Function at 0x684da780
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x184]
push ebx
mov ebx, edx
sub esp, 0x1cc
mov dword [edx], 0
mov dword [ebp - 0x184], 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_FindActCtxSectionStringW]
sub esp, 0x14
test eax, eax
jne 0x684da900
lea eax, [ebp - 0x190]
mov dword [esp + 0xc], 0x20019
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsRuntimeActivatableClassId
mov dword [esp], 0x80000002
call edi
sub esp, 0x14
test eax, eax
jne 0x684daa70
lea eax, [ebp - 0x18c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x190]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
jne 0x684daa80
mov eax, dword [ebp - 0x190]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call edi
lea eax, [ebp - 0x144]
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 4
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x188]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DllPath
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x19c], eax
jne 0x684da8f0
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov edx, 0x80040150
sub eax, 1
cmp eax, 1
jbe 0x684da930
mov dword [ebp - 0x1a0], edx
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x19c]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1a0]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
mov edx, 0x80040150
jmp 0x684da8bf
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x16c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
xor edx, edx
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x1a4], eax
call eax
mov ecx, eax
test eax, eax
je 0x684daca2
lea eax, [ebp - 0x144]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DllPath
mov dword [esp], eax
call esi
mov ecx, dword [ebp - 0x1a0]
sub esp, 0x18
test eax, eax
mov edx, eax
jne 0x684da9b0
cmp dword [ebp - 0x188], 2
je 0x684da9d0
mov dword [ebx], ecx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x18c]
mov edx, 0x80040150
mov dword [ebp - 0x19c], eax
jmp 0x684da8bf
mov dword [ebp - 0x1ac], eax
mov eax, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp], ecx
mov dword [ebp - 0x1a8], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0x1a0], eax
call eax
sub esp, 0xc
mov dword [ebp - 0x19c], eax
add eax, eax
mov dword [esp], eax
mov eax, dword [ebp - 0x1a4]
call eax
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1ac]
test eax, eax
mov esi, eax
je 0x684dacac
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], edx
mov dword [esp], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x19c], ecx
mov dword [esp + 4], esi
call eax
mov ecx, dword [ebp - 0x19c]
sub esp, 0xc
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
mov ecx, esi
mov edx, dword [ebp - 0x1a4]
mov dword [ebx], ecx
jmp 0x684da9a1
mov edx, 0x80040150
jmp 0x684da8e2
test byte [0x684eb210], 4
jne 0x684daaa5
mov eax, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, 0x80040154
sub esp, 4
jmp 0x684da8e2
test esi, esi
je 0x684dac7a
mov eax, esi
shr eax, 0x10
je 0x684dac58
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, 0x684f1da0
test ecx, ecx
jne 0x684dab9e
movzx eax, word [esi]
test ax, ax
je 0x684dac84
lea esi, [esi]
nop
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x684daaf0
mov ecx, 0x224c
lea ebx, [ebp - 0x142]
lea edi, [ebp - 0x22]
mov word [ebp - 0x144], cx
jmp 0x684dab48
cmp ax, 9
je 0x684dabdc
cmp ax, 0xa
jne 0x684dabf6
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
lea esi, [esi]
lea ecx, [edx - 1]
cmp ebx, edi
ja 0x684dab75
test edx, edx
jle 0x684dab75
movzx eax, word [esi]
mov edx, ecx
add esi, 2
cmp ax, 0xd
je 0x684dabcb
jbe 0x684dab14
cmp ax, 0x22
je 0x684dac47
cmp ax, 0x5c
jne 0x684dabed
mov eax, 0x5c5c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x684dab38
mov byte [ebx], 0x22
test ecx, ecx
jle 0x684dac9a
mov word [ebx + 1], 0x2e2e
lea eax, [ebx + 4]
mov byte [ebx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.684e9c40
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Class__s_not_found_in_registry_n
mov dword [esp + 8], 0x684f2194
mov dword [esp + 4], 0x684eb210
mov dword [esp], 2
call fcn.684da680
jmp 0x684daa89
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x684dab38
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x684dab38
lea ecx, [eax - 0x20]
cmp cx, 0x5e
jbe 0x684dac70
mov ecx, eax
mov byte [ebx], 0x5c
add ebx, 5
shr cx, 0xc
movzx ecx, cx
movzx ecx, byte [ecx + str.0123456789abcdefget_library_for_classid]
mov byte [ebx - 4], cl
mov ecx, eax
shr cx, 8
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefget_library_for_classid]
mov byte [ebx - 3], cl
mov ecx, eax
and eax, 0xf
shr cx, 4
movzx eax, byte [eax + str.0123456789abcdefget_library_for_classid]
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefget_library_for_classid]
mov byte [ebx - 1], al
mov byte [ebx - 2], cl
jmp 0x684dab38
mov eax, 0x225c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x684dab38
movzx esi, si
mov dword [esp], 0x684f1db1
mov dword [esp + 4], esi
call fcn.684da3a0
jmp 0x684dab9e
mov byte [ebx], al
add ebx, 1
jmp 0x684dab38
mov eax, 0x684f1daa
jmp 0x684dab9e
mov word [ebp - 0x144], 0x224c
lea ebx, [ebp - 0x142]
mov byte [ebp - 0x142], 0x22
lea eax, [ebx + 1]
jmp 0x684dab8d
mov edx, 0x8007000e
jmp 0x684da8bf
mov eax, dword [ebp - 0x18c]
mov edx, 0x8007000e
mov dword [ebp - 0x19c], eax
jmp 0x684da8bf