Function at 0x100026fd
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x40
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x1001306c], 8
jne 0x100022e0
test esi, esi
je 0x1000293a
cmp ebx, 0x12
ja case.0x100022d5.7
jmp dword [ebx*4 + 0x100151dc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0x10015082
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100022c8
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_ACCESS_TOKEN_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.unknown_attribute__lu_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call sym._lsa_QueryContextAttributesW_12
sub esp, 0xc
mov esi, eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_LIFESPAN_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_DCE_INFO_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_NAMES_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_STREAM_SIZES_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
lea eax, [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 5
call sym._lsa_QueryContextAttributesW_12
sub esp, 0xc
mov esi, eax
test eax, eax
jne 0x10002399
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x20
mov dword [ebp - 0x28], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x24], eax
call eax
mov edx, dword [ebp + 0x10]
sub esp, 0xc
mov dword [edx], eax
test eax, eax
je 0x10002981
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x20
mov dword [ebp - 0x28], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov dword [edx + 4], eax
je 0x10002957
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
sub esp, 0x20
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.secur32.dll_FreeContextBuffer
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call sym.secur32.dll_FreeContextBuffer
sub esp, 4
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_AUTHORITY_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_PASSWORD_EXPIRY_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_PACKAGE_INFO_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
lea eax, [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
call sym._lsa_QueryContextAttributesW_12
sub esp, 0xc
mov esi, eax
test eax, eax
jne 0x10002399
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28], ecx
mov dword [edx + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x24], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov ecx, dword [ebp - 0x28]
sub esp, 0x20
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x2c], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov edx, eax
sub esp, 0x20
mov dword [ebp - 0x28], eax
lea edi, [ebx + edx + 0x14]
mov dword [esp + 4], 0
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10002944
mov eax, dword [ecx]
mov dword [ebp - 0x2c], ecx
mov dword [edi], eax
movzx eax, word [ecx + 4]
mov word [edi + 4], ax
movzx eax, word [ecx + 6]
mov word [edi + 6], ax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
lea eax, [edi + 0x14]
mov dword [edi + 0xc], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ecx + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], 0
call eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
add ebx, dword [edi + 0xc]
sub esp, 0x20
mov dword [edi + 0x10], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ecx + 0x10]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], 0
call eax
mov eax, dword [ebp + 0x10]
sub esp, 0x20
mov dword [eax], edi
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.secur32.dll_FreeContextBuffer
sub esp, 4
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_NATIVE_NAMES_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090302
test byte [0x1001306c], 1
je 0x10002399
mov dword [esp + 0xc], str.SECPKG_ATTR_TARGET_INFORMATION_stub_n
mov dword [esp + 8], str.lsa_QueryContextAttributesA
mov dword [esp + 4], 0x1001306c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10002399
mov esi, 0x80090301
jmp 0x10002399
mov eax, dword [ebp + 0x10]
mov esi, 0x80090300
mov dword [eax], 0
jmp 0x100028b1
mov eax, dword [edx]
mov dword [esp + 4], 0
mov esi, 0x80090300
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
sub esp, 0xc
jmp 0x1000262b
mov esi, 0x80090300
jmp 0x1000262b