Function at 0x77ca16b5
Capabilities:
Query or enumerate registry key

Disassembly:
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77ca195d
push 0xb0
push 0x77ca1aa0
call fcn.77cd5e30
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x28], ebx
push 0x77ca1988
lea eax, [ebp - 0x80]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call esi
push 0x77ca1968
lea eax, [ebp - 0x74]
push eax
call esi
mov dword [ebp - 4], ebx
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push 4
pop esi
push esi
push 0x77d2a788
push esi
push esi
push 0x77ca19f0
call fcn.77ca2b1d
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d2a7b0
push esi
push esi
push 0x77ca1a10
call fcn.77ca2b1d
mov dword [ebp - 0x24], 0x2710
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d2a7c0
push esi
push esi
push 0x77ca1a38
call fcn.77ca2b1d
mov dword [ebp - 0x24], 0x1d4c0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x77d2a784
push esi
push esi
push 0x77ca1a68
call fcn.77ca2b1d
cmp dword [ebp - 0x34], ebx
je 0x77ca178a
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [0x77d2a6a8], ebx
jne 0x77ca17a2
push 0x77ca1a90
push ebx
call sym.ADVAPI32.dll_RegisterEventSourceW
mov dword [0x77d2a6a8], eax
mov word [ebp - 0x20], bx
mov eax, dword [ebp - 0x72]
add eax, 0x202
mov word [ebp - 0x1e], ax
movzx eax, ax
push eax
push 0x52c
mov esi, 0x77ca2978
push esi
call fcn.77ca96e5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64], 0x18
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], 0x40
lea eax, [ebp - 0x80]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x64]
push eax
push 0x20019
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov eax, 0x218
push eax
push 0x533
push esi
call fcn.77ca96e5
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x4a], 0x200
push 0x200
push 0x536
push esi
call fcn.77ca96e5
mov dword [ebp - 0x48], eax
mov word [ebp - 0x6a], 0x100
push 0x100
push 0x538
push esi
call fcn.77ca96e5
mov dword [ebp - 0x68], eax
cmp edi, ebx
jl 0x77ca3208
cmp dword [ebp - 0x1c], ebx
je 0x77ca3208
cmp dword [ebp - 0x2c], ebx
je 0x77ca3208
cmp dword [ebp - 0x48], ebx
je 0x77ca3208
cmp eax, ebx
je 0x77ca3208
mov dword [ebp - 0x44], ebx
cmp edi, ebx
jl 0x77ca3208
lea eax, [ebp - 0x78]
push eax
mov eax, 0x218
push eax
push dword [ebp - 0x2c]
push ebx
push dword [ebp - 0x44]
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
inc dword [ebp - 0x44]
cmp eax, ebx
jl 0x77ca3208
mov ecx, dword [ebp - 0x2c]
movzx eax, word [ecx + 0xc]
lea edx, [eax + 2]
cmp word [ebp - 0x1e], dx
jb 0x77ca195d
mov word [ebp - 0x20], ax
movzx eax, ax
push eax
add ecx, 0x10
push ecx
push dword [ebp - 0x1c]
call sub.ntdll.dll_memmove
add esp, 0xc
movzx eax, word [ebp - 0x20]
shr eax, 1
mov dword [ebp - 0x3c], eax
lea edi, [eax + eax]
mov eax, dword [ebp - 0x1c]
mov word [edi + eax], bx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov dword [ebp - 0x64], 0x18
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], 0x40
lea eax, [ebp - 0x20]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x64]
push eax
push 0x2001f
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jge 0x77ca1938
lea eax, [ebp - 0x64]
push eax
push 0x20019
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x77ca1abc
mov eax, dword [0x77d2b29c]
and al, 0xf
cmp al, 1
jae 0x77ced832
cmp dword [ebp - 0x30], 0xc0000034
jne 0x77ced859
xor edi, edi
jmp 0x77ca186f
mov eax, dword [ebp - 0x1c]
mov word [edi + eax], bx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call fcn.77ca1b14
cmp eax, ebx
je 0x77ced7fe
cmp byte [eax + 0x1cc], bl
je 0x77c9d641
mov edx, dword [0x77d2a6b0]
cmp edx, ebx
je 0x77ca2e0a
mov ecx, dword [ebp - 0x40]
cmp ecx, ebx
je 0x77ca2e21
mov dword [ecx], eax
mov dword [ebp - 0x40], eax
inc dword [0x77d2a6b8]
jmp 0x77ca195d
mov dword [0x77d2a6b0], eax
mov dword [ebp - 0x40], eax
mov dword [0x77d2a6b8], 1
jmp 0x77ca195d
mov dword [eax], edx
mov dword [0x77d2a6b0], eax
jmp 0x77ca1b04
mov dword [ebp - 4], 0xfffffffe
call fcn.77ca321f
call fcn.77cd5e80
ret
mov eax, dword [0x77d2b29c]
and al, 0xf
cmp al, 1
jb 0x77c9d641
push ebx
movzx eax, word [ebp - 0x1e]
push eax
push dword [ebp - 0x1c]
push ebx
push 1
push 0x13
push 0x58d
push 0x77cf057c
call fcn.77d1cff0
add esp, 0x20
jmp 0x77c9d641
push ebx
movzx eax, word [ebp - 0x1e]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push 1
push 0x13
push 0x598
push 0x77cf057c
call fcn.77d1cff0
add esp, 0x20
jmp 0x77ca1950
push 0x77d265a0
push ebx
mov edi, 0x800007d1
push edi
call fcn.77cd91f2
test eax, eax
je 0x77ca195d
cmp dword [0x77d2a788], 2
jl 0x77ca195d
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x30]
call fcn.77ca96ca
mov dword [ebp - 0xa0], eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
push 2
pop eax
cmp dword [0x77d2a788], eax
jl 0x77ced8ad
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], edx
lea edx, [ebp - 0xa0]
push edx
lea edx, [ebp - 0xc0]
push edx
mov edx, dword [ebp - 0x3c]
shl edx, 2
push edx
push ecx
push ebx
push edi
push ebx
push eax
push dword [0x77d2a6a8]
call sym.ADVAPI32.dll_ReportEventW
jmp 0x77ca195d