x18
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push 0x2000000
push eax
push edi
call fcn.77cc8869
cmp eax, edi
jl 0x77cdbf9b
mov eax, dword [ebp - 0xac]
cmp eax, edi
je 0x77cc754b
cmp dword [ebp - 0xa4], edi
je 0x77cc754b
mov dword [ebp - 0xa8], eax
jmp 0x77cc754b
test eax, eax
je 0x77cc7589
cmp dword [ebp - 0xa8], eax
je 0x77cc7589
cmp dword [ebp - 0x98], 0xc0000034
jne 0x77cc7589
lea ecx, [ebp - 0xb0]
push ecx
push edi
lea ecx, [ebp - 0x94]
push ecx
push 2
push ebx
mov dword [ebp - 0xa8], eax
push eax
jmp 0x77cc756e
test eax, eax
je 0x77cc75ad
cmp ecx, dword [ebp - 0xbc]
jne 0x77cdbfa1
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cc75ad
push 0x57
jmp 0x77cdbfa9
push eax
jmp 0x77cc7642
push ecx
jmp 0x77ccb82b
push 0xe
pop eax
jmp 0x77cc7648