Function at 0x5711aa
Capabilities:
Query environment variable

Disassembly:
push 0x124
mov eax, 0x63d5e4
call fcn.005de4ce
mov dword [ebp - 0x130], ecx
mov esi, 0x69228b
xor ebx, ebx
push esi
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x119], bl
call fcn.0057115f
push esi
lea ecx, [ebp - 0x124]
mov dword [ebp - 4], ebx
call fcn.0057115f
push esi
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.0057115f
mov byte [ebp - 4], 2
call fcn.00570a48
test eax, eax
jne 0x571241
push str.Legacy_machine_found__n
call fcn.005dcd3f
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, 1
call fcn.005de52a
ret
push 0x64
push 1
call fcn.005dccff
pop ecx
pop ecx
mov edi, eax
push 0x64
push edi
push str.WINDIR
mov dword [ebp - 0x12c], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp edi, ebx
je 0x571274
push 0x64
push edi
call fcn.005dc877
pop ecx
pop ecx
cmp eax, ebx
ja 0x57127e
mov esi, str.c:windows
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push str._s_system32_regsvr32.exe
push eax
call fcn.005710e6
push dword [ebp - 0x12c]
lea eax, [ebp - 0x124]
push str._s_syswow64_regsvr32.exe
push eax
call fcn.005710e6
add esp, 0x18
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
push str.checkForSign_:_File_Path_:__s_n
call fcn.005dcd3f
pop ecx
lea eax, [ebp - 0x118]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5712e2
sub eax, edx
push eax
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x120]
call fcn.00570fb0
lea ecx, [ebp - 0x120]
call fcn.00571079
mov ecx, eax
call fcn.00570efe
push eax
push str.checkForSign_:_GetModuleFileNameA_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00571079
mov ecx, eax
call fcn.00570efe
push eax
push str.checkForSign_:_regsvr32Path_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x124]
call fcn.00571079
mov ecx, eax
call fcn.00570efe
push eax
push str.checkForSign_:_regsvr32PathAlt_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00571079
mov ecx, eax
call fcn.00570efe
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00571079
mov ecx, eax
call fcn.00570efe
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5713a3
cmp dl, bl
je 0x57139f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5713a3
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x571383
xor eax, eax
jmp 0x5713a8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x571460
lea ecx, [ebp - 0x124]
call fcn.00571079
mov ecx, eax
call fcn.00570efe
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00571079
mov ecx, eax
call fcn.00570efe
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5713f8
cmp dl, bl
je 0x5713f4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5713f8
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x5713d8
xor eax, eax
jmp 0x5713fd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x571460
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x118]
push eax
call fcn.005706a4
test eax, eax
setne byte [ebp - 0x119]
movzx eax, byte [ebp - 0x119]
push eax
push str.checkForSign_:_isSignatureMatches_:__d_n
call fcn.005dcd3f
pop ecx
pop ecx
push dword [ebp - 0x12c]
call fcn.005dcea1
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, byte [ebp - 0x119]
jmp 0x571495
push str.checkForSign_:_skipped_signature_check_for_regsvr32.exe__n
call fcn.005dcd3f
push dword [ebp - 0x12c]
call fcn.005dcea1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, 1
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, bl
jmp 0x57123b