Function at 0x61778bc7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x6177d2e0]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x278]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x61771e48
push ebx
push 0x80000002
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x274], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x61778c3e
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x270], ebx
jbe 0x61778e37
push edi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e84
jmp 0x61778eb7
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x278]
call fcn.61776e81
mov edi, eax
cmp edi, esi
je 0x61778c79
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61778c18
cmp dword [ebp - 0x284], esi
mov edi, 0x389
mov dword [ebp - 0x280], esi
jbe 0x61778e19
lea eax, [ebp - 0x2a4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x280]
mov dword [ebp - 0x290], 0x32
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
je 0x61778cd3
cmp edi, 0xea
jne 0x61778e48
lea eax, [ebp - 0x274]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x61778e67
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x28c]
push eax
push esi
push 0x61771e28
push dword [ebp - 0x274]
mov dword [ebp - 0x288], 0x202
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x61778e96
cmp dword [ebp - 0x28c], 1
jne 0x61778e96
cmp dword [ebp - 0x27c], esi
je 0x61778d7a
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x61778d7a
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x274], esi
jmp 0x61778e01
push dword [ebp + 0xc]
lea eax, [ebp - 0x26c]
push dword [ebp - 0x274]
push eax
call fcn.61777e49
mov edi, eax
cmp edi, esi
je 0x61778dc7
cmp dword [0x6177d38c], esi
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], eax
jbe 0x61778dc7
push 1
push edi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e89
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventStringW
cmp edi, 0x32
jne 0x61778dce
xor edi, edi
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x27c], esi
mov dword [ebp - 0x274], esi
je 0x61778e01
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x61778e19
inc dword [ebp - 0x280]
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x284]
jb 0x61778c90
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x27c], esi
jne 0x61778e37
cmp edi, 0x389
jne 0x61778e37
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.6177afa9
leave
ret 8
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x270], ebx
jbe 0x61778e19
push edi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e86
jmp 0x61778e87
cmp dword [0x6177d38c], esi
lea eax, [ebp - 0x68]
mov dword [ebp - 0x270], eax
jbe 0x61778e19
push edi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e84
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x61778e19
cmp dword [0x6177d38c], esi
mov dword [ebp - 0x270], 0x61771e28
jbe 0x61778e37
push edi
lea eax, [ebp - 0x270]
push eax
push 1
push 0x4e83
push 1
push dword [0x6177d3a0]
call sub.rtutils.dll_RouterLogEventW
jmp 0x61778e37