Function at 0x402920
Capabilities:
Accept command line arguments
Create thread
Query environment variable
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x60c], 0
mov dword [ebp - 8], 0
mov al, byte [0x409910]
mov byte [ebp - 0x508], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x507]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x409914]
mov byte [ebp - 0x408], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x409918]
mov byte [ebp - 0x608], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x607]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [0x4097c4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x608]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x40991c
call fcn.004027ab
add esp, 4
push 0x409920
call fcn.004027ab
add esp, 4
push 0x408200
call fcn.004027ab
add esp, 4
lea edx, [ebp - 0x608]
push edx
push str.Startup___s_
call fcn.004027ab
add esp, 8
push str.
call fcn.004027ab
add esp, 4
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push str._RESTORE
lea ecx, [ebp - 0x608]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402a46
push str.Processing_manual_request_to_restore_security_settings
call fcn.004027ab
add esp, 4
push 0
call fcn.0040281c
add esp, 4
jmp 0x40308f
push str._SECURE
lea edx, [ebp - 0x608]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402a7b
push str.Processing_manual_request_to_apply_security_settings
call fcn.004027ab
add esp, 4
push 1
call fcn.0040281c
add esp, 4
jmp 0x40308f
push 0xff
lea eax, [ebp - 0x508]
push eax
push str._SystemRoot__system32_username_.kiosk
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x508]
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
mov dword [0x409908], 0
push 0
push 0x80
push 3
push 0
push 0
push 0
lea edx, [ebp - 0x508]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0xffffffff
jne 0x402b7f
push str.Startup_without_username_sentinel_file__display_warning
call fcn.004027ab
add esp, 4
push 0x40837c
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x402b66
lea ecx, [ebp - 0x508]
push ecx
push str.EZShell_is_a_Windows_Desktop_replacement_process_that_normally_runs_only_during_Windows_startup_as_configured_by_the_IDCONFIG_utility._However__because_the_User_semaphore_file__s_was_not_found__it_appears_that_EZShell_was_run_manually_and_not_part_of_normal_user_profile_initialization._n_nIf_you_really_intend_to_do_this_and_you_know_what_youre_doing__press_OK_to_continue._Otherwise__press_Cancel_to_exit.
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x1001
push str.EZShell
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x402b57
push str.User_dismissed_warning__clear_security_policies_and_exit.
call fcn.004027ab
add esp, 4
push 0
call fcn.0040281c
add esp, 4
jmp 0x40308f
push str.User_acknowledged_warning__continue_operation
call fcn.004027ab
add esp, 4
jmp 0x402b7d
push str.Suppress_warning_due_to__Y_parameter
call fcn.004027ab
add esp, 4
mov dword [0x409908], 1
jmp 0x402b96
mov dword [0x409908], 1
mov ecx, dword [ebp - 0x610]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Creating_startup_semaphore
call fcn.004027ab
add esp, 4
push str.CDS_EZSHELL
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
push str.SOFTWAREEZShell
push 0x80000002
mov ecx, 0x4097a0
call fcn.004011fd
and eax, 0xff
test eax, eax
je 0x402c74
push str.DefaultMenu
mov ecx, 0x4097a0
call fcn.004013aa
mov byte [0x409900], al
push str.DesktopText
mov ecx, 0x4097a0
call fcn.0040135c
mov dword [0x4098f4], eax
push str.MenuDir
mov ecx, 0x4097a0
call fcn.0040135c
mov dword [0x4098f8], eax
push str.StartupDir
mov ecx, 0x4097a0
call fcn.0040135c
mov dword [0x4098fc], eax
push str.HotKey
mov ecx, 0x4097a0
call fcn.004013aa
mov byte [0x409901], al
push str.DesktopBitmap
mov ecx, 0x4097a0
call fcn.0040135c
mov dword [ebp - 8], eax
push str.SkipRegistry
mov ecx, 0x4097a0
call fcn.004013aa
mov byte [0x4080a4], al
push str.Startup_configuration_values:
call fcn.004027ab
add esp, 4
jmp 0x402d11
mov byte [0x409900], 0
mov byte [0x409901], 0
push 0x80
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x4098f4], eax
push str.OUT_OF_SERVICE
mov edx, dword [0x4098f4]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x80
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x4098fc], eax
push str.C:CDSNTEZSHELLSTARTUP_
mov eax, dword [0x4098fc]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x80
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x4098f8], eax
push str.C:CDSNTEZSHELLMENU_
mov ecx, dword [0x4098f8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 8], 0
