Function at 0x9060cb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x90a44f5
call fcn.090070c5
mov edi, dword [ebp + 8]
mov ecx, edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x240], ebx
call fcn.0906767e
test al, al
je 0x9060f34
mov ecx, edi
call fcn.090125e6
push 0x90b8008
push edi
call fcn.0906767e
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.0906767e
push dword [ebp - 0x224]
xor esi, esi
push esi
push 0x69636d32
push edi
mov dword [ebp - 4], esi
call fcn.0905e623
add esp, 0x10
mov ecx, ebx
push eax
call fcn.0906767e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.09019ed5
mov eax, dword [ebx + 8]
push esi
push esi
push 5
mov dword [ebp - 0x244], eax
call fcn.0906767e
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionICMICMatchers
test al, al
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMICMatchers
lea eax, [ebp - 0x22c]
cmove ecx, edx
push eax
push 0x20019
push esi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9060f34
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x9060f28
mov dword [ebp - 0x224], esi
cmp dword [ebp - 0x228], esi
jbe 0x9060f28
lea eax, [ebp - 0x238]
mov dword [ebp - 0x234], 5
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x9060f15
cmp dword [ebp - 0x23c], 1
jne 0x9060f15
lea eax, [ebp - 0x11c]
xor ebx, ebx
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_strnlen]
pop ecx
pop ecx
test eax, eax
je 0x9060e57
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
je 0x9060e57
cmp byte [ebp + ecx - 0x11c], 0x3a
jne 0x9060e41
mov al, byte [ebp + ecx - 0x11b]
cmp al, 0x2f
je 0x9060e48
cmp al, 0x5c
je 0x9060e48
inc ecx
cmp ecx, edx
jb 0x9060e28
jmp 0x9060e57
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x9060f15
push str.CMGetInfo
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 5
call eax
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x9060f0e
movsx esi, byte [ebp - 0x18]
movsx eax, byte [ebp - 0x17]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x16]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x15]
shl esi, 8
or esi, eax
lea eax, [ebp - 0x220]
push 0x4d534654
push eax
push edi
call fcn.09017543
add esp, 0xc
lea ecx, [ebp - 0x230]
push eax
call fcn.0906767e
push dword [ebp - 0x230]
mov dword [ebp - 4], 1
push esi
push 0x69636d32
push edi
call fcn.0905e623
mov ecx, dword [ebp - 0x240]
add esp, 0x10
push dword [ebp - 0x244]
push eax
call fcn.0905e4c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.09019ed5
mov esi, dword [ebp - 0x224]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
inc esi
mov dword [ebp - 0x224], esi
cmp esi, dword [ebp - 0x228]
jb 0x9060dad
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.09008ed9
ret