Function at 0x100190f9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1a34
call fcn.1002fb29
mov eax, dword [0x100400b0]
xor eax, esp
mov dword [esp + 0x1a30], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x24], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
jne 0x10019132
mov eax, 0x80070057
jmp 0x100194be
xor esi, esi
mov dword [ebx], esi
test edi, edi
jne 0x10019142
or dword [ebx], 0xffffffff
jmp 0x100194bc
push 0x10038864
push edi
mov dword [esp + 0xf8], esi
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], esi
mov dword [esp + 0x104], esi
call fcn.10013969
pop ecx
pop ecx
test eax, eax
je 0x100191db
push 0x100388f8
push edi
call fcn.10013969
pop ecx
pop ecx
test eax, eax
je 0x100191db
push edi
push dword [esi*8 + 0x1003a1e0]
call fcn.10013969
pop ecx
pop ecx
test eax, eax
je 0x1001919e
inc esi
cmp esi, 0xf
jb 0x10019180
jmp 0x100194bc
mov ecx, dword [esi*8 + 0x1003a1e4]
test ecx, ecx
je 0x100194bc
push ecx
lea eax, [esp + 0x9f4]
xor edx, edx
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.10013969
test eax, eax
js 0x100194bc
mov eax, dword [esp + 0xf0]
mov dword [ebx], eax
jmp 0x100194bc
xor eax, eax
lea ecx, [esp + 0x30]
mov word [esp + 0x9f0], ax
call fcn.10007912
push str.c2r32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
lea ecx, [esp + 0x30]
mov dword [esp + 0xe8], eax
call fcn.100079ce
cmp dword [esp + 0x34], esi
je 0x1001922c
call dword [esp + 0x34]
test eax, eax
je 0x1001922c
cmp dword [esp + 0x38], esi
je 0x100194ba
call dword [esp + 0x38]
mov esi, eax
jmp 0x100194ba
push 0x64
lea eax, [esp + 0x104]
push esi
push eax
call fcn.1001e894
add esp, 0xc
mov ebx, 0x1003abd0
cmp dword [ebx], esi
je 0x10019279
push dword [ebx]
push edi
call fcn.10013969
pop ecx
pop ecx
test eax, eax
je 0x1001925d
add ebx, 0x24
jne 0x10019244
jmp 0x10019279
cmp dword [ebx + 0x1c], esi
je 0x10019279
push 0xffffffffffffffff
push dword [ebx + 0x1c]
lea eax, [esp + 0x108]
push 0x32
push eax
call fcn.10013969
add esp, 0x10
cmp word [esp + 0x100], si
je 0x100194bc
push 0x10
pop eax
mov dword [esp + 0x20], eax
push eax
push str.SoftwareMicrosoftOffice_i.0CommonInstallRootVirtual
lea eax, [esp + 0x1d8]
push 0x104
push eax
call fcn.10013969
add esp, 0x10
test eax, eax
je 0x100194bc
mov edi, esi
mov eax, dword [edi*4 + 0x10039c94]
lea ecx, [esp + 0x14]
push ecx
or eax, 1
mov dword [esp + 0x1c], esi
push eax
push esi
lea eax, [esp + 0x1dc]
mov dword [esp + 0x20], esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10019318
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x64
push eax
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x110]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x14], esi
je 0x10019328
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
jne 0x1001938c
cmp dword [esp + 0x18], 1
je 0x1001933c
cmp dword [esp + 0x18], 2
jne 0x1001938c
cmp dword [esp + 0x18], 2
jne 0x100193b3
push 0x104
lea eax, [esp + 0x3dc]
push eax
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100193b3
push 0xffffffffffffffff
lea eax, [esp + 0x3dc]
push eax
lea eax, [esp + 0x170]
push 0x32
push eax
call fcn.10013969
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
jmp 0x1001938e
mov ecx, esi
test ecx, ecx
jne 0x100193b3
inc edi
cmp edi, 3
jb 0x100192b3
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
cmp eax, 0xe
jae 0x1001928e
jmp 0x100194bc
cmp dword [ebx + 0x20], esi
je 0x100194b2
push dword [esp + 0x20]
lea eax, [esp + 0x5e4]
push str.SoftwareMicrosoftOffice_i.0ClickToRunStoreApplications
push 0x104
push eax
call fcn.10013969
add esp, 0x10
test eax, eax
je 0x100194b2
mov ebx, dword [ebx + 0x20]
mov eax, dword [edi*4 + 0x10039c94]
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], esi
test ebx, ebx
je 0x100194b2
lea ecx, [esp + 0x1c]
or eax, 1
push ecx
push eax
push esi
lea eax, [esp + 0x5ec]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019447
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x1048
push eax
lea eax, [esp + 0x9f4]
push eax
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [esp + 0x1c], esi
je 0x10019457
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100194b2
cmp dword [esp + 0x10], 1
je 0x10019469
cmp dword [esp + 0x10], 2
jne 0x100194b2
cmp dword [esp + 0x10], 2
jne 0x100194b2
push 0x104
lea eax, [esp + 0x7ec]
push eax
lea eax, [esp + 0x9f8]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100194b2
push 0xffffffffffffffff
lea eax, [esp + 0x7ec]
push eax
lea eax, [esp + 0x9f8]
push 0x824
push eax
call fcn.10013969
add esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov dword [ebx], esi
xor eax, eax
mov ecx, dword [esp + 0x1a3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c65c
mov esp, ebp
pop ebp
ret 0xc