Function at 0x10026ad0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100503cb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x12d4
call fcn.1003dcd0
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x12d0], eax
push ebx
push esi
push edi
mov eax, dword [0x10063790]
xor eax, esp
push eax
lea eax, [esp + 0x12e8]
mov dword fs:[0], eax
xor esi, esi
mov ebx, ecx
or edi, 0xffffffff
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], si
push 0x206
lea eax, [esp + 0xac2]
push esi
mov dword [esp + 0x12f8], esi
push eax
mov word [esp + 0xac8], si
call fcn.1003d360
push 0x206
lea ecx, [esp + 0x6c6]
push esi
push ecx
mov word [esp + 0x6cc], si
call fcn.1003d360
push 0x206
lea edx, [esp + 0x10f2]
push esi
push edx
mov word [esp + 0x10f8], si
call fcn.1003d360
push 0x206
lea eax, [esp + 0x2ce]
push esi
push eax
mov word [esp + 0x2d4], si
call fcn.1003d360
push 0x206
lea ecx, [esp + 0x4e2]
push esi
push ecx
mov word [esp + 0x4e8], si
call fcn.1003d360
push 0x206
lea edx, [esp + 0xd06]
push esi
push edx
mov word [esp + 0xd0c], si
call fcn.1003d360
add esp, 0x48
push 0x206
lea eax, [esp + 0xed2]
push esi
push eax
mov word [esp + 0xed8], si
call fcn.1003d360
push 0x24c
lea ecx, [esp + 0x68]
push esi
push ecx
mov dword [esp + 0x6c], esi
call fcn.1003d360
push 0x200
lea edx, [esp + 0x8d8]
push esi
push edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
call fcn.1003d360
add esp, 0x24
lea eax, [esp + 0x38]
push eax
mov ecx, ebx
call fcn.10025cf0
test eax, eax
jne 0x10026c6e
cmp dword [esp + 0x50], 8
jb 0x10026c66
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.1003c1aa
add esp, 4
or eax, 0xffffffff
jmp 0x1002724d
cmp dword [esp + 0x4c], esi
jne 0x10026c90
cmp dword [esp + 0x50], 8
jb 0x10026c66
mov edx, dword [esp + 0x3c]
push edx
call fcn.1003c1aa
add esp, 4
or eax, 0xffffffff
jmp 0x1002724d
push 0x104
lea eax, [esp + 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [esp + 0x50], 8
mov eax, dword [esp + 0x3c]
mov word [esp + 0x10da], si
jae 0x10026cba
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xac0]
push 0x104
push ecx
call fcn.1003e374
push str.SYSTEM32KERNEL32.DLL
lea edx, [esp + 0xacc]
push 0x104
push edx
call fcn.10040110
mov eax, dword [esp + 0x54]
add esp, 0x18
cmp dword [esp + 0x50], 8
jae 0x10026cf6
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0xcc8]
push 0x104
push eax
call fcn.1003e374
push str.EHOMEEHSHELL.EXE
lea ecx, [esp + 0xcd4]
push 0x104
push ecx
call fcn.10040110
add esp, 0x18
lea ecx, [esp + 0xabc]
call fcn.10027280
cmp dword [esp + 0x50], 8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
jae 0x10026d42
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x2c]
push edx
push ebx
lea edx, [esp + 0x44]
call fcn.10026310
test eax, eax
jne 0x10026d7f
cmp dword [esp + 0x50], 8
jb 0x10026c66
mov eax, dword [esp + 0x3c]
push eax
call fcn.1003c1aa
add esp, 4
or eax, 0xffffffff
jmp 0x1002724d
mov eax, dword [esp + 0x24]
cmp eax, 6
jne 0x10026f7b
mov eax, dword [esp + 0x3c]
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x50], 8
jae 0x10026d9f
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x6b8]
push 0x104
push ecx
call fcn.1003e374
push str.SYSTEM32CONFIGSOFTWARE
lea edx, [esp + 0x6c4]
push 0x104
push edx
call fcn.10040110
push str.TEST
lea eax, [esp + 0x2c0]
push 0x104
push eax
call fcn.1003e374
push 1
push str.SeBackupPrivilege
call fcn.10032020
push 1
push str.SeRestorePrivilege
call fcn.10032020
add esp, 0x34
lea ecx, [esp + 0x6b4]
push ecx
lea edx, [esp + 0x2a8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
jne 0x10026e21
push str.TESTMicrosoftWindows_NTCurrentVersion
jmp 0x10026e2e
cmp eax, 0x20
jne 0x10026e61
lea ebx, [eax - 0x1f]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea eax, [esp + 0x2a8]
push 0x104
push eax
call fcn.1003e374
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push esi
lea edx, [esp + 0x2b0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10026eec
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x8c0]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
