Function at 0x100019c4
Capabilities:
Query environment variable

Disassembly:
push 0xee8
mov eax, 0x10010704
call fcn.1000f57b
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, 0x10017d5c
mov dword [ebp - 0xe50], edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0xe64], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0xe54]
mov byte [ebp - 4], 1
call fcn.100018f5
mov byte [ebp - 4], 2
cmp ebx, edi
je 0x10002105
mov eax, dword [ebx]
cmp eax, edi
je 0x10002105
cmp eax, 0x24
jbe 0x10001a47
push 0x24
lea eax, [ebp - 0xe94]
push str.Wrong_ApplicationInfo_size__should_be_no_more_than__d_bytes.
push eax
call fcn.100010d0
add esp, 0xc
push 0x10013f08
lea eax, [ebp - 0xe94]
push eax
call fcn.100061ca
cmp eax, 4
jbe 0x100020e2
mov ecx, dword [ebx + 4]
cmp ecx, edi
je 0x100020e2
cmp eax, 0xc
jbe 0x100020e2
cmp dword [ebx + 0xc], edi
je 0x100020e2
cmp eax, 0x10
jbe 0x100020e2
cmp dword [ebx + 0x10], edi
je 0x100020e2
mov eax, dword [0x10017d58]
push ecx
add eax, 0x1c
push eax
call fcn.100027b4
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x10001ae3
push 3
push eax
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x114]
push eax
mov dword [ebp - 0x118], ecx
call fcn.10002e5f
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x118]
lea eax, [ebp - 0xe5c]
push eax
mov dword [ebp - 0xe50], 1
call fcn.100026ed
mov dword [ebp - 4], 4
mov dword [ebp - 0xe50], 3
jmp 0x10001b11
mov eax, dword [ebp - 0xe54]
add eax, 0xfffffff0
call fcn.10003003
add eax, 0x10
mov dword [ebp - 0xe58], eax
mov dword [ebp - 4], 5
lea eax, [ebp - 0xe58]
mov dword [ebp - 0xe50], 4
mov edi, dword [0x10017d58]
call fcn.1000273b
test byte [ebp - 0xe50], 4
je 0x10001b3a
mov eax, dword [ebp - 0xe58]
and dword [ebp - 0xe50], 0xfffffffb
add eax, 0xfffffff0
call fcn.10003e1a
test byte [ebp - 0xe50], 2
je 0x10001b58
mov eax, dword [ebp - 0xe5c]
and dword [ebp - 0xe50], 0xfffffffd
add eax, 0xfffffff0
call fcn.10003e1a
mov dword [ebp - 4], 2
test byte [ebp - 0xe50], 1
je 0x10001b82
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x10001b82
push dword [ebp - 0x118]
call fcn.100058c3
pop ecx
mov eax, dword [0x10017d58]
push dword [ebx + 0xc]
add eax, 4
push eax
call fcn.1000277c
mov eax, dword [0x10017d58]
push dword [ebx + 0x10]
add eax, 8
push eax
call fcn.1000277c
mov eax, dword [0x10017d58]
add eax, 0x1c
push eax
mov ecx, str.00000000_0000_0000_0000_000000000000
call fcn.100028e5
pop ecx
test al, al
je 0x10001bdf
lea eax, [ebp - 0xea4]
push str.Generate_new_GUID_for_ApplicationGUID.
push eax
call fcn.100010d0
pop ecx
pop ecx
push 0x10013f08
lea eax, [ebp - 0xea4]
jmp 0x10001a41
mov eax, dword [0x10017d58]
add eax, 4
push eax
mov ecx, str.AppName
call fcn.100028e5
pop ecx
test al, al
je 0x10001c1a
lea eax, [ebp - 0xee4]
push str.Set_correct_application_name.
push eax
call fcn.100010d0
pop ecx
pop ecx
push 0x10013f08
lea eax, [ebp - 0xee4]
jmp 0x10001a41
mov eax, dword [0x10017d58]
add eax, 8
push eax
mov ecx, str.Company
call fcn.100028e5
pop ecx
test al, al
je 0x10001c55
lea eax, [ebp - 0xe84]
push str.Set_correct_company_name.
