Function at 0x57112e
Capabilities:
Query environment variable

Disassembly:
push 0x120
mov eax, 0x63c5d4
call fcn.005dd4de
mov dword [ebp - 0x12c], ecx
mov esi, 0x69123b
push esi
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x119], 0
call fcn.005710e3
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x124]
call fcn.005710e3
push esi
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.005710e3
mov byte [ebp - 4], 2
call fcn.00570a16
test eax, eax
jne 0x5711c5
push str.Legacy_machine_found__n
call fcn.005dbd3f
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, 1
call fcn.005dd53a
ret
push 0x64
push 1
call fcn.005dbcff
pop ecx
pop ecx
push 0x64
mov ebx, eax
push ebx
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test ebx, ebx
je 0x5711f2
push 0x64
push ebx
call fcn.005db877
pop ecx
pop ecx
test eax, eax
jne 0x5711fe
mov esi, str.c:windows
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ebx
lea eax, [ebp - 0x128]
push str._s_system32_regsvr32.exe
push eax
call fcn.0057106a
push ebx
lea eax, [ebp - 0x124]
push str._s_syswow64_regsvr32.exe
push eax
call fcn.0057106a
add esp, 0x18
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
push str.checkForSign_:_File_Path_:__s_n
call fcn.005dbd3f
pop ecx
lea eax, [ebp - 0x118]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x571259
sub eax, edx
push eax
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x120]
call fcn.00570f34
lea ecx, [ebp - 0x120]
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
push eax
push str.checkForSign_:_GetModuleFileNameA_:__s_n
call fcn.005dbd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
push eax
push str.checkForSign_:_regsvr32Path_:__s_n
call fcn.005dbd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x124]
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
push eax
push str.checkForSign_:_regsvr32PathAlt_:__s_n
call fcn.005dbd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x57131a
test dl, dl
je 0x571316
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x57131a
add eax, 2
add ecx, 2
test dl, dl
jne 0x5712fa
xor eax, eax
jmp 0x57131f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5713cb
lea ecx, [ebp - 0x124]
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00570ffd
mov ecx, eax
call fcn.00570e82
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x57136f
test dl, dl
je 0x57136b
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x57136f
add eax, 2
add ecx, 2
test dl, dl
jne 0x57134f
xor eax, eax
jmp 0x571374
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5713cb
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x118]
push eax
call fcn.0057067f
test eax, eax
setne byte [ebp - 0x119]
movzx eax, byte [ebp - 0x119]
push eax
push str.checkForSign_:_isSignatureMatches_:__d_n
call fcn.005dbd3f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, byte [ebp - 0x119]
jmp 0x5713f4
push str.checkForSign_:_skipped_signature_check_for_regsvr32.exe__n
call fcn.005dbd3f
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, 1
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, bl
jmp 0x5711bf