Function at 0x77ca3e68
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, dword [ebp - 0x20]
lea eax, [edi + 2]
cmp edi, eax
jae 0x77ca4687
cmp dword [ebp - 0x2c], 0
jne 0x77cec09e
push edi
push 0x4e8
push esi
call fcn.77ca96e5
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x77ca467f
push eax
jmp 0x77ca3f68
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], ebx
je 0x77ca4659
cmp esi, 0xffffffff
je 0x77ca4659
cmp edi, ebx
je 0x77ca4659
cmp eax, ebx
je 0x77ca4659
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.77ca33df
test eax, eax
jne 0x77cec06a
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push edi
push esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], ebx
call fcn.77ca1178
cmp eax, ebx
jne 0x77cec06f
push 4
pop esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d260f0]
mov dword [ebp - 0x20], esi
push dword [ebp - 0x18]
call fcn.77ca3c5b
test eax, eax
jne 0x77ca4660
cmp dword [ebp - 0x1c], esi
jne 0x77ca4660
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d26140]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x18]
call fcn.77ca3c5b
mov esi, 0x77cceba4
mov ebx, 0xea
cmp eax, ebx
je 0x77ca4606
test eax, eax
je 0x77ca464d
push dword [ebp - 0x24]
push 0x4d6
push esi
call fcn.77ca972d
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d26158]
push dword [ebp - 0x18]
call fcn.77ca3c5b
mov edi, eax
cmp edi, ebx
je 0x77ca3e2e
test edi, edi
jne 0x77ca3fbe
cmp dword [ebp - 0x1c], 1
je 0x77ca3f9c
cmp dword [ebp - 0x1c], 2
jne 0x77cec0b1
push 1
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push dword [ebp - 0x2c]
push eax
call fcn.77ca4224
test eax, eax
mov dword [ebp - 0x30], eax
je 0x77cec0b9
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x20], ecx
push dword [ebp - 0x24]
push 0x504
push esi
call fcn.77ca972d
push dword [ebp - 0x2c]
push 0x505
push esi
call fcn.77ca972d
test edi, edi
jne 0x77ca4051
mov edi, 0x418
push edi
push 0x509
push esi
call fcn.77ca96e5
mov ebx, eax
test ebx, ebx
je 0x77ca4691
and dword [ebp - 0x28], 0
push edi
push 0
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
inc dword [ebp - 0x28]
test eax, eax
jl 0x77ca4038
push dword [ebp - 0x30]
lea eax, [ebx + 0x10]
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x18]
call fcn.77ca390d
jmp 0x77ca3ffd
cmp eax, 0x8000001a
jne 0x77cec0c6
xor edi, edi
push ebx
push 0x521
push esi
call fcn.77ca972d
push dword [ebp - 0x18]
call fcn.77ca11ed
test edi, edi
jne 0x77cec0d4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0xc
mov edi, dword [ebp - 0x20]
lea eax, [edi + 2]
cmp edi, eax
jae 0x77ca3f50
cmp dword [ebp - 0x24], 0
jne 0x77cec08b
push edi
push 0x4c3
push esi
call fcn.77ca96e5
test eax, eax
mov dword [ebp - 0x24], eax
je 0x77ca4668
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x77d26140]
push dword [ebp - 0x18]
call fcn.77ca3c5b
jmp 0x77ca3f40
cmp dword [ebp - 0x1c], 1
je 0x77ca3f62
jmp 0x77ca4670
push 0x57
jmp 0x77cec06c
mov dword [ebp - 0x28], ebx
jmp 0x77ca3f1c
push 0xe
pop eax
jmp 0x77ca3f40
cmp dword [ebp - 0x1c], 2
jne 0x77ca3f50
jmp 0x77ca3f62
push 0xe
pop edi
jmp 0x77ca3f80
mov edi, 0x216
jmp 0x77ca3fbe
push 0xe
pop edi
jmp 0x77ca4051
push 0xd
pop edi
jmp 0x77cec0d4
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push esi
call fcn.77ca1178
mov edi, eax
cmp edi, ebx
je 0x77ca3eeb
jmp 0x77cec0d4
push dword [ebp - 0x24]
push 0x4c1
push esi
call fcn.77ca972d
jmp 0x77ca461e
push dword [ebp - 0x2c]
push 0x4e6
push esi
call fcn.77ca972d
jmp 0x77ca3e46
push 0xd
pop edi
jmp 0x77ca3fbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77ca3fbe
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
jmp 0x77ca4045
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77ca4061