mov byte [0x4080a4], 0
push str.Default_configuration_values:
call fcn.004027ab
add esp, 4
mov ecx, 0x4097a0
call fcn.00401240
xor edx, edx
mov dl, byte [0x409900]
push edx
push str._____DefaultMenu_____d
call fcn.004027ab
add esp, 8
mov eax, dword [0x4098f4]
push eax
push str._____DesktopText_____s
call fcn.004027ab
add esp, 8
mov ecx, dword [0x4098f8]
push ecx
push str._____MenuDir_________s
call fcn.004027ab
add esp, 8
mov edx, dword [0x4098fc]
push edx
push str._____StartupDir______s
call fcn.004027ab
add esp, 8
xor eax, eax
mov al, byte [0x409901]
push eax
push str._____HotKey__________d
call fcn.004027ab
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
push str._____DesktopBitmap___s
call fcn.004027ab
add esp, 8
xor edx, edx
mov dl, byte [0x4080a4]
push edx
push str._____SkipRegistry____d
call fcn.004027ab
add esp, 8
xor eax, eax
mov al, byte [0x4080a4]
test eax, eax
jne 0x402dc6
cmp dword [0x409908], 0
je 0x402dc6
push 1
call fcn.0040281c
add esp, 4
cmp dword [ebp - 8], 0
je 0x402e1a
push str.setting_shell_background_image
call fcn.004027ab
add esp, 4
push str.Control_PanelDesktop
push 0x80000001
mov ecx, 0x4097a0
call fcn.004011b2
mov ecx, dword [ebp - 8]
push ecx
push str.Wallpaper
mov ecx, 0x4097a0
call fcn.00401418
mov ecx, 0x4097a0
call fcn.00401240
push 1
mov edx, dword [ebp - 8]
push edx
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push str.Loading_SHELL32_entry_points
call fcn.004027ab
add esp, 4
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
je 0x402e6b
push 0x3d
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4098f0], eax
mov ecx, dword [0x4098f0]
push ecx
push str.Acquiring_context_menu_resources_from_SHELL32__0x_08X_
call fcn.004027ab
add esp, 8
jmp 0x402e78
push str.Error_loading_SHELL32.DLL
call fcn.004027ab
add esp, 4
push str.Creating_Desk1_thread__to_own_background_and_label_
call fcn.004027ab
add esp, 4
lea edx, [ebp - 0x614]
push edx
push 0
push 0
push 0x403096
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x409904], eax
cmp dword [0x409904], 0
je 0x402ec2
push 0x7d0
mov eax, dword [0x409904]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402edb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning__unable_to_creating_Desk1__gla_d
call fcn.004027ab
add esp, 8
jmp 0x402f60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x618], eax
cmp dword [0x409904], 0
je 0x402f4a
cmp dword [0x4098ec], 0
jne 0x402f4a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x618]
jb 0x402f1b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x618]
mov dword [ebp - 0x61c], eax
jmp 0x402f34
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x618]
sub ecx, eax
or edx, 0xffffffff
sub edx, ecx
mov dword [ebp - 0x61c], edx
cmp dword [ebp - 0x61c], 0x1388
jae 0x402f4a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402ee7
cmp dword [0x4098ec], 0
jne 0x402f60
push str.Warning__Desk1_did_not_report_ready
call fcn.004027ab
add esp, 4
push 0x1d4c0
call fcn.0040644d
add esp, 4
push 0x1d4c0
call fcn.00404168
add esp, 4
cmp dword [0x4098fc], 0
je 0x402fd7
mov eax, dword [0x4098fc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402fd7
push str.Set_working_directory_to_startup_Folder
call fcn.004027ab
add esp, 4
mov edx, dword [0x4098fc]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x402fca
push str.Run_startup_tasks
call fcn.004027ab
add esp, 4
mov eax, dword [0x4098fc]
push eax
call fcn.004034ea
add esp, 4
jmp 0x402fd7
push str.Startup_folder_invalid__skipping
call fcn.004027ab
add esp, 4
push str.Initialisation_complete
call fcn.004027ab
add esp, 4
mov ecx, 0x4097a4
call fcn.00401066
push str.Switching_to_idle_mode__platform_and_other_startup_tools_should_now_be_running
call fcn.004027ab
add esp, 4
cmp dword [0x409904], 0
je 0x40302c
cmp dword [0x409904], 0
je 0x40302a
push 0
mov ecx, dword [0x409904]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40302a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403004
jmp 0x40304c
push str.Desk1_not_running__sleep_perpetually
call fcn.004027ab
add esp, 4
mov edx, 1
test edx, edx
je 0x40304c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403039
push str.Desktop_threads_complete
call fcn.004027ab
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Clearing_security_settings_at_shutdown
call fcn.004027ab
add esp, 4
push 0
call fcn.0040281c
add esp, 4
push str.process_exiting_and_alternate_shell_terminating
call fcn.004027ab
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov esp, ebp
pop ebp
ret 0x10