Function at 0x10005cf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x944
mov eax, 0x100315bd
call fcn.10030db7
mov eax, edx
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x93c], ecx
mov ecx, dword [ebp + 0x10]
mov bl, byte [ebp + 8]
mov dword [ebp - 0x950], ecx
xor ecx, ecx
mov esi, ecx
mov byte [ebp - 0x919], cl
mov byte [ebp - 0x911], cl
mov dword [ebp - 0x918], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 0x910], ecx
or dword [ebp - 0x940], 0xffffffff
mov edi, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x938], edi
cmp bl, 1
jbe 0x10005d85
cmp bl, 2
je 0x10005d79
cmp bl, 3
jne 0x10005d72
mov dword [ebp - 0x928], str.shell_newcommand
jmp 0x10005d8f
xor eax, eax
jmp 0x1000667b
mov dword [ebp - 0x928], str.shellprintcommand
jmp 0x10005d8f
mov dword [ebp - 0x928], 0x10036a1c
mov ecx, eax
call fcn.100072e2
mov ecx, eax
mov dword [ebp - 0x94c], eax
call fcn.1000c36e
test eax, eax
mov ecx, str.SOFTWAREMicrosoftSharedHTML
mov edx, str.SOFTWAREMicrosoftSharedMHTML
cmove edx, ecx
lea ecx, [ebp - 0x700]
push 0x105
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
push 0x105
mov edx, 0x10036a18
lea ecx, [ebp - 0x700]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov edx, dword [ebp - 0x93c]
lea ecx, [ebp - 0x700]
push 0x105
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov eax, dword [ebp - 0x93c]
cmp word [eax], 0x4f
jne 0x10005e05
mov byte [ebp - 0x919], 1
jmp 0x10005f7a
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000001
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10005f7a
movzx eax, byte [ebp - 0x428]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
mov dword [ebp - 0x948], 0x20a
cmove eax, ecx
mov byte [ebp - 0x428], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push 0x10036a90
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005e85
cmp word [ebp - 0x428], di
jne 0x10006034
mov byte [ebp - 0x921], 0
jmp 0x10005f4a
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005f7a
cmp word [ebp - 0x21c], di
je 0x10005f7a
mov bh, 1
cmp byte [ebp - 0x921], al
jne 0x10006132
lea edx, [ebp - 0x930]
mov byte [ebp - 0x921], bh
lea ecx, [ebp - 0x21c]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10006132
mov eax, dword [ebp - 0x930]
test eax, eax
je 0x10005f22
cmp eax, 4
jne 0x10006132
push eax
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x10006132
cmp dword [ebp - 0x910], edi
je 0x10005f44
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], edi
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
mov dword [ebp - 0x93c], 0x20a
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x10005e91
cmp dword [ebp - 0x918], edi
je 0x10005f8e
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x918], edi
cmp dword [ebp - 0x910], edi
je 0x10005fa8
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], edi
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000002
xor bh, bh
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10006112
movzx eax, byte [ebp - 0x428]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
mov dword [ebp - 0x930], 0x20a
cmove eax, ecx
mov byte [ebp - 0x428], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push 0x10036a90
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006093
cmp word [ebp - 0x428], di
je 0x10006093
cmp byte [ebp - 0x919], al
jne 0x1000604b
push 0x105
lea edx, [ebp - 0x428]
mov ecx, 0x100618d8
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
jmp 0x10006063
lea edx, [ebp - 0x428]
mov ecx, 0x100618d8
call fcn.1000d8bb
test eax, eax
jne 0x10006630
push 0
lea eax, [ebp - 0x428]
push eax
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
xor edx, edx
mov dword [ebp - 0x940], eax
lea ecx, [ebp - 0x428]
call fcn.1000da04
mov edi, eax
xor bh, bh
mov dword [ebp - 0x938], edi
jmp 0x100062e4
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
xor bh, bh
mov dword [ebp - 0x948], 0x20a
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10006112
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006112
cmp word [ebp - 0x21c], di
je 0x10006112
mov eax, edi
inc bh
mov cl, al
jmp 0x1000611e
mov eax, dword [ebp - 0x934]
mov cl, byte [ebp - 0x911]
test eax, eax
jne 0x10006411
test bh, bh
je 0x10006198
cmp byte [ebp - 0x919], al
jne 0x10006149
push 0x105
lea edx, [ebp - 0x21c]
mov ecx, 0x10061ae8
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
jmp 0x10006161
lea edx, [ebp - 0x21c]
mov ecx, 0x10061ae8
call fcn.1000d8bb
test eax, eax
jne 0x10006609
lea edx, [ebp - 0x938]
lea ecx, [ebp - 0x21c]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov edi, dword [ebp - 0x938]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x934], eax
test eax, eax
jne 0x10006411
mov cl, byte [ebp - 0x911]
test cl, cl
