Function at 0x77cbf78c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1d4
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x124]
push ecx
xor ebx, ebx
push ebx
mov esi, 0x20019
push esi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0x10]
push 0x77cbf8d0
push eax
push dword [ebp + 0xc]
call fcn.77cbeaa7
cmp eax, ebx
mov dword [ebp - 0x134], eax
jge 0x77cd2048
call fcn.77cbff5b
mov dword [ebp - 0x130], eax
xor edi, edi
xor eax, eax
inc eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x160], 0x1000
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], 0x10000
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], 0x20000
mov dword [ebp - 0x148], 0x40000
mov esi, dword [ebp + edi*8 - 0x168]
push esi
push dword [ebp - 0x120]
call fcn.77cb5bfd
test eax, eax
jne 0x77cbf8ad
push 0x54
lea eax, [ebp - 0x1d4]
push ebx
push eax
call sub.ntdll.dll_memset
mov al, byte [ebp + edi*8 - 0x164]
mov byte [ebp - 0x1cf], al
mov eax, esi
and eax, dword [ebp - 0x130]
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1d4], esi
mov byte [ebp - 0x1d0], 1
je 0x77cbf8ea
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cbf3cc
test eax, eax
lea eax, [ebp - 0x1d4]
jl 0x77cbf8f3
push ebx
push 0x54
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlInsertElementGenericTable]
inc edi
cmp edi, 5
jb 0x77cbf7e9
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 0xc
mov byte [ebp - 0x1cf], 1
jmp 0x77cbf887
push eax
call fcn.77cc03cf
jmp 0x77cbf8ad
mov edi, dword [sym.imp.ntdll.dll_NtEnumerateKey]
lea eax, [ebp - 0x130]
push eax
push 0x118
lea eax, [ebp - 0x11c]
push eax
push ebx
mov dword [ebp - 0x128], ebx
push ebx
jmp 0x77cd21fb
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x138], eax
mov ax, word [ebp - 0x110]
mov word [ebp - 0x13c], ax
lea eax, [ebp - 0x140]
push eax
push 0xa
lea eax, [ebp - 0x13c]
push eax
mov word [ebp - 0x13a], 0x100
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
test eax, eax
jl 0x77cd21db
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x180]
push eax
push esi
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x180], 0x18
mov dword [ebp - 0x174], 0x40
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77cd21db
push 0x54
lea eax, [ebp - 0x1d4]
push ebx
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp - 0x140]
add esp, 0xc
cmp eax, 0x40000
mov dword [ebp - 0x1d4], eax
je 0x77cd2148
cmp eax, 0x20000
je 0x77cd2148
cmp eax, 0x10000
je 0x77cd2148
cmp eax, 0x1000
je 0x77cd2148
cmp eax, ebx
mov byte [ebp - 0x1d0], bl
jne 0x77cd214f
mov byte [ebp - 0x1d0], 1
cmp byte [ebp - 0x1d0], bl
mov byte [ebp - 0x1cf], 1
jne 0x77cd2184
push ebx
lea eax, [ebp - 0x1d4]
push eax
push 0x77d1ab48
push dword [ebp - 0x12c]
push 0x40000000
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
cmp byte [ebp - 0x1d0], bl
je 0x77cd2194
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cbf3cc
test eax, eax
jl 0x77cd21c3
lea eax, [ebp - 0x1d4]
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlLookupElementGenericTable]
test eax, eax
jne 0x77cd21c3
push ebx
push 0x54
lea eax, [ebp - 0x1d4]
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ntdll.dll_RtlInsertElementGenericTable]
jmp 0x77cd21cf
lea eax, [ebp - 0x1d4]
push eax
call fcn.77cc03cf
push dword [ebp - 0x12c]
call dword [sym.imp.ntdll.dll_NtClose]
inc dword [ebp - 0x128]
lea eax, [ebp - 0x130]
push eax
push 0x118
lea eax, [ebp - 0x11c]
push eax
push ebx
push dword [ebp - 0x128]
push dword [ebp - 0x124]
call edi
cmp eax, ebx
mov dword [ebp - 0x134], eax
jge 0x77cd206e
push dword [ebp - 0x124]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cbf7dc