Function at 0x719e4cef
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, 0x208
push edi
xor ebx, ebx
push ebx
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x10], esi
je 0x719e4df7
push 0x719cc060
push esi
call dword [sym.imp._Cmvrt.DLL_wcscpy]
push dword [ebp + 8]
push esi
mov esi, dword [sym.imp._Cmvrt.DLL_wcscat]
call esi
push 0x719e500c
push dword [ebp - 0x10]
call esi
add esp, 0x18
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x10]
push reloc.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_2
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp._Cntl.DLL_RtlFreeHeap]
push ebx
push dword [0x719f71dc]
mov dword [ebp - 0x14], eax
call esi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x719e4fc6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x719e5000
push dword [ebp - 8]
mov dword [ebp - 4], 4
call dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
cmp eax, ebx
je 0x719e4da6
mov esi, eax
jmp 0x719e4e3d
test byte [ebp - 0x18], 8
jne 0x719e4db4
push 0x32
pop esi
jmp 0x719e4e3d
push edi
push ebx
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x719e4dcd
push 8
jmp 0x719e4dae
push edi
push ebx
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x719e4dff
push dword [ebp - 8]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
push dword [ebp - 0x14]
push ebx
push dword [0x719f71dc]
call esi
push 8
pop eax
jmp 0x719e4fc6
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0x14]
push edi
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x719e4fe4
push dword [ebp - 8]
call dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x719e4e4b
push edi
push ebx
push dword [0x719f71dc]
call esi
push dword [ebp + 8]
push ebx
push dword [0x719f71dc]
call esi
mov esi, dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
jmp 0x719e4eec
push 0x104
push dword [ebp + 8]
push edi
call dword [sym.imp._CKERNEL.DLL_ExpandEnvironmentStringsW]
push edi
push ebx
push dword [0x719f71dc]
call esi
push dword [ebp + 8]
call dword [sym.imp._CKERNEL.DLL_LoadLibraryW]
push dword [ebp + 8]
mov edi, eax
push ebx
push dword [0x719f71dc]
mov dword [ebp - 0x10], edi
call esi
push dword [ebp - 8]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
cmp edi, ebx
je 0x719e4ea5
push 0x719e4fd0
push edi
call dword [sym.imp._CKERNEL.DLL_GetProcAddress]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x719e4eb0
push edi
call dword [sym.imp._CKERNEL.DLL_FreeLibrary]
call dword [sym.imp._CKERNEL.DLL_GetLastError]
jmp 0x719e4fc6
lea ecx, [ebp - 4]
push ecx
xor edi, edi
push ebx
lea ecx, [ebp - 0xc]
inc edi
push ecx
mov dword [ebp - 0xc], edi
call eax
cmp dword [ebp - 0xc], edi
jae 0x719e4eca
push 0x32
jmp 0x719e4ee2
push dword [ebp - 4]
push ebx
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
jne 0x719e4ef3
push 8
pop esi
push dword [ebp - 0x10]
call dword [sym.imp._CKERNEL.DLL_FreeLibrary]
mov eax, esi
jmp 0x719e4fc6
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 1
call dword [ebp + 8]
cmp eax, ebx
ja 0x719e4f25
push dword [ebp - 0x10]
call dword [sym.imp._CKERNEL.DLL_FreeLibrary]
push edi
push ebx
push dword [0x719f71dc]
call esi
or eax, 0xffffffff
jmp 0x719e4fc6
mov dword [ebp + 8], eax
push 0x28
push ebx
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
cmp eax, ebx
je 0x719e4fb8
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x719e4f4f
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
jmp 0x719e4f51
xor ecx, ecx
xor edx, edx
inc edx
mov dword [eax + 0xc], ecx
cmp dword [edi], edx
jbe 0x719e4f63
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
jmp 0x719e4f65
xor ecx, ecx
mov dword [eax + 0x14], ecx
cmp dword [edi], 2
jbe 0x719e4f75
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 8]
jmp 0x719e4f77
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [edi]
mov dword [eax + 0x20], ecx
mov ecx, dword [edi + 0xc]
mov dword [eax + 0x18], ecx
mov ecx, dword [edi + 8]
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x24], edx
xor ecx, ecx
cmp dword [0x719f8664], ebx
jbe 0x719e4fb2
mov edx, dword [eax + 0x1c]
mov esi, dword [0x719f8660]
cmp edx, dword [esi + ecx*4]
jne 0x719e4fa9
mov dword [eax + 0x24], ebx
inc ecx
cmp ecx, dword [0x719f8664]
jb 0x719e4f9b
push eax
call fcn.719e4a75
add edi, 0x10
dec dword [ebp + 8]
jne 0x719e4f28
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4