Function at 0x571198
Capabilities:
Query environment variable

Disassembly:
push 0x124
mov eax, 0x63d5e4
call fcn.005de4ce
mov dword [ebp - 0x130], ecx
mov esi, 0x69227b
xor ebx, ebx
push esi
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x119], bl
call fcn.0057114d
push esi
lea ecx, [ebp - 0x124]
mov dword [ebp - 4], ebx
call fcn.0057114d
push esi
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.0057114d
mov byte [ebp - 4], 2
call fcn.00570a36
test eax, eax
jne 0x57122f
push str.Legacy_machine_found__n
call fcn.005dcd3f
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, 1
call fcn.005de52a
ret
push 0x64
push 1
call fcn.005dccff
pop ecx
pop ecx
mov edi, eax
push 0x64
push edi
push str.WINDIR
mov dword [ebp - 0x12c], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp edi, ebx
je 0x571262
push 0x64
push edi
call fcn.005dc877
pop ecx
pop ecx
cmp eax, ebx
ja 0x57126c
mov esi, str.c:windows
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push str._s_system32_regsvr32.exe
push eax
call fcn.005710d4
push dword [ebp - 0x12c]
lea eax, [ebp - 0x124]
push str._s_syswow64_regsvr32.exe
push eax
call fcn.005710d4
add esp, 0x18
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
push str.checkForSign_:_File_Path_:__s_n
call fcn.005dcd3f
pop ecx
lea eax, [ebp - 0x118]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5712d0
sub eax, edx
push eax
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x120]
call fcn.00570f9e
lea ecx, [ebp - 0x120]
call fcn.00571067
mov ecx, eax
call fcn.00570eec
push eax
push str.checkForSign_:_GetModuleFileNameA_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00571067
mov ecx, eax
call fcn.00570eec
push eax
push str.checkForSign_:_regsvr32Path_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x124]
call fcn.00571067
mov ecx, eax
call fcn.00570eec
push eax
push str.checkForSign_:_regsvr32PathAlt_:__s_n
call fcn.005dcd3f
pop ecx
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00571067
mov ecx, eax
call fcn.00570eec
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00571067
mov ecx, eax
call fcn.00570eec
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x571391
cmp dl, bl
je 0x57138d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x571391
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x571371
xor eax, eax
jmp 0x571396
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x57144e
lea ecx, [ebp - 0x124]
call fcn.00571067
mov ecx, eax
call fcn.00570eec
lea ecx, [ebp - 0x120]
mov esi, eax
call fcn.00571067
mov ecx, eax
call fcn.00570eec
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5713e6
cmp dl, bl
je 0x5713e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5713e6
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x5713c6
xor eax, eax
jmp 0x5713eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x57144e
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x118]
push eax
call fcn.005706a4
test eax, eax
setne byte [ebp - 0x119]
movzx eax, byte [ebp - 0x119]
push eax
push str.checkForSign_:_isSignatureMatches_:__d_n
call fcn.005dcd3f
pop ecx
pop ecx
push dword [ebp - 0x12c]
call fcn.005dcea1
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, byte [ebp - 0x119]
jmp 0x571483
push str.checkForSign_:_skipped_signature_check_for_regsvr32.exe__n
call fcn.005dcd3f
push dword [ebp - 0x12c]
call fcn.005dcea1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0056fef9
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0056fef9
mov bl, 1
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0056fef9
mov al, bl
jmp 0x571229