Function at 0x1076c88
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x40
push 0x1026238
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x10098a4
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
je 0x10771de
mov edi, 0x10f6960
mov esi, 0x10f5820
mov dword [ebp - 0x24], ebx
mov byte [0x1106960], bl
push ebx
push 0xfffa
push 0x1106960
push 1
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x10771d4
push 0x1106960
push 0x100d20c
call sub.msvcrt.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1076de3
mov byte [0x10f6960], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1076dcc
mov byte [0x10f5820], bl
push ebx
push 0x1000
push esi
push 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
cmp eax, ebx
je 0x1076dcc
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], ebx
cmp eax, ebx
je 0x1076d87
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x1076d78
call eax
mov dword [ebp - 0x1c], eax
push eax
push esi
push 0x10261fc
jmp 0x1076d94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10261c0
jmp 0x1076d94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1026188
call fcn.01071ac0
add esp, 0xc
or dword [ebp - 4], 0xffffffff
jmp 0x1077117
push 0x1026138
call fcn.01071aad
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10771b0
push 0x1106960
push 0x1026124
call sub.msvcrt.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1076e66
mov byte [0x10f6960], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1076e5c
push 0x1000
push esi
push edi
call fcn.01072cf1
cmp eax, 0xffffffff
je 0x1076e51
push esi
call sub.msvcrt.dll__strdup
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1076e47
mov dword [ebp - 0x24], 1
push eax
push edi
push 0x10260e4
jmp 0x1077100
push 0x10260b4
jmp 0x10770c0
push edi
push 0x1026068
jmp 0x1077110
push 0x1026010
jmp 0x1076dd1
push 0x1106960
push 0x100d1b0
call sub.msvcrt.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1077053
mov byte [0x10f6960], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1077049
mov byte [0x10f5820], bl
push ebx
push 0x1000
push esi
push 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x1077049
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1077014
mov dword [ebp - 0x20], ebx
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1076eed
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x1076f23
cmp eax, 0xea
je 0x1076f23
push eax
push 0x1025fc8
jmp 0x1076f74
mov eax, dword [ebp - 0x28]
dec eax
je 0x1076fa7
sub eax, 3
je 0x1076f38
push dword [ebp - 0x28]
push 0x1025f68
jmp 0x1076f74
mov dword [ebp - 0x20], 4
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1076f44
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x1076f80
push eax
push 0x1025f30
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1077009
push 0x22
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1076e47
mov dword [ebp - 0x24], 1
push 0xa
push eax
push dword [ebp - 0x34]
call sub.msvcrt.dll__ultoa
jmp 0x1077006
push dword [ebp - 0x20]
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1076e47
mov dword [ebp - 0x24], 1
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1076fc7
sub eax, ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push ecx
push ebx
neg eax
sbb eax, eax
and eax, esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x1077009
push eax
push 0x1025ee8
call fcn.01071ac0
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
mov dword [ebp - 0x1c], ebx
add esp, 0xc
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1077021
push eax
push 0x1025eb0
call fcn.01071ac0
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x107703d
push dword [ebp - 0x1c]
push esi
push edi
push 0x1025e68
call fcn.01071ac0
add esp, 0x10
jmp 0x1077117
push esi
push edi
push 0x1025e28
jmp 0x1077100
push 0x1025dd0
jmp 0x1076dd1
push 0x1106960
push 0x100d144
call sub.msvcrt.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x10771be
mov byte [0x10f6960], bl
push ebx
push 0xfffa
push edi
push 2
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x10771b4
push edi
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0x107710a
push ebx
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x10770f1
push eax
call sub.msvcrt.dll_malloc
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x10770cc
push 0x1025d98
call fcn.01071aad
push 8
jmp 0x1076dd8
mov dword [ebp - 0x24], 1
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10770f1
push dword [ebp - 0x1c]
push edi
push 0x1025d58
jmp 0x1077100
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x30]
push 0x1025d10
call fcn.01071ac0
add esp, 0xc
jmp 0x1077117
push edi
push 0x1025cb8
call fcn.01071ac0
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x107715a
mov byte [0x10f6960], bl
push ebx
push 0xfffa
push edi
push ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x107719f
push dword [ebp - 0x1c]
push edi
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpSetDynamicStringA]
test eax, eax
je 0x1077185
push dword [ebp - 0x1c]
push edi
push 0x1025c7c
call fcn.01071ac0
add esp, 0xc
cmp dword [ebp - 0x24], ebx
je 0x1077170
cmp dword [ebp - 0x1c], ebx
je 0x1077170
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
pop ecx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x50]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
jne 0x1076cc4
jmp 0x10771e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x1c]
push edi
push 0x1025c30
call fcn.01071ac0
add esp, 0x10
jmp 0x10771b0
push 0x1106960
push 0x1025bf4
call fcn.01071ac0
pop ecx
pop ecx
xor esi, esi
jmp 0x10771eb
push 0x1025ba0
jmp 0x1076dd1
push 0x1106960
push 0x1025b64
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1076dd6
push 0x1025b30
jmp 0x1076dd1
push 0x1025b00
call fcn.01071aad
xor esi, esi
inc esi
cmp dword [ebp - 0x24], ebx
je 0x10771fe
cmp dword [ebp - 0x1c], ebx
je 0x10771fe
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
call fcn.0106bf9e
ret 4