Function at 0x10005cf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x944
mov eax, 0x100315bd
call fcn.10030db7
mov eax, edx
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x93c], ecx
mov ecx, dword [ebp + 0x10]
mov bl, byte [ebp + 8]
mov dword [ebp - 0x950], ecx
xor ecx, ecx
mov esi, ecx
mov byte [ebp - 0x919], cl
mov byte [ebp - 0x911], cl
mov dword [ebp - 0x918], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 0x910], ecx
or dword [ebp - 0x940], 0xffffffff
mov edi, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x938], edi
cmp bl, 1
jbe 0x10005d85
cmp bl, 2
je 0x10005d79
cmp bl, 3
jne 0x10005d72
mov dword [ebp - 0x928], str.shell_newcommand
jmp 0x10005d8f
xor eax, eax
jmp 0x1000667b
mov dword [ebp - 0x928], str.shellprintcommand
jmp 0x10005d8f
mov dword [ebp - 0x928], 0x10036a1c
mov ecx, eax
call fcn.100072e2
mov ecx, eax
mov dword [ebp - 0x94c], eax
call fcn.1000c36e
test eax, eax
mov ecx, str.SOFTWAREMicrosoftSharedHTML
mov edx, str.SOFTWAREMicrosoftSharedMHTML
cmove edx, ecx
lea ecx, [ebp - 0x700]
push 0x105
call fcn.10029dd9
push 0x105
mov edx, 0x10036a18
lea ecx, [ebp - 0x700]
call fcn.10029dd9
mov edx, dword [ebp - 0x93c]
lea ecx, [ebp - 0x700]
push 0x105
call fcn.10029dd9
mov eax, dword [ebp - 0x93c]
cmp word [eax], 0x4f
jne 0x10005e05
mov byte [ebp - 0x919], 1
jmp 0x10005f7a
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000001
call fcn.10029dd9
test eax, eax
jne 0x10005f7a
movzx eax, byte [ebp - 0x428]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
mov dword [ebp - 0x948], 0x20a
cmove eax, ecx
mov byte [ebp - 0x428], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push 0x10036a90
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005e85
cmp word [ebp - 0x428], di
jne 0x10006034
mov byte [ebp - 0x921], 0
jmp 0x10005f4a
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005f7a
cmp word [ebp - 0x21c], di
je 0x10005f7a
mov bh, 1
cmp byte [ebp - 0x921], al
jne 0x10006132
lea edx, [ebp - 0x930]
mov byte [ebp - 0x921], bh
lea ecx, [ebp - 0x21c]
call fcn.10029dd9
test eax, eax
jne 0x10006132
mov eax, dword [ebp - 0x930]
test eax, eax
je 0x10005f22
cmp eax, 4
jne 0x10006132
push eax
call fcn.10029dd9
test eax, eax
je 0x10006132
cmp dword [ebp - 0x910], edi
je 0x10005f44
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], edi
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
mov dword [ebp - 0x93c], 0x20a
call fcn.10029dd9
test eax, eax
je 0x10005e91
cmp dword [ebp - 0x918], edi
je 0x10005f8e
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x918], edi
cmp dword [ebp - 0x910], edi
je 0x10005fa8
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], edi
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000002
xor bh, bh
call fcn.10029dd9
test eax, eax
jne 0x10006112
movzx eax, byte [ebp - 0x428]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
mov dword [ebp - 0x930], 0x20a
cmove eax, ecx
mov byte [ebp - 0x428], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push 0x10036a90
push dword [ebp - 0x918]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006093
cmp word [ebp - 0x428], di
je 0x10006093
cmp byte [ebp - 0x919], al
jne 0x1000604b
push 0x105
lea edx, [ebp - 0x428]
mov ecx, 0x100618d8
call fcn.10029dd9
jmp 0x10006063
lea edx, [ebp - 0x428]
mov ecx, 0x100618d8
call fcn.1000d8bb
test eax, eax
jne 0x10006630
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.10029dd9
xor edx, edx
mov dword [ebp - 0x940], eax
lea ecx, [ebp - 0x428]
call fcn.1000da04
mov edi, eax
xor bh, bh
mov dword [ebp - 0x938], edi
jmp 0x100062e4
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
xor bh, bh
mov dword [ebp - 0x948], 0x20a
call fcn.10029dd9
test eax, eax
jne 0x10006112
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006112
cmp word [ebp - 0x21c], di
je 0x10006112
mov eax, edi
inc bh
mov cl, al
jmp 0x1000611e
mov eax, dword [ebp - 0x934]
mov cl, byte [ebp - 0x911]
test eax, eax
jne 0x10006411
test bh, bh
je 0x10006198
cmp byte [ebp - 0x919], al
jne 0x10006149
push 0x105
lea edx, [ebp - 0x21c]
mov ecx, 0x10061ae8
call fcn.10029dd9
jmp 0x10006161
lea edx, [ebp - 0x21c]
mov ecx, 0x10061ae8
call fcn.1000d8bb
test eax, eax
jne 0x10006609
lea edx, [ebp - 0x938]
lea ecx, [ebp - 0x21c]
call fcn.10029dd9
mov edi, dword [ebp - 0x938]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x934], eax
test eax, eax
jne 0x10006411
mov cl, byte [ebp - 0x911]
test cl, cl
jne 0x1000640a
cmp bl, 3
jne 0x1000640a
mov eax, dword [ebp - 0x918]
test eax, eax
je 0x100061ba
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x910], 0
je 0x100061d6
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000001