push str.EditionID
push eax
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10026ee1
lea ecx, [esp + 0x8bc]
push ecx
lea edx, [esp + 0x4b0]
push 0x104
push edx
call fcn.1003e374
lea eax, [esp + 0x4b8]
push 0x104
push eax
call fcn.1003c7dd
lea ecx, [esp + 0x4c0]
push str.server
push ecx
call fcn.1003c14c
add esp, 0x1c
mov edi, eax
neg edi
sbb edi, edi
neg edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x10026f1d
push str.TEST
lea eax, [esp + 0x2a8]
push 0x104
push eax
call fcn.1003e374
add esp, 0xc
lea ecx, [esp + 0x2a4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
cmp dword [esp + 0x30], esi
je 0x10026f4e
cmp dword [esp + 0x18], 1
jne 0x10026f3e
cmp dword [esp + 0x20], 0x1b91
jl 0x10026f3e
mov edi, 0xe
jmp 0x10027237
xor edx, edx
cmp edi, esi
setne dl
lea edx, [edx + edx + 0xa]
jmp 0x10027235
cmp dword [esp + 0x18], 1
jne 0x10026f69
cmp dword [esp + 0x20], 0x1b91
jl 0x10026f69
mov edi, 0xd
jmp 0x10027237
xor eax, eax
cmp edi, esi
setne al
lea eax, [eax + eax + 9]
mov edi, eax
jmp 0x10027237
cmp eax, 5
jne 0x10027226
mov eax, dword [esp + 0x18]
cmp eax, 2
jne 0x10026f95
lea edi, [eax + 5]
jmp 0x10027237
cmp eax, 1
jne 0x1002721f
cmp dword [esp + 0x30], esi
je 0x10026fac
lea edi, [eax + 7]
jmp 0x10027237
cmp dword [esp + 0x50], 8
mov eax, dword [esp + 0x3c]
jae 0x10026fbb
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x6b8]
push 0x104
push ecx
call fcn.1003e374
push 0x1005b850
lea edx, [esp + 0x6c4]
push 0x104
push edx
call fcn.10040110
push str.TEST
lea eax, [esp + 0x2c0]
push 0x104
push eax
call fcn.1003e374
push 1
push str.SeBackupPrivilege
call fcn.10032020
push 1
push str.SeRestorePrivilege
call fcn.10032020
add esp, 0x34
lea ecx, [esp + 0x6b4]
push ecx
lea edx, [esp + 0x2a8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
jne 0x1002703d
push str.TESTControlSet001ControlProductOptions
jmp 0x1002704f
cmp eax, 0x20
jne 0x10027082
mov dword [esp + 0x2c], 1
push str.SYSTEMCurrentControlSetControlProductOptions
lea eax, [esp + 0x2a8]
push 0x104
push eax
call fcn.1003e374
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push esi
lea edx, [esp + 0x2b0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov word [esp + 0x4ac], si
jne 0x10027145
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x8c0]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
push str.ProductSuite
push eax
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002713a
cmp word [esp + 0x8bc], si
lea edi, [esp + 0x8bc]
je 0x1002713a
push edi
lea ecx, [esp + 0xed0]
push 0x104
push ecx
call fcn.1003e374
push 0x1005b8d4
lea edx, [esp + 0x4bc]
push 0x104
push edx
call fcn.10040110
lea eax, [esp + 0xee4]
push eax
lea ecx, [esp + 0x4c8]
push 0x104
push ecx
call fcn.10040110
mov eax, edi
add esp, 0x24
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10027120
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], si
lea edi, [edi + eax*2 + 2]
jne 0x100270d2
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0xcc8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov edi, edx
cmp edi, esi
je 0x1002716d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x4ac]
push 0x104
push eax
call fcn.1003c7dd
add esp, 8
cmp word [esp + 0x4ac], si
jne 0x10027197
cmp edi, esi
je 0x10027197
mov edi, 6
jmp 0x100271ea
lea ecx, [esp + 0x4ac]
push str.server
push ecx
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x100271b7
mov edi, 7
jmp 0x100271ea
lea edx, [esp + 0x4ac]
push 0x1005b8d8
push edx
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x100271d7
mov edi, 2
jmp 0x100271ea
mov di, word [esp + 0x4ac]
neg di
sbb edi, edi
and edi, 0xfffffffd
add edi, 5
cmp dword [esp + 0x2c], esi
jne 0x10027237
push str.TEST
lea eax, [esp + 0x2a8]
push 0x104
push eax
call fcn.1003e374
add esp, 0xc
lea ecx, [esp + 0x2a4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x10027237
mov edi, 3
jmp 0x10027237
cmp eax, 4
jne 0x10027237
xor edx, edx
cmp dword [esp + 0x18], 0x5a
setne dl
mov edi, edx
cmp dword [esp + 0x50], 8
jb 0x1002724b
mov eax, dword