Function at 0x100499a
Capabilities:
Query environment variable
Query or enumerate registry value
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
xor eax, eax
push edi
push eax
push eax
push 1
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, 0x104
push esi
mov edi, 0x1007988
push edi
push 0x10015e0
call ebx
push 0
test eax, eax
jne 0x10049eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010026f3
xor eax, eax
inc eax
jmp 0x1004d2c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1007b9c], eax
test eax, eax
jne 0x10049fd
push edi
jmp 0x10049d7
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
push esi
push 0x1007780
push 0x10015c8
mov dword [0x1007778], eax
call ebx
test eax, eax
jne 0x1004a28
push 0x1007988
push esi
push 0x1007780
call fcn.010024d1
cmp dword [ebp + 8], 1
jne 0x1004a3a
xor esi, esi
call fcn.01003d20
jmp 0x1004d2a
mov esi, dword [sym.imp.msvcrt.dll_wcsncmp]
push 2
pop ebx
push ebx
push 0x10015c0
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004e69
push ebx
push 0x10015b8
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004e69
push ebx
push 0x10015b0
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004e69
push ebx
push 0x10015a8
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004e69
push ebx
push 0x1001590
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004df9
push ebx
push 0x1001578
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004df9
push ebx
push 0x1001560
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004df9
push ebx
push 0x1001548
push dword [edi + 4]
call esi
add esp, 0xc
test eax, eax
je 0x1004df9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 8]
call fcn.01001d92
test eax, eax
jne 0x1004b38
xor esi, esi
inc esi
jmp 0x1004a30
push dword [ebp - 0x14]
mov esi, 0x1007ba8
push dword [ebp - 4]
mov ecx, esi
call fcn.010018a7
xor ebx, ebx
test eax, eax
je 0x1004b65
cmp dword [ebp - 0x14], ebx
je 0x1004b5e
or dword [ebp - 4], 0x2000000
jmp 0x1004b65
or dword [ebp - 4], 0x1000000
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 4]
call fcn.010018a7
test eax, eax
je 0x1004b93
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x1004b90
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1004b80
sub eax, edx
sar eax, 1
jne 0x1004b93
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
push edi
call fcn.0100215c
cmp dword [ebp - 0x24], ebx
je 0x1004bb0
push edi
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x1004d87
cmp dword [ebp - 0x1c], ebx
je 0x1004be4
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0xfffffff4
push ebx
add eax, 0x10
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1004d27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x1007988
jmp 0x1004ea6
cmp dword [ebp - 0x28], ebx
je 0x1004d5a
push ebx
call fcn.01002193
test eax, eax
jne 0x1004d31
push 0x13
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x1004d27
cmp edi, ebx
je 0x1004cb2
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1004c29
sub eax, edx
sar eax, 1
je 0x1004cb2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1004c3e
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x1004c53
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
lea esi, [esi + esi + 0x28]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1004d1e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [edi], ax
call ebx
test eax, eax
je 0x1004ca5
call ebx
push eax
push dword [ebp - 8]
push dword [ebp - 0x18]
push 0x1001300
push esi
push edi
call fcn.010025ef
add esp, 0x18
jmp 0x1004d11
push dword [ebp - 8]
push dword [ebp - 0x18]
push 0x1001360
jmp 0x1004cf3
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1004cb7
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 0x28]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1004d1e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [edi], ax
call ebx
test eax, eax
je 0x1004cff
call ebx
push eax
push dword [ebp - 8]
push 0x10012f0
push esi
push edi
call fcn.010025ef
add esp, 0x14
jmp 0x1004d11
push dword [ebp - 8]
push 0x10013dc
push esi
push edi
call fcn.010025ef
add esp, 0x10
push edi
call fcn.01001bd1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
push ebx
and eax, 0x7fffffff
inc eax
push eax
push 2
push 3
call dword [sym.imp.ntdll.dll_NtInitiatePowerAction]
cmp eax, ebx
jge 0x1004d27
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x1004dda
cmp dword [ebp - 0x2c], ebx
je 0x1004d93
push 1
call fcn.01002193
push dword [ebp - 4]
test eax, eax
je 0x1004d7f
xor eax, eax
cmp dword [ebp - 8], ebx
setne al
lea eax, [eax*4 + 8]
push eax
jmp 0x1004d81
push 1
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1004d27
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004dda
cmp dword [ebp - 0x14], ebx
je 0x1004db0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push ebx
push ebx
push eax
push edi
call fcn.01002f44
jmp 0x1004d27
cmp dword [ebp - 0x30], ebx
je 0x1004de1
mov eax, 0x84
cmp dword [ebp - 8], ebx
je 0x1004dc9
inc eax
cmp edi, ebx
jne 0x1004dc9
mov eax, 0x87
push dword [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov esi, eax
jmp 0x1004ea5
push dword [ebp - 4]
push dword [ebp - 0x34]
push dword [ebp - 8]
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x1004d87
lea eax, [ebp - 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x1001370
push 0x80000002
mov dword [0x1007b98], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1004d2c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push edi
push 0x1001344
push dword [ebp - 0x18]
mov dword [ebp - 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x1004d2a
push dword [0x1007b9c]
call fcn.0100558c
jmp 0x1004e9b
mov eax, dword [0x1007b9c]
xor edi, edi
cmp eax, edi
je 0x1004d27
push edi
push 0x100491b
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, eax
and ecx, 0x1fff0000
movzx esi, ax
cmp ecx, 0x70000
je 0x1004e9d
mov esi, eax
cmp esi, edi
je 0x1004d2a
push edi
push esi
call fcn.010026f3
jmp 0x1004d2a