push eax
call fcn.100010d0
pop ecx
pop ecx
push 0x10013f08
lea eax, [ebp - 0xe84]
jmp 0x10001a41
cmp dword [ebx], 0x14
mov ecx, dword [0x10017d58]
jbe 0x10001c6e
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [ecx + 0x14], eax
jmp 0x10001c75
xor eax, eax
lea edi, [ecx + 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebx], 0x1c
jbe 0x10001c80
mov ax, word [ebx + 0x1c]
jmp 0x10001c82
xor eax, eax
mov word [ecx + 0x18], ax
xor edi, edi
cmp dword [ebx], 0x20
jbe 0x10001ca0
mov ebx, dword [ebx + 0x20]
cmp ebx, edi
je 0x10001ca0
push ebx
add ecx, 0xc
push ecx
call fcn.1000277c
jmp 0x10001cb2
push dword [ecx + 0x1c]
lea eax, [ecx + 0xc]
push str.http:__www.drdump.com_AppPrivacyPolicy.aspx_AppID_s
call fcn.10003811
pop ecx
pop ecx
cmp esi, edi
je 0x10001d06
mov eax, dword [esi]
cmp eax, 0x34
jbe 0x10001ce3
push 0x34
lea eax, [ebp - 0xe74]
push str.Wrong_HandlerSettings_size__should_be_no_more_than__d.
push eax
call fcn.100010d0
add esp, 0xc
push 0x10013f08
lea eax, [ebp - 0xe74]
jmp 0x10001a41
cmp eax, 4
jbe 0x10001d06
mov eax, dword [0x10017d58]
xor ecx, ecx
cmp dword [esi + 4], 2
sete cl
mov dword [eax + 0x20], ecx
xor ecx, ecx
cmp dword [esi + 4], edi
setne cl
mov dword [eax + 0x24], ecx
jmp 0x10001d11
mov eax, dword [0x10017d58]
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
cmp esi, edi
je 0x10001d22
cmp dword [esi], 8
jbe 0x10001d22
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
jmp 0x10001d25
mov dword [eax + 0x28], edi
cmp esi, edi
je 0x10001d36
cmp dword [esi], 0xc
jbe 0x10001d36
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
jmp 0x10001d39
mov dword [eax + 0x2c], edi
cmp esi, edi
je 0x10001d4a
cmp dword [esi], 0x10
jbe 0x10001d4a
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x30], ecx
jmp 0x10001d4d
mov dword [eax + 0x30], edi
cmp esi, edi
je 0x10001d5e
cmp dword [esi], 0x14
jbe 0x10001d5e
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x34], ecx
jmp 0x10001d61
mov dword [eax + 0x34], edi
cmp esi, edi
je 0x10001d7e
mov ecx, dword [esi]
cmp ecx, 0x18
jbe 0x10001d7e
cmp ecx, 0x1c
jbe 0x10001d7e
cmp dword [esi + 0x18], edi
je 0x10001d7e
mov ecx, dword [esi + 0x1c]
mov dword [eax + 0x38], ecx
jmp 0x10001d85
mov dword [eax + 0x38], 2
cmp esi, edi
je 0x10001da1
cmp dword [esi], 0x20
jbe 0x10001da1
push dword [esi + 0x20]
add eax, 0x3c
push eax
call fcn.1000277c
mov ebx, 0x10013714
jmp 0x10001db0
mov ebx, 0x10013714
push ebx
add eax, 0x3c
push eax
call fcn.1000277c
cmp esi, edi
je 0x10001dbe
cmp dword [esi], 0x24
jbe 0x10001dbe
push dword [esi + 0x24]
jmp 0x10001dbf
push ebx
mov eax, dword [0x10017d58]
add eax, 0x40
push eax
call fcn.1000277c
cmp esi, edi
je 0x10001ddb
cmp dword [esi], 0x28
jbe 0x10001ddb
push dword [esi + 0x28]
jmp 0x10001ddc
push ebx
mov eax, dword [0x10017d58]
add eax, 0x44
push eax
call fcn.1000277c
cmp esi, edi
je 0x10001dfd
cmp dword [esi], 0x2c
jbe 0x10001dfd
mov eax, dword [esi + 0x2c]
mov dword [0x10017d50], eax
jmp 0x10001e03
mov dword [0x10017d50], edi
cmp esi, edi
je 0x10001e16
cmp dword [esi], 0x30
jbe 0x10001e16
mov eax, dword [esi + 0x30]
mov dword [0x10017d54], eax
jmp 0x10001e1c
mov dword [0x10017d54], edi
mov edi, dword [0x10017d58]
add edi, 0x48
lea eax, [ebp - 0xe54]
call fcn.1000273b
mov esi, 0x104
push esi
lea eax, [ebp - 0xa3c]
push eax
push dword [0x10017d3c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0xe4c]
push eax
push esi
lea eax, [ebp - 0xc44]
push eax
push esi
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.10005598
mov edi, dword [0x10017d58]
mov eax, dword [edi + 0x40]
add esp, 0x24
cmp dword [eax - 0xc], 0
jne 0x10001e93
push str..exe
push str.SendRpt
jmp 0x10001eb8
push 0x10013650
push eax
call fcn.10004f91
pop ecx
pop ecx
test eax, eax
je 0x10001eae
sub eax, dword [edi + 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x10001eeb
mov eax, dword [0x10017d58]
mov eax, dword [eax + 0x40]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.100057aa
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [0x10017d58]
add eax, 0x40
push eax
call fcn.1000277c
mov eax, dword [0x10017d58]
mov eax, dword [eax + 0x40]
push 0
push eax
call fcn.10004eeb
pop ecx
pop ecx
test eax, eax
je 0x10001f2d
mov eax, dword [0x10017d58]
push dword [eax + 0x40]
lea eax, [ebp - 0xeb4]
push str._ls_not_found.
