Function at 0x90642f8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x90aba98
call fcn.09007445
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x244], esi
call fcn.090446cf
test al, al
je 0x9064585
mov ecx, ebx
call fcn.09012a13
push 0x90c0558
push ebx
call fcn.090446cf
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.090446cf
push dword [ebp - 0x224]
xor edi, edi
push edi
push 0x69636d32
push ebx
mov dword [ebp - 4], edi
call fcn.09061721
add esp, 0x10
mov ecx, esi
push eax
call fcn.090446cf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.090199ca
mov eax, dword [esi + 8]
push edi
push edi
push 5
mov dword [ebp - 0x224], eax
call fcn.090446cf
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionICMICMatchers
test al, al
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMICMatchers
lea eax, [ebp - 0x22c]
cmove ecx, edx
push eax
push 0x20019
push edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9064585
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x9064579
mov ebx, edi
cmp dword [ebp - 0x228], ebx
jbe 0x9064579
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 5
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x906456c
cmp dword [ebp - 0x240], 1
jne 0x906456c
lea eax, [ebp - 0x11c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
test eax, eax
je 0x906449e
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
je 0x906449e
cmp byte [ebp + ecx - 0x11c], 0x3a
jne 0x9064488
mov al, byte [ebp + ecx - 0x11b]
cmp al, 0x2f
je 0x906448f
cmp al, 0x5c
je 0x906448f
inc ecx
cmp ecx, edx
jb 0x906446f
jmp 0x906449e
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x906456a
push str.CMGetInfo
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x220]
push 0x104
push eax
push 5
mov ecx, esi
call dword [0x90ae2d0]
call esi
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x9064563
movsx esi, byte [ebp - 0x18]
movsx eax, byte [ebp - 0x17]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x16]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x15]
shl esi, 8
or esi, eax
lea eax, [ebp - 0x220]
push 0x4d534654
push eax
push dword [ebp - 0x230]
call fcn.09017c73
add esp, 0xc
lea ecx, [ebp - 0x234]
push eax
call fcn.090446cf
push dword [ebp - 0x234]
mov dword [ebp - 4], 1
push esi
push 0x69636d32
push dword [ebp - 0x230]
call fcn.09061721
mov ecx, dword [ebp - 0x244]
add esp, 0x10
push dword [ebp - 0x224]
push eax
call fcn.090615aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.090199ca
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor edi, edi
inc ebx
cmp ebx, dword [ebp - 0x228]
jb 0x90643f7
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.090091e6
ret