Function at 0x90633b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x90a94b8
call fcn.09007236
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x244], esi
call fcn.0909ff92
test al, al
je 0x906363d
mov ecx, ebx
call fcn.090122fd
push 0x90be558
push ebx
call fcn.0909ff92
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.0909ff92
push dword [ebp - 0x224]
xor edi, edi
push edi
push 0x69636d32
push ebx
mov dword [ebp - 4], edi
call fcn.09060881
add esp, 0x10
mov ecx, esi
push eax
call fcn.0909ff92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0909ff92
mov eax, dword [esi + 8]
push edi
push edi
push 5
mov dword [ebp - 0x224], eax
call fcn.0909ff92
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionICMICMatchers
test al, al
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMICMatchers
lea eax, [ebp - 0x22c]
cmove ecx, edx
push eax
push 0x20019
push edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x906363d
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x9063631
mov ebx, edi
cmp dword [ebp - 0x228], ebx
jbe 0x9063631
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 5
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x9063624
cmp dword [ebp - 0x240], 1
jne 0x9063624
lea eax, [ebp - 0x11c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
test eax, eax
je 0x9063556
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
je 0x9063556
cmp byte [ebp + ecx - 0x11c], 0x3a
jne 0x9063540
mov al, byte [ebp + ecx - 0x11b]
cmp al, 0x2f
je 0x9063547
cmp al, 0x5c
je 0x9063547
inc ecx
cmp ecx, edx
jb 0x9063527
jmp 0x9063556
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x9063622
push str.CMGetInfo
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x220]
push 0x104
push eax
push 5
mov ecx, esi
call dword [0x90ac2d4]
call esi
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x906361b
movsx esi, byte [ebp - 0x18]
movsx eax, byte [ebp - 0x17]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x16]
shl esi, 8
or esi, eax
movsx eax, byte [ebp - 0x15]
shl esi, 8
or esi, eax
lea eax, [ebp - 0x220]
push 0x4d534654
push eax
push dword [ebp - 0x230]
call fcn.09017803
add esp, 0xc
lea ecx, [ebp - 0x234]
push eax
call fcn.0909ff92
push dword [ebp - 0x234]
mov dword [ebp - 4], 1
push esi
push 0x69636d32
push dword [ebp - 0x230]
call fcn.09060881
mov ecx, dword [ebp - 0x244]
add esp, 0x10
push dword [ebp - 0x224]
push eax
call fcn.0906070a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0909ff92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor edi, edi
inc ebx
cmp ebx, dword [ebp - 0x228]
jb 0x90634af
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.09008fc6
ret