Function at 0x1024d0a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x440
mov eax, 0x1031c51
call fcn.01026060
mov ebx, dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 0x30]
lea ecx, [ebp - 0x43c]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
and dword [ebp - 4], 0
and dword [ebp - 0x438], 0
mov byte [ebp - 4], 1
test esi, esi
je 0x1024d5c
push ebx
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_1476]
test eax, eax
je 0x1024d54
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x1024d40
test esi, esi
jne 0x1024e2a
push 0x24
call sub.MFC80U.DLL_Ordinal_762
pop ecx
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 2
xor esi, esi
cmp eax, esi
je 0x1024d83
push dword [edi + 0x30]
mov ecx, eax
push ebx
call fcn.01024b9d
mov ebx, eax
jmp 0x1024d85
xor ebx, ebx
mov byte [ebp - 4], 1
cmp ebx, esi
jne 0x1024e53
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov byte [ebp - 4], 3
mov ebx, 0xc000c43f
lea eax, [ebp - 0x430]
push ebx
push eax
call fcn.0100ba1d
pop ecx
pop ecx
mov byte [ebp - 4], 4
push 0x24
mov ecx, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_870]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_2311]
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
mov esi, dword [ecx + eax + 4]
push 1
push 1
push 2
push 0
lea ecx, [ebp - 0x42c]
add esi, 4
mov edi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_870]
push eax
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
push ebx
lea ecx, [eax + edi + 4]
call dword [esi]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
xor esi, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.010106e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
call fcn.010260f2
ret 4
mov dword [edi + 0x30], ebx
push dword [ebx]
lea eax, [ebp - 0x43c]
push dword [edi + 0x18]
push 0x1005d60
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_2311]
add esp, 0x10
lea eax, [ebp - 0x438]
push eax
push 0x20019
push esi
lea ecx, [ebp - 0x43c]
call dword [sym.imp.MFC80U.DLL_Ordinal_870]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024fec
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x44c]
push eax
push esi
push 0x1001ec0
push dword [ebp - 0x438]
mov dword [ebp - 0x444], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024fec
cmp word [ebp - 0x21c], si
je 0x1024fec
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x430], esi
mov esi, 0x1005d5c
push esi
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x434]
call dword [sym.imp.MFC80U.DLL_Ordinal_6133]
mov byte [ebp - 4], 6
mov edi, 0x10016d0
jmp 0x1024fb7
push 0x105
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_870]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1024f7b
push 3
push 0
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x448], eax
je 0x1024f7b
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebx + 4]
call fcn.01010b57
lea eax, [ebp - 0x430]
push eax
push esi
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x434]
call dword [sym.imp.MFC80U.DLL_Ordinal_6133]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x440]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
push edi
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_1472]
test eax, eax
jne 0x1024f2e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x42c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x434]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov esi, ebx
jmp 0x1024e2a