Function at 0x9070b7c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x90d355c
call fcn.09006dd9
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x244], esi
call fcn.09037ac3
test al, al
je 0x9070e09
mov ecx, ebx
call fcn.0901471e
push 0x90e9e28
push ebx
call fcn.09037ac3
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.09037ac3
push dword [ebp - 0x224]
xor edi, edi
push edi
push 0x69636d32
push ebx
mov dword [ebp - 4], edi
call fcn.0906d79b
add esp, 0x10
mov ecx, esi
push eax
call fcn.09037ac3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0901b69b
mov eax, dword [esi + 8]
push edi
push edi
push 5
mov dword [ebp - 0x224], eax
call fcn.09037ac3
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionICMICMatchers
test al, al
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMICMatchers
lea eax, [ebp - 0x22c]
cmove ecx, edx
push eax
push 0x20019
push edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9070e09
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x9070dfd
mov ebx, edi
cmp dword [ebp - 0x228], ebx
jbe 0x9070dfd
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 5
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x9070df0
cmp dword [ebp - 0x240], 1
jne 0x9070df0
lea eax, [ebp - 0x11c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
test eax, eax
je 0x9070d22
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
je 0x9070d22
cmp byte [ebp + ecx - 0x11c], 0x3a
jne 0x9070d0c
mov al, byte [ebp + ecx - 0x11b]
cmp al, 0x2f
je 0x9070d13
cmp al, 0x5c
je 0x9070d13
inc ecx
cmp ecx, edx
jb 0x9070cf3
jmp 0x9070d22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x9070dee
push str.CMGetInfo
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x220]
push 0x104
push eax
push 5
mov ecx, esi
call dword [0x90d62d0]
call esi
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x9070de7
movsx esi, byte [ebp - 0x18]
movsx eax, byte [ebp - 0x17]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x16]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x15]
shl esi, 8
or esi, eax
lea eax, [ebp - 0x220]
push 0x4d534654
push eax
push dword [ebp - 0x230]
call fcn.0901a3a3
add esp, 0xc
lea ecx, [ebp - 0x234]
push eax
call fcn.09037ac3
push dword [ebp - 0x234]
mov dword [ebp - 4], 1
push esi
push 0x69636d32
push dword [ebp - 0x230]
call fcn.0906d79b
mov ecx, dword [ebp - 0x244]
add esp, 0x10
push dword [ebp - 0x224]
push eax
call fcn.0906d628
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0901b69b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor edi, edi
inc ebx
cmp ebx, dword [ebp - 0x228]
jb 0x9070c7b
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.09006f96
ret