Function at 0x9057d45
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x240
mov eax, 0x90a23f1
call fcn.0900621d
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x240], esi
call fcn.0903b6c0
test al, al
je 0x905800a
mov ecx, edi
call fcn.090421cc
push str.____ACE_MicrosoftICMMicrosoft_ICM
push edi
call fcn.0903b6c0
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.0903b6c0
push dword [ebp - 0x224]
xor edi, edi
push edi
mov ebx, 0x69636d32
push ebx
push dword [ebp - 0x22c]
mov dword [ebp - 4], edi
call fcn.0905472e
add esp, 0x10
push eax
mov ecx, esi
call fcn.0903b6c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0901c194
mov eax, dword [esi + 8]
mov esi, 0x94
push esi
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0xac]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xac], esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 2
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMICMatchers
je 0x9057e11
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionICMICMatchers
lea ecx, [ebp - 0x228]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x905800a
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x230]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x228]
mov dword [ebp - 0x230], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x9057ffe
mov dword [ebp - 0x224], edi
cmp dword [ebp - 0x230], edi
jbe 0x9057ffe
mov edi, 0x104
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x244]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x224]
mov dword [ebp - 0x238], 5
push dword [ebp - 0x228]
mov dword [ebp - 0x23c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x9057fe6
cmp dword [ebp - 0x244], 1
jne 0x9057fe6
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strnlen]
pop ecx
pop ecx
cmp eax, esi
jbe 0x9057fe6
dec eax
je 0x9057fe6
cmp byte [ebp + esi - 0x11c], 0x3a
jne 0x9057f08
mov cl, byte [ebp + esi - 0x11b]
cmp cl, 0x2f
je 0x9057f12
cmp cl, 0x5c
je 0x9057f12
inc esi
cmp esi, eax
jb 0x9057eed
jmp 0x9057fe6
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x248], esi
test esi, esi
je 0x9057fe6
push str.CMGetInfo
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
lea ecx, [ebp - 0x220]
push ecx
push 5
call eax
push eax
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x9057fda
movsx esi, byte [ebp - 0x18]
movsx eax, byte [ebp - 0x17]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x16]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x15]
shl esi, 8
or esi, eax
push 0x4d534654
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x22c]
call fcn.09098bf5
add esp, 0xc
push eax
lea ecx, [ebp - 0x234]
call fcn.0903b6c0
push dword [ebp - 0x234]
mov dword [ebp - 4], 1
push esi
push ebx
push dword [ebp - 0x22c]
call fcn.0905472e
mov ecx, dword [ebp - 0x240]
add esp, 0x10
push dword [ebp - 0x24c]
push eax
call fcn.09054838
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0901c194
push dword [ebp - 0x248]
call dword [sym.imp.kernel32.dll_FreeLibrary]
inc dword [ebp - 0x224]
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x230]
jb 0x9057e74
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0900804d
ret