jne 0x1000640a
cmp bl, 3
jne 0x1000640a
mov eax, dword [ebp - 0x918]
test eax, eax
je 0x100061ba
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x910], 0
je 0x100061d6
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000001
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x10006223
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000002
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x1000640a
lea eax, [ebp - 0x910]
mov dword [ebp - 0x930], 0x20a
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
mov edx, 0x10036a1c
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x1000640a
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000640a
cmp word [ebp - 0x21c], ax
je 0x1000640a
lea edx, [ebp - 0x938]
lea ecx, [ebp - 0x21c]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov edi, dword [ebp - 0x938]
mov dword [ebp - 0x940], eax
cmp eax, 9
je 0x1000640a
push 0x105
mov edx, edi
lea ecx, [ebp - 0x428]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x92c]
mov byte [ebp - 0x911], 1
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x428]
mov ecx, 0x80000000
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10006112
and dword [ebp - 0x928], eax
mov edx, str.CurVer
lea eax, [ebp - 0x928]
mov dword [ebp - 0x948], 0xca
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x100063cf
movzx eax, byte [ebp - 0x4f4]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x4f4], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x928]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100063cf
cmp word [ebp - 0x4f4], ax
je 0x100063cf
lea eax, [ebp - 0x93c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x4f4]
mov ecx, 0x80000000
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x100063cf
cmp dword [ebp - 0x92c], eax
je 0x100063c3
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x934], eax
je 0x100063f6
push dword [ebp - 0x928]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x934]
and dword [ebp - 0x928], 0
mov cl, 1
mov byte [ebp - 0x911], cl
jmp 0x1000611e
xor esi, esi
jmp 0x10006609
cmp dword [ebp + 0xc], 0
je 0x10006430
test bh, bh
jne 0x10006428
mov dl, bl
mov ecx, eax
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
je 0x1000640a
xor esi, esi
inc esi
jmp 0x10006609
test edi, edi
je 0x1000645e
mov eax, dword [ebp - 0x944]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000644c
call fcn.100033fc
mov eax, dword [ebp - 0x944]
mov dword [eax + 0xc], edi
mov ecx, eax
xor edi, edi
call fcn.100072e2
mov dword [ebp - 0x94c], eax
mov ecx, dword [ebp - 0x940]
cmp ecx, 9
je 0x100064d9
cmp bl, 2
je 0x100064d9
cmp bl, 1
jne 0x1000647b
mov esi, dword [0x100373f0]
jmp 0x10006485
movzx eax, bl
mov esi, dword [eax*4 + 0x100373f0]
mov ebx, dword [ebp - 0x934]
mov edx, esi
push 0
push dword [ebp - 0x944]
push ecx
mov ecx, ebx
call fcn.100048c5
mov dword [ebp - 0x930], eax
test eax, eax
jne 0x100064ce
cmp esi, dword [0x100373f0]
jne 0x100064ce
mov edx, dword [0x100373f4]
mov ecx, ebx
push eax
push dword [ebp - 0x944]
push dword [ebp - 0x940]
call fcn.100048c5
jmp 0x10006607
mov esi, dword [ebp - 0x930]
jmp 0x10006609
push 0x104
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x100065d5
cmp bl, 3
jne 0x100065a9
cmp word [ebp - 0x90c], 0
jne 0x100065a9
cmp dword [ebp - 0x910], 0
je 0x1000652a
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x934]
mov edx, str.shell_newcommand
mov dword [ebp - 0x930], 0x20a
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10006609
movzx eax, byte [ebp - 0x90c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x90c], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006609
cmp word [ebp - 0x90c], ax
je 0x10006609
mov ecx, dword [ebp - 0x94c]
call fcn.1000d787
mov edx, dword [ebp - 0x94c]
push ecx
mov ecx, dword [ebp - 0x944]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x90c]
push eax
call fcn.10005673
jmp 0x10006607
test bl, bl
jne 0x100065e1
mov edx, dword [0x100373f4]
jmp 0x100065eb
movzx eax, bl
mov edx, dword [eax*4 + 0x100373f0]
mov esi, dword [ebp - 0x94c]
xor eax, eax
cmp bl, 2
push ecx
mov ecx, dword [ebp - 0x934]
sete al
push eax
push esi
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov esi, eax
test edi, edi
je 0x10006630
mov eax, dword [ebp - 0x950]
test eax, eax
je 0x10006629
cmp dword [ebp + 0x14], 0
je 0x10006629
push dword [ebp + 0x14]
mov edx, edi
mov ecx, eax
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov ecx, edi
call fcn.100033fc
cmp dword [ebp - 0x910], 0
je 0x10006645
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x92c], 0
je 0x10006661
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x918]
test eax, eax
je 0x10006679
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.10030d76
ret 0x10