call fcn.10029dd9
test eax, eax
je 0x10006223
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x700]
mov ecx, 0x80000002
call fcn.10029dd9
test eax, eax
jne 0x1000640a
lea eax, [ebp - 0x910]
mov dword [ebp - 0x930], 0x20a
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x918]
mov edx, 0x10036a1c
call fcn.10029dd9
test eax, eax
jne 0x1000640a
movzx eax, byte [ebp - 0x21c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x21c], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000640a
cmp word [ebp - 0x21c], ax
je 0x1000640a
lea edx, [ebp - 0x938]
lea ecx, [ebp - 0x21c]
call fcn.10029dd9
mov edi, dword [ebp - 0x938]
mov dword [ebp - 0x940], eax
cmp eax, 9
je 0x1000640a
push 0x105
mov edx, edi
lea ecx, [ebp - 0x428]
call fcn.10029dd9
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x92c]
mov byte [ebp - 0x911], 1
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x428]
mov ecx, 0x80000000
call fcn.10029dd9
test eax, eax
jne 0x10006112
and dword [ebp - 0x928], eax
mov edx, str.CurVer
lea eax, [ebp - 0x928]
mov dword [ebp - 0x948], 0xca
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
call fcn.10029dd9
test eax, eax
jne 0x100063cf
movzx eax, byte [ebp - 0x4f4]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x4f4], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x928]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100063cf
cmp word [ebp - 0x4f4], ax
je 0x100063cf
lea eax, [ebp - 0x93c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x4f4]
mov ecx, 0x80000000
call fcn.10029dd9
test eax, eax
jne 0x100063cf
cmp dword [ebp - 0x92c], eax
je 0x100063c3
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x934], eax
je 0x100063f6
push dword [ebp - 0x928]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x934]
and dword [ebp - 0x928], 0
mov cl, 1
mov byte [ebp - 0x911], cl
jmp 0x1000611e
xor esi, esi
jmp 0x10006609
cmp dword [ebp + 0xc], 0
je 0x10006430
test bh, bh
jne 0x10006428
mov dl, bl
mov ecx, eax
call fcn.10029dd9
test eax, eax
je 0x1000640a
xor esi, esi
inc esi
jmp 0x10006609
test edi, edi
je 0x1000645e
mov eax, dword [ebp - 0x944]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000644c
call fcn.100033fc
mov eax, dword [ebp - 0x944]
mov dword [eax + 0xc], edi
mov ecx, eax
xor edi, edi
call fcn.100072e2
mov dword [ebp - 0x94c], eax
mov ecx, dword [ebp - 0x940]
cmp ecx, 9
je 0x100064d9
cmp bl, 2
je 0x100064d9
cmp bl, 1
jne 0x1000647b
mov esi, dword [0x100373f0]
jmp 0x10006485
movzx eax, bl
mov esi, dword [eax*4 + 0x100373f0]
mov ebx, dword [ebp - 0x934]
mov edx, esi
push 0
push dword [ebp - 0x944]
push ecx
mov ecx, ebx
call fcn.100048c5
mov dword [ebp - 0x930], eax
test eax, eax
jne 0x100064ce
cmp esi, dword [0x100373f0]
jne 0x100064ce
mov edx, dword [0x100373f4]
mov ecx, ebx
push eax
push dword [ebp - 0x944]
push dword [ebp - 0x940]
call fcn.100048c5
jmp 0x10006607
mov esi, dword [ebp - 0x930]
jmp 0x10006609
push 0x104
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x100065d5
cmp bl, 3
jne 0x100065a9
cmp word [ebp - 0x90c], 0
jne 0x100065a9
cmp dword [ebp - 0x910], 0
je 0x1000652a
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
lea eax, [ebp - 0x910]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x934]
mov edx, str.shell_newcommand
mov dword [ebp - 0x930], 0x20a
call fcn.10029dd9
test eax, eax
jne 0x10006609
movzx eax, byte [ebp - 0x90c]
xor ecx, ecx
cmp dword [ebp - 0x920], 1
cmove eax, ecx
mov byte [ebp - 0x90c], al
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x920]
push eax
push ecx
push ecx
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006609
cmp word [ebp - 0x90c], ax
je 0x10006609
mov ecx, dword [ebp - 0x94c]
call fcn.1000d787
mov edx, dword [ebp - 0x94c]
push ecx
mov ecx, dword [ebp - 0x944]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x90c]
push eax
call fcn.10005673
jmp 0x10006607
test bl, bl
jne 0x100065e1
mov edx, dword [0x100373f4]
jmp 0x100065eb
movzx eax, bl
mov edx, dword [eax*4 + 0x100373f0]
mov esi, dword [ebp - 0x94c]
xor eax, eax
cmp bl, 2
push ecx
mov ecx, dword [ebp - 0x934]
sete al
push eax
push esi
call fcn.10029dd9
mov esi, eax
test edi, edi
je 0x10006630
mov eax, dword [ebp - 0x950]
test eax, eax
je 0x10006629
cmp dword [ebp + 0x14], 0
je 0x10006629
push dword [ebp + 0x14]
mov edx, edi
mov ecx, eax
call fcn.10029dd9
mov ecx, edi
call fcn.100033fc
cmp dword [ebp - 0x910], 0
je 0x10006645
push dword [ebp - 0x910]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x92c], 0
je 0x10006661
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x918]
test eax, eax
je 0x10006679
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.10030d76
ret 0x10