Function at 0x1000b3ae
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x1001b100]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x360]
push eax
mov esi, ecx
mov ebx, edx
xor ecx, ecx
push 0x20019
push ecx
push 0x10001ef4
mov byte [ebx], cl
push esi
mov dword [edi], ecx
mov dword [ebp - 0x360], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b83b
push 0x105
push eax
lea eax, [ebp - 0x34c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x34c]
mov edx, 0x105
call fcn.1000b0fd
test eax, eax
je 0x1000b44e
cmp byte [ebp - 0x34c], 0
je 0x1000b82f
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x244]
push 0x105
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_strcpy_s]
add esp, 0xc
jmp 0x1000b485
lea eax, [ebp - 0x364]
mov dword [ebp - 0x364], 0x104
push eax
xor ecx, ecx
lea eax, [ebp - 0x244]
push eax
push ecx
push ecx
push ecx
push dword [ebp - 0x360]
mov byte [ebp - 0x140], cl
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b82f
and dword [ebp - 0x358], 0
lea eax, [ebp - 0x358]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x360]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
je 0x1000b518
cmp esi, 0x80000001
jne 0x1000b82f
push 0x10001f0c
mov esi, 0x105
lea eax, [ebp - 0x13c]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x13c]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x358]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x13c]
push eax
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b82f
cmp dword [ebp + 0xc], 0
push 4
pop esi
je 0x1000b570
and dword [ebp - 0x35c], 0
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x350], esi
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f24
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b570
cmp dword [ebp - 0x354], esi
jne 0x1000b570
cmp dword [ebp - 0x35c], eax
je 0x1000b570
mov dword [edi], 1
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
and dword [ebp - 0x35c], eax
xor esi, esi
push 4
rep stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x350]
mov dword [ebp - 0x368], esi
push eax
lea eax, [ebp - 0x364]
mov dword [ebp - 0x350], edi
push eax
lea eax, [ebp - 0x354]
push eax
push esi
push 0x10001f30
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b5c4
cmp dword [ebp - 0x354], edi
je 0x1000b5cf
xor edi, edi
inc edi
mov dword [ebp - 0x364], edi
jmp 0x1000b5d2
xor edi, edi
inc edi
lea eax, [ebp - 0x350]
push eax
push 0
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f40
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b655
cmp dword [ebp - 0x354], 7
jne 0x1000b655
mov esi, dword [ebp - 0x350]
inc esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x35c], eax
test eax, eax
je 0x1000b64f
mov ecx, dword [ebp - 0x350]
mov byte [eax + ecx], 0
lea ecx, [ebp - 0x350]
push ecx
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f40
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
mov esi, dword [ebp - 0x368]
lea eax, [ebp - 0x350]
push eax
push 0
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f54
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b6ce
cmp dword [ebp - 0x354], 7
jne 0x1000b6ce
mov esi, dword [ebp - 0x350]
inc esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000b6ce
mov ecx, dword [ebp - 0x350]
lea eax, [ebp - 0x350]
push eax
push esi
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f54
mov byte [esi + ecx], 0
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
lea eax, [ebp - 0x350]
mov dword [ebp - 0x350], 0x27
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0x10001f64
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000b772
cmp dword [ebp - 0x354], edi
jne 0x1000b772
cmp dword [ebp - 0x364], eax
jne 0x1000b71c
call fcn.1000b220
test eax, eax
je 0x1000b71c
xor edi, edi
mov eax, dword [ebp - 0x35c]
test eax, eax
je 0x1000b73f
push edi
push 0x105
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call sym.MAPI32.dll_FGetComponentPath
test eax, eax
jne 0x1000b7f9
test esi, esi
je 0x1000b75c
push edi
push 0x105
push ebx
push esi
lea eax, [ebp - 0x30]
push eax
call sym.MAPI32.dll_FGetComponentPath
test eax, eax
jne 0x1000b7ed
push edi
push 0x105
push ebx
push 0
lea eax, [ebp - 0x30]
push eax
call sym.MAPI32.dll_FGetComponentPath
test eax, eax
jne 0x1000b7ed
cmp dword [ebp + 0xc], 0
mov edi, 0x104
mov dword [ebp - 0x350], edi
mov eax, 0x10001f74
mov byte [ebx + 0x104], 0
jne 0x1000b794
mov eax, 0x10001f7c
lea ecx, [ebp - 0x350]
push ecx
push ebx
lea ecx, [ebp - 0x354]
push ecx
push 0
push eax
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
je 0x1000b7bb
mov byte [ebx], 0
jmp 0x1000b7ed
cmp dword [ebp - 0x354], 2
jne 0x1000b7ed
push edi
lea eax, [ebp - 0x13c]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1000b7ed
lea eax, [ebp - 0x13c]
push eax
push 0x105
push ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_strcpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x35c]
test eax, eax
je 0x1000b80f
jmp 0x1000b7ff
mov eax, dword [ebp - 0x35c]
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0x1000b823
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push dword [ebp - 0x358]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push dword [ebp - 0x360]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp byte [ebx], al
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100174b0
leave
ret 0xc