Function at 0x1067957
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x1099a38]
push edi
xor edi, edi
cmp dword [0x109a048], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x31c], edi
jne 0x1067992
xor eax, eax
jmp 0x1067c26
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
push 0x1021f30
call ebx
cmp eax, edi
mov dword [ebp - 0x32c], eax
je 0x1067a2a
cmp eax, esi
jae 0x1067a2a
lea eax, [ebp - 0x318]
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x108]
push 0x2f
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x10679f4
xor eax, eax
mov cl, byte [ebp + eax - 0x108]
mov byte [ebp + eax - 0x318], cl
inc eax
test cl, cl
jne 0x10679df
jmp 0x1067a2a
mov edi, dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x318]
push 0x102129c
push eax
call edi
lea ecx, [ebp - 0x108]
lea eax, [ebp + eax - 0x318]
push ecx
push eax
mov dword [ebp - 0x31c], eax
call edi
add dword [ebp - 0x31c], eax
add esp, 0x10
xor edi, edi
push esi
lea eax, [ebp - 0x108]
push eax
push 0x1021f1c
call ebx
test eax, eax
je 0x1067a43
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x340]
push eax
push edi
push 0x1017ad4
push dword [0x109a048]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
mov ebx, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
jmp 0x1067ad8
cmp byte [ebp - 0x108], 0
je 0x1067b03
mov eax, dword [ebp - 0x31c]
cmp eax, edi
je 0x1067aa7
cmp byte [eax], 0
jne 0x1067aa7
push 0x10212a4
lea eax, [ebp - 0x108]
push eax
call fcn.01074be9
cmp eax, edi
je 0x1067aa7
mov edx, dword [ebp - 0x31c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1067a9d
cmp dword [ebp - 0x324], edi
je 0x1067af9
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.010678df
test eax, eax
je 0x1067aca
mov dword [ebp - 0x320], 1
lea eax, [ebp - 0x340]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
je 0x1067b03
push edi
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x340]
push edi
push eax
call ebx
test eax, eax
jne 0x1067a64
jmp 0x1067b03
mov dword [ebp - 0x320], 1
lea eax, [ebp - 0x340]
push eax
push edi
push 0x1017ac4
push dword [0x109a048]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
je 0x1067b65
push edi
push esi
lea eax, [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x340]
push eax
call ebx
test eax, eax
je 0x1067b65
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
cmp eax, edi
pop ecx
mov dword [0x10bbbcc], eax
jne 0x1067b5b
push 0x1021ee4
call fcn.01071ac0
pop ecx
jmp 0x1067b65
mov dword [ebp - 0x320], 1
cmp dword [ebp - 0x320], edi
je 0x1067c08
cmp dword [ebp - 0x324], edi
je 0x1067beb
lea eax, [ebp - 0x328]
push eax
push 1
push edi
push 0x1021eb8
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1067beb
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x330]
push eax
push edi
push 0x1021eac
push dword [ebp - 0x328]
mov dword [ebp - 0x32c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1067bdf
cmp dword [ebp - 0x330], 1
jne 0x1067bdf
push 1
lea eax, [ebp - 0x108]
push eax
call fcn.010678df
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x31c]
cmp eax, edi
je 0x1067c08
cmp byte [eax], 0
je 0x1067c08
push 1
lea eax, [ebp - 0x318]
push eax
call fcn.010678df
cmp dword [0x10bbbc8], edi
pop esi
pop ebx
jne 0x1067c20
cmp dword [0x10bbbcc], edi
jne 0x1067c20
mov dword [ebp - 0x320], edi
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp - 4]
pop edi
call fcn.0106bc50
leave
ret