Function at 0x77d0fc3f
Capabilities:
Check for peb beingdebugged flag
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov ebx, 0x2000000
je 0x77d0fc90
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push ebx
push 8
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.ADVAPI32.dll_RegOpenKeyExW
cmp eax, esi
jne 0x77d10044
jmp 0x77d0fc96
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
lea eax, [ebp - 0x34]
push eax
push 0xc
lea eax, [ebp - 0x60]
push eax
push 5
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, esi
jge 0x77d0fd2b
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], esi
je 0x77d0fd05
cmp dword [ebp - 4], esi
je 0x77d0fcf8
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0xc], esi
je 0x77d0fd05
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x1c], esi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x77d0ffca
push dword [ebp - 0x1c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
jmp 0x77d0ffca
test byte [ebp - 0x5c], 2
je 0x77d0fd3a
mov dword [ebp + 8], 0x57
jmp 0x77d0fce6
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
je 0x77d0fd9b
inc dword [ebp - 8]
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x77d0fd70
mov dword [ebp + 8], 8
jmp 0x77d0fce6
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov word [ecx + eax*2], si
cmp dword [ebp + 0x10], esi
je 0x77d0fdd0
xor eax, eax
test byte [ebp - 0x5c], 1
je 0x77d0fda9
inc eax
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push ebx
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sym.ADVAPI32.dll_RegCreateKeyExW
cmp eax, esi
mov dword [ebp + 8], eax
je 0x77d0feb3
jmp 0x77d0fce6
mov eax, dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x34]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
mov dword [ebp - 0xc], eax
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0ffc4
cmp dword [ebp - 8], esi
jne 0x77d0fe06
cmp dword [ebp - 0x10], esi
je 0x77d0feb3
inc dword [ebp - 0x10]
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x1c], eax
jne 0x77d0fe31
mov dword [ebp + 8], 8
jmp 0x77d0fd05
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegQueryInfoKeyW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fd05
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov word [ecx + eax*2], si
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x77d0fe70
mov dword [ebp + 8], 0x57
jmp 0x77d0fd05
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
lea eax, [ebp - 0x54]
push eax
call ebx
cmp eax, esi
jge 0x77d0fe92
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
jmp 0x77d0fd05
push dword [ebp - 0x1c]
lea eax, [ebp - 0x4c]
push eax
call ebx
cmp eax, esi
jl 0x77d0fe83
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0x77d0fe64
cmp dword [ebp - 0x2c], esi
je 0x77d0ff07
mov eax, dword fs:[0x18]
push dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x24], eax
je 0x77d0fd64
lea ecx, [ebp - 0x2c]
push ecx
push eax
push 4
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegGetKeySecurity
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
push dword [ebp - 0x24]
push 4
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegSetKeySecurity
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
cmp dword [ebp - 0x30], esi
je 0x77d0ff29
mov eax, dword fs:[0x18]
push dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x20], eax
je 0x77d0fd64
cmp dword [ebp - 0x18], esi
je 0x77d0ff54
add dword [ebp - 0x18], 2
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ecx + ecx + 2]
push ecx
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x28], eax
je 0x77d0fd64
xor ebx, ebx
cmp dword [ebp - 0x40], esi
jbe 0x77d0fd05
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push dword [ebp - 4]
call sym.ADVAPI32.dll_RegEnumValueW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
mov eax, dword [ebp - 0x38]
mov word [edi + eax*2], si
push dword [ebp - 0x3c]
push dword [ebp - 0x20]
push dword [ebp - 0x44]
push esi
push edi
push dword [ebp - 0xc]
call sym.ADVAPI32.dll_RegSetValueExW
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x77d0fce6
inc ebx
cmp ebx, dword [ebp - 0x40]
jae 0x77d0fd05
jmp 0x77d0ff5f
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x14], esi
je 0x77d0ffe1
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x24], esi
je 0x77d0fff8
push dword [ebp - 0x24]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x20], esi
je 0x77d1000f
push dword [ebp - 0x20]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp - 0x28], esi
je 0x77d10026
push dword [ebp - 0x28]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call edi
cmp dword [ebp + 0x10], esi
pop edi
je 0x77d10041
cmp dword [ebp + 8], esi
jne 0x77d10041
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 0x14