Function at 0x7cfab65d
Capabilities:
Get hostname
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2050
call fcn.7d041c90
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 0x10
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
cmp eax, esi
jl 0x7cfab983
lea eax, [ebp - 4]
push eax
call fcn.7cfaabfc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x7cfab6c1
lea eax, [ebp - 0x48]
push 1
push eax
lea eax, [ebp - 4]
push 0x7cf3a398
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.7cfab48d
test eax, eax
je 0x7cfab708
push 1
lea eax, [ebp - 4]
push dword [ebp - 0x18]
push 0x7cf3a384
push eax
call fcn.7cfaa6a4
push 1
lea eax, [ebp - 4]
push dword [ebp - 0x14]
push 0x7cf3a36c
push eax
call fcn.7cfaa6a4
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x14]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, 0x801
lea eax, [ebp - 0x104c]
push esi
mov ebx, 0x7cf3a350
push eax
push ebx
call edi
test eax, eax
je 0x7cfab73a
lea eax, [ebp - 0x104c]
push 1
push eax
lea eax, [ebp - 4]
push ebx
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0x104c]
push esi
mov ebx, 0x7cf3a33c
push eax
push ebx
call edi
test eax, eax
je 0x7cfab761
lea eax, [ebp - 0x104c]
push 1
push eax
lea eax, [ebp - 4]
push ebx
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0x104c]
push esi
mov ebx, 0x7cf3a328
push eax
push ebx
call edi
test eax, eax
je 0x7cfab788
lea eax, [ebp - 0x104c]
push 1
push eax
lea eax, [ebp - 4]
push ebx
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0x104c]
push esi
mov ebx, 0x7cf3a314
push eax
push ebx
call edi
test eax, eax
je 0x7cfab7af
lea eax, [ebp - 0x104c]
push 1
push eax
lea eax, [ebp - 4]
push ebx
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0x104c]
push esi
mov ebx, 0x7cf3a2fc
push eax
push ebx
call edi
test eax, eax
je 0x7cfab7d6
lea eax, [ebp - 0x104c]
push 1
push eax
lea eax, [ebp - 4]
push ebx
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x7cf37798
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfab8ac
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1002
push eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x7cf37874
push dword [ebp - 8]
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
jne 0x7cfab853
lea eax, [ebp - 0x2050]
push esi
push eax
lea eax, [ebp - 0x104c]
push eax
call ebx
lea eax, [ebp - 0x2050]
push 1
push eax
lea eax, [ebp - 4]
push 0x7cf37368
push eax
call fcn.7cfaa6a4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1002
push eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x7cf37854
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7cfab8a1
lea eax, [ebp - 0x2050]
push esi
push eax
lea eax, [ebp - 0x104c]
push eax
call ebx
lea eax, [ebp - 0x2050]
push 1
push eax
lea eax, [ebp - 4]
push 0x7cf37340
push eax
call fcn.7cfaa6a4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea eax, [ebp - 0x10]
push 0x7cf331dc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x7cf3a290
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cfab92c
lea eax, [ebp - 0xc]
mov esi, 0x7cf3a274
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
mov dword [ebp - 0xc], 4
push dword [ebp - 8]
call edi
test eax, eax
je 0x7cfab923
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 1]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x10], 0x31
mov esi, 0x7cf32208
jne 0x7cfab942
lea eax, [ebp - 4]
push esi
push eax
call fcn.7cfab272
lea eax, [ebp - 4]
push 0x7cf3a25c
push eax
call fcn.7cfaa950
lea eax, [ebp - 4]
push 0x7cf37c04
push eax
call fcn.7cfaa950
push 0x7cf3a154
lea eax, [ebp - 4]
push esi
push eax
call fcn.7cfab3e1
cmp dword [ebp + 0xc], ebx
je 0x7cfab990
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlSetCurrentEnvironment]
cmp eax, ebx
jge 0x7cfab987
xor eax, eax
jmp 0x7cfab9b5
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x1d4], ebx
je 0x7cfab9aa
lea eax, [ebp - 4]
push eax
call fcn.7cfab5cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 1
mov dword [eax], ecx
pop eax
pop edi
pop esi
pop ebx
leave
ret 8