Function at 0x1000e51d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0xa2c
mov eax, 0x10035693
call fcn.1001f7cd
mov ebx, edx
mov dword [ebp - 0x91c], ebx
mov dword [ebp - 0x928], ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x914], eax
test ecx, ecx
je 0x1000eb7b
test ebx, ebx
je 0x1000eb7b
test edi, edi
je 0x1000eb7b
test eax, eax
je 0x1000eb7b
xor esi, esi
xor edx, edx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov word [eax], dx
call fcn.1001585e
mov dword [ebx], eax
test eax, eax
jne 0x1000e58d
mov eax, 0x80041605
jmp 0x1000eb80
lea ecx, [ebp - 0x974]
mov ebx, esi
call fcn.100152f6
mov dword [ebp - 4], esi
cmp byte [ebp - 0x944], 0
je 0x1000e647
mov eax, dword [ebp - 0x974]
lea ecx, [ebp - 0x974]
push dword [ebp + 8]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x908], ebx
push dword [eax]
call fcn.100152f6
test al, al
jne 0x1000e5fd
lea eax, [ebp - 0x908]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x974]
push esi
push esi
push dword [ebp - 0x928]
call fcn.100152f6
test al, al
je 0x1000e66b
mov ebx, dword [ebp - 0x908]
push ecx
push dword [ebp - 0x914]
push edi
push ecx
lea ecx, [ebp - 0x974]
call fcn.100152f6
test al, al
je 0x1000e66b
cmp dword [ebp - 0x910], 2
jne 0x1000eb59
test ebx, ebx
je 0x1000eb59
mov ecx, dword [ebx]
call fcn.1001585e
mov ecx, dword [ebp - 0x91c]
mov dword [ecx], eax
test eax, eax
jne 0x1000eb59
mov ebx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x91c]
mov eax, dword [eax]
mov dword [ebp - 0x918], eax
test eax, eax
je 0x1000e737
mov eax, dword [eax + 4]
mov dword [ebp - 0x908], esi
jmp 0x1000e733
mov ebx, dword [ebp - 0x910]
cmp ebx, 4
jne 0x1000e67e
xor esi, esi
inc esi
jmp 0x1000eb59
cmp ebx, 2
je 0x1000e647
test ebx, ebx
je 0x1000e647
xor eax, eax
inc eax
mov dword [ebp - 0x908], eax
cmp ebx, 3
je 0x1000e69d
test ebx, ebx
jne 0x1000e968
mov eax, dword [ebp - 0x914]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0xa38]
call fcn.10007b32
push str.c2r32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0x980], eax
call fcn.10007bee
cmp dword [ebp - 0xa34], 0
je 0x1000e79f
call dword [ebp - 0xa34]
test eax, eax
je 0x1000e79f
mov byte [ebp - 4], 1
cmp dword [ebp - 0xa30], 0
jne 0x1000e792
mov eax, esi
jmp 0x1000e798
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 0x914]
mov ecx, eax
push edi
call fcn.100152f6
test eax, eax
jns 0x1000eb59
mov ecx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x918]
inc ecx
mov dword [ebp - 0x908], ecx
mov eax, dword [eax + ecx*4 + 4]
test eax, eax
jne 0x1000e702
lea eax, [ebp - 0x940]
xor edx, edx
push eax
push ecx
mov ecx, dword [ebp - 0x928]
call fcn.100152f6
test eax, eax
je 0x1000e687
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 0x914]
mov ecx, dword [ebp - 0x93c]
push edi
call fcn.100152f6
test eax, eax
js 0x1000e687
mov ecx, dword [ebp - 0x940]
call fcn.1001585e
mov ecx, dword [ebp - 0x91c]
mov dword [ecx], eax
test eax, eax
je 0x1000eb3e
jmp 0x1000eb59
call dword [ebp - 0xa30]
mov dword [edi], eax
jmp 0x1000eb50
push 0x64
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.10021114
mov eax, 0x1003e770
add esp, 0xc
mov dword [ebp - 0x904], eax
cmp dword [eax], 0
je 0x1000e7fd
push dword [eax]
push dword [ebp - 0x928]
call fcn.100152f6
pop ecx
test eax, eax
mov eax, dword [ebp - 0x904]
pop ecx
je 0x1000e7e4
add eax, 0x24
mov dword [ebp - 0x904], eax
jne 0x1000e7b9
jmp 0x1000e7fd
cmp dword [eax + 0x1c], 0
je 0x1000e7fd
push 0xffffffffffffffff
push dword [eax + 0x1c]
lea eax, [ebp - 0x78]
push 0x32
push eax
call fcn.100152f6
add esp, 0x10
cmp word [ebp - 0x78], 0
je 0x1000e965
push 0x10
pop eax
mov dword [ebp - 0x910], eax
push eax
push str.SoftwareMicrosoftOffice_i.0CommonInstallRootVirtual
lea eax, [ebp - 0x2e8]
push 0x104
push eax
call fcn.100152f6
add esp, 0x10
test eax, eax
je 0x1000e965
mov eax, esi
mov dword [ebp - 0x90c], esi
mov eax, dword [eax*4 + 0x1003d830]