push eax
call fcn.100010d0
add esp, 0xc
push 0x10013f08
lea eax, [ebp - 0xeb4]
jmp 0x10001a41
mov edi, dword [0x10017d58]
mov eax, dword [edi + 0x44]
cmp dword [eax - 0xc], 0
jne 0x10001f48
push str..dll
push str.dbghelp
jmp 0x10001f6d
push 0x10013650
push eax
call fcn.10004f91
pop ecx
pop ecx
test eax, eax
je 0x10001f63
sub eax, dword [edi + 0x44]
sar eax, 1
cmp eax, 0xffffffff
jne 0x10001fa0
mov eax, dword [0x10017d58]
mov eax, dword [eax + 0x44]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.100057aa
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [0x10017d58]
add eax, 0x44
push eax
call fcn.1000277c
mov edi, dword [0x10017d58]
mov eax, dword [edi + 0x44]
cmp dword [eax - 0xc], 0
jle 0x10001ff3
push 0x25
push eax
call fcn.10004f6a
pop ecx
pop ecx
test eax, eax
je 0x10001ff3
sub eax, dword [edi + 0x44]
sar eax, 1
cmp eax, 0xffffffff
je 0x10001ff3
mov eax, dword [0x10017d58]
mov eax, dword [eax + 0x44]
push esi
lea ecx, [ebp - 0x834]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x834]
push eax
mov eax, dword [0x10017d58]
add eax, 0x44
push eax
call fcn.1000277c
mov eax, dword [0x10017d58]
mov eax, dword [eax + 0x44]
xor edi, edi
push edi
push eax
call fcn.10004eeb
pop ecx
pop ecx
test eax, eax
je 0x10002036
mov eax, dword [0x10017d58]
push dword [eax + 0x44]
lea eax, [ebp - 0xed4]
push str._ls_not_found.
push eax
call fcn.100010d0
add esp, 0xc
push 0x10013f08
lea eax, [ebp - 0xed4]
jmp 0x10001a41
cmp dword [ebp + 0x10], edi
setne al
cmp byte [0x10017d7b], 0
mov byte [0x10017d41], al
jne 0x100020c1
test al, al
je 0x10002095
push str.verifier.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
setne al
mov byte [0x10017d40], al
test al, al
je 0x10002074
push 0x100015ca
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push fcn.10001597
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push edi
mov dword [0x10017d48], eax
call fcn.10001618
pop ecx
call fcn.10001809
call fcn.100017e1
push esi
lea eax, [ebp - 0x834]
push eax
push dword [0x10017d3c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100020ba
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x10017d7b], 1
mov eax, dword [ebp - 0xe54]
add eax, 0xfffffff0
call fcn.10003e1a
push 0x10017d5c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
jmp 0x10002163
lea eax, [ebp - 0xef4]
push str.Some_parameters_missing_in_ApplicationInfo.
push eax
call fcn.100010d0
pop ecx
pop ecx
push 0x10013f08
lea eax, [ebp - 0xef4]
jmp 0x10001a41
lea eax, [ebp - 0xec4]
push str.Wrong_ApplicationInfo_size.
push eax
call fcn.100010d0
pop ecx
pop ecx
push 0x10013f08
lea eax, [ebp - 0xec4]
jmp 0x10001a41
call fcn.1000f5d7
ret