Function at 0x1019749
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x40
push 0x1006748
call fcn.010145b0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x1006738
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
je 0x1019c9f
mov edi, 0x106f8a0
mov esi, 0x106e760
mov dword [ebp - 0x24], ebx
mov byte [0x107f8a0], bl
push ebx
push 0xfffa
push 0x107f8a0
push 1
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1019c95
push 0x107f8a0
push 0x1006728
call sub.ntdll.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x10198a4
mov byte [0x106f8a0], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x101988d
mov byte [0x106e760], bl
push ebx
push 0x1000
push esi
push 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
cmp eax, ebx
je 0x101988d
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], ebx
cmp eax, ebx
je 0x1019848
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x1019839
call eax
mov dword [ebp - 0x1c], eax
push eax
push esi
push 0x10066ec
jmp 0x1019855
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10066b0
jmp 0x1019855
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1006678
call fcn.01015c5a
add esp, 0xc
or dword [ebp - 4], 0xffffffff
jmp 0x1019bd8
push 0x1006628
call fcn.01015c42
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019c71
push 0x107f8a0
push 0x1006614
call sub.ntdll.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1019927
mov byte [0x106f8a0], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x101991d
push 0x1000
push esi
push edi
call fcn.010166f8
cmp eax, 0xffffffff
je 0x1019912
push esi
call sub.msvcrt.dll__strdup
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1019908
mov dword [ebp - 0x24], 1
push eax
push edi
push 0x10065d4
jmp 0x1019bc1
push 0x10065a4
jmp 0x1019b81
push edi
push 0x1006558
jmp 0x1019bd1
push 0x1006500
jmp 0x1019892
push 0x107f8a0
push 0x10064e8
call sub.ntdll.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1019b14
mov byte [0x106f8a0], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1019b0a
mov byte [0x106e760], bl
push ebx
push 0x1000
push esi
push 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1019b0a
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1019ad5
mov dword [ebp - 0x20], ebx
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10199ae
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x10199e4
cmp eax, 0xea
je 0x10199e4
push eax
push 0x10064a0
jmp 0x1019a35
mov eax, dword [ebp - 0x28]
dec eax
je 0x1019a68
sub eax, 3
je 0x10199f9
push dword [ebp - 0x28]
push 0x1006440
jmp 0x1019a35
mov dword [ebp - 0x20], 4
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1019a05
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x1019a41
push eax
push 0x1006408
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1019aca
push 0x22
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1019908
mov dword [ebp - 0x24], 1
push 0xa
push eax
push dword [ebp - 0x34]
call sub.msvcrt.dll__ultoa
jmp 0x1019ac7
push dword [ebp - 0x20]
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1019908
mov dword [ebp - 0x24], 1
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1019a88
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x1019aca
push eax
push 0x10063c0
call fcn.01015c5a
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
mov dword [ebp - 0x1c], ebx
add esp, 0xc
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1019ae2
push eax
push 0x1006388
call fcn.01015c5a
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x1019afe
push dword [ebp - 0x1c]
push esi
push edi
push 0x1006340
call fcn.01015c5a
add esp, 0x10
jmp 0x1019bd8
push esi
push edi
push 0x1006300
jmp 0x1019bc1
push 0x10062a8
jmp 0x1019892
push 0x107f8a0
push 0x1006290
call sub.ntdll.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1019c7f
mov byte [0x106f8a0], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1019c75
push edi
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0x1019bcb
push ebx
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x1019bb2
push eax
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x1019b8d
push 0x1006258
call fcn.01015c42
push 8
jmp 0x1019899
mov dword [ebp - 0x24], 1
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1019bb2
push dword [ebp - 0x1c]
push edi
push 0x1006218
jmp 0x1019bc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x30]
push 0x10061d0
call fcn.01015c5a
add esp, 0xc
jmp 0x1019bd8
push edi
push 0x1006178
call fcn.01015c5a
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x1019c1b
mov byte [0x106f8a0], bl
push ebx
push 0xfffa
push edi
push ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1019c60
push dword [ebp - 0x1c]
push edi
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpSetDynamicStringA]
test eax, eax
je 0x1019c46
push dword [ebp - 0x1c]
push edi
push 0x100613c
call fcn.01015c5a
add esp, 0xc
cmp dword [ebp - 0x24], ebx
je 0x1019c31
cmp dword [ebp - 0x1c], ebx
je 0x1019c31
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
pop ecx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x50]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
jne 0x1019785
jmp 0x1019ca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x1c]
push edi
push 0x10060f0
call fcn.01015c5a
add esp, 0x10
jmp 0x1019c71
push 0x107f8a0
push 0x10060b4
call fcn.01015c5a
pop ecx
pop ecx
xor esi, esi
jmp 0x1019cac
push 0x1006060
jmp 0x1019892
push 0x107f8a0
push 0x1006024
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1019897
push 0x1005ff0
jmp 0x1019892
push 0x1005fc0
call fcn.01015c42
xor esi, esi
inc esi
cmp dword [ebp - 0x24], ebx
je 0x1019cbf
cmp dword [ebp - 0x1c], ebx
je 0x1019cbf
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
call fcn.010145eb
ret 4