lea ecx, [ebp - 0x920]
push ecx
or eax, 1
mov dword [ebp - 0x924], esi
push eax
push esi
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x920], esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x918], eax
test eax, eax
jne 0x1000e8ac
lea eax, [ebp - 0x92c]
mov dword [ebp - 0x92c], 0x64
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x924]
push eax
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x920]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x920], 0
je 0x1000e8c1
push dword [ebp - 0x920]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x918], 0
jne 0x1000e92f
cmp dword [ebp - 0x924], 1
je 0x1000e8dc
cmp dword [ebp - 0x924], 2
jne 0x1000e92f
cmp dword [ebp - 0x924], 2
jne 0x1000e92a
push 0x104
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000e92a
push 0xffffffffffffffff
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0xe0]
push 0x32
push eax
call fcn.100152f6
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
jmp 0x1000e931
xor ecx, ecx
inc ecx
jmp 0x1000e931
mov ecx, esi
test ecx, ecx
jne 0x1000e9dd
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp eax, 3
jb 0x1000e83b
mov eax, dword [ebp - 0x910]
dec eax
mov dword [ebp - 0x910], eax
cmp eax, 0xe
jae 0x1000e811
xor eax, eax
inc eax
cmp ebx, eax
je 0x1000e974
test ebx, ebx
jne 0x1000eb5f
mov eax, dword [ebp - 0x91c]
push 0x1003c550
push dword [ebp - 0x928]
mov eax, dword [eax]
mov ebx, dword [eax + 0x10]
call fcn.100152f6
neg eax
pop ecx
sbb eax, eax
inc eax
pop ecx
test ebx, ebx
je 0x1000eb38
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000e9ae
cmp ecx, 8
ja 0x1000eb38
test eax, eax
je 0x1000e9bf
test ecx, ecx
je 0x1000e9bf
cmp ecx, 8
jne 0x1000eb38
mov edx, edi
mov ecx, ebx
call fcn.100152f6
test eax, eax
je 0x1000eb38
xor eax, eax
cmp dword [edi], 8
sete al
jmp 0x1000eb3a
mov eax, dword [ebp - 0x904]
cmp dword [eax + 0x20], esi
je 0x1000eb19
push dword [ebp - 0x910]
lea eax, [ebp - 0x6f8]
push str.SoftwareMicrosoftOffice_i.0ClickToRunStoreApplications
push 0x104
push eax
call fcn.100152f6
add esp, 0x10
test eax, eax
je 0x1000eb19
mov eax, dword [ebp - 0x904]
mov ecx, dword [ebp - 0x90c]
mov dword [ebp - 0x90c], esi
mov dword [ebp - 0x904], esi
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx*4 + 0x1003d830]
mov dword [ebp - 0x934], eax
test eax, eax
je 0x1000eb19
lea eax, [ebp - 0x904]
or ecx, 1
push eax
push ecx
push esi
lea eax, [ebp - 0x6f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x918], eax
test eax, eax
jne 0x1000eaa2
lea eax, [ebp - 0x930]
mov dword [ebp - 0x930], 0x1048
push eax
push dword [ebp - 0x914]
lea eax, [ebp - 0x90c]
push eax
push esi
push dword [ebp - 0x934]
push dword [ebp - 0x904]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x904], 0
je 0x1000eab7
push dword [ebp - 0x904]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
cmp dword [ebp - 0x918], 0
jne 0x1000eb1c
cmp dword [ebp - 0x90c], eax
je 0x1000ead4
cmp dword [ebp - 0x90c], 2
jne 0x1000eb1c
cmp dword [ebp - 0x90c], 2
jne 0x1000eb1c
push 0x104
lea eax, [ebp - 0x900]
push eax
push dword [ebp - 0x914]
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000eb19
push 0xffffffffffffffff
lea eax, [ebp - 0x900]
push eax
push 0x824
push dword [ebp - 0x914]
call fcn.100152f6
add esp, 0x10
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x910]
mov dword [edi], ecx
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
cmp ecx, dword [ebp + 8]
jb 0x1000e968
jmp 0x1000eb59
mov eax, esi
test eax, eax
jne 0x1000eb45
mov esi, 0x80041605
jmp 0x1000eb59
cmp dword [edi], 8
je 0x1000eb59
mov dword [edi], 8
mov dword [edi + 0xc], esi
mov dword [edi + 8], esi
mov dword [edi + 4], esi
mov dword [ebp - 0x908], esi
cmp byte [ebp - 0x944], 0
je 0x1000eb73
lea ecx, [ebp - 0x974]
call fcn.100169b9
mov eax, dword [ebp - 0x908]
jmp 0x1000eb80
mov eax, 0x80070057
call fcn.1001f782
ret 0x10