Function at 0x719eb16b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x738
mov eax, dword [0x719f7264]
push esi
lea ecx, [ebp - 0x728]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x738]
push ecx
mov dword [ebp - 0x734], eax
add eax, 0x14
lea ecx, [ebp - 0x520]
push ecx
mov dword [ebp - 0x730], eax
push eax
mov eax, dword [0x719f7210]
mov esi, 0x105
mov dword [ebp - 0x738], esi
call dword [eax + 0x14]
cmp eax, 0xffffffff
jne 0x719eb1e8
cmp dword [ebp - 0x728], 8
je 0x719eb1de
cmp dword [ebp - 0x728], 0x2747
je 0x719eb1de
mov eax, 0xc0000001
jmp 0x719eb59a
mov eax, 0xc0000017
jmp 0x719eb59a
push ebx
push edi
push esi
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp._CKERNEL.DLL_ExpandEnvironmentStringsW]
push 0xc0
xor edi, edi
push edi
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x719eb223
mov eax, 0xc0000017
jmp 0x719eb598
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp._CKERNEL.DLL_LoadLibraryW]
cmp eax, edi
mov dword [ebx + 0x10], eax
je 0x719eb585
push 0x719d5830
push eax
call dword [sym.imp._CKERNEL.DLL_GetProcAddress]
cmp eax, edi
je 0x719eb57c
lea ecx, [ebx + 0x28]
push ecx
push 0x719f8600
push 0x719f7670
lea ecx, [ebp - 0x724]
push ecx
push 0x202
call eax
cmp eax, edi
mov dword [ebp - 0x728], eax
jne 0x719eb57c
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xa0]
push eax
push 0x10
push 0x719d57b8
mov esi, 0xc8000006
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb2b0
mov dword [ebx + 0xa0], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xa4]
push eax
push 0x10
push 0x719d57c8
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb2e2
mov dword [ebx + 0xa4], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xa8]
push eax
push 0x10
push 0x719d57d8
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb314
mov dword [ebx + 0xa8], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xac]
push eax
push 0x10
push 0x719d57e8
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb346
mov dword [ebx + 0xac], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xb0]
push eax
push 0x10
push 0x719d57f8
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb378
mov dword [ebx + 0xb0], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xb4]
push eax
push 0x10
push 0x719d5808
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb3aa
mov dword [ebx + 0xb4], edi
lea ecx, [ebp - 0x728]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x72c]
push ecx
push 4
lea eax, [ebx + 0xb8]
push eax
push 0x10
push 0x719d5818
push esi
push 0xffffffffffffffff
call dword [ebx + 0x68]
cmp eax, 0xffffffff
jne 0x719eb3dc
mov dword [ebx + 0xb8], edi
cmp dword [ebx + 0x28], edi
je 0x719eb568
cmp dword [ebx + 0x34], edi
je 0x719eb568
cmp dword [ebx + 0x3c], edi
je 0x719eb568
cmp dword [ebx + 0x40], edi
je 0x719eb568
cmp dword [ebx + 0x44], edi
je 0x719eb568
cmp dword [ebx + 0x48], edi
je 0x719eb568
cmp dword [ebx + 0x4c], edi
je 0x719eb568
cmp dword [ebx + 0x50], edi
je 0x719eb568
cmp dword [ebx + 0x54], edi
je 0x719eb568
cmp dword [ebx + 0x60], edi
je 0x719eb568
cmp dword [ebx + 0x68], edi
je 0x719eb568
cmp dword [ebx + 0x70], edi
je 0x719eb568
cmp dword [ebx + 0x74], edi
je 0x719eb568
cmp dword [ebx + 0x84], edi
je 0x719eb568
cmp dword [ebx + 0x90], edi
je 0x719eb568
cmp dword [ebx + 0x98], edi
je 0x719eb568
cmp dword [ebx + 0xa0], edi
je 0x719eb568
cmp dword [ebx + 0xa4], edi
je 0x719eb568
cmp dword [0x719f79a8], edi
je 0x719eb4c6
cmp dword [ebx + 0xb0], edi
je 0x719eb4c6
mov dword [0x719f79a8], 1
cmp dword [ebx + 0xa8], edi
je 0x719eb4b7
cmp dword [ebx + 0xac], edi
jne 0x719eb4cc
lea eax, [ebp - 0x730]
push eax
call dword [ebx + 0x3c]
jmp 0x719eb57c
mov dword [0x719f79a8], edi
mov eax, dword [ebp - 0x734]
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0x730]
mov dword [ebx + 0x14], eax
lea edi, [ebx + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebx + 0xc], 0
mov dword [ebx + 8], 1
cmp byte [0x719f8144], 0
jne 0x719eb53b
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [0x719f71d8]
call dword [sym.imp._CKERNEL.DLL_GetModuleFileNameA]
test eax, eax
je 0x719eb57a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp._CKERNEL.DLL_LoadLibraryA]
test eax, eax
je 0x719eb57a
push 0x719d96cf
call sub._Cntl.DLL_RtlRegisterSecureMemoryCacheCallback
test eax, eax
jl 0x719eb57a
mov byte [0x719f8144], 1
mov esi, 0x719f8560
push esi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov eax, dword [0x719f8654]
mov dword [ebx], 0x719f8650
mov dword [ebx + 4], eax
mov dword [eax], ebx
push esi
mov dword [0x719f8654], ebx
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
xor eax, eax
jmp 0x719eb598
mov eax, dword [ebx + 0x3c]
cmp eax, edi
je 0x719eb57c
lea ecx, [ebp - 0x730]
push ecx
call eax
jmp 0x719eb57c
xor edi, edi
push dword [ebx + 0x10]
call dword [sym.imp._CKERNEL.DLL_FreeLibrary]
push ebx
push edi
push dword [0x719f71dc]
call dword [sym.imp._Cntl.DLL_RtlFreeHeap]
mov eax, 0xc0000001
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.719c15f6
leave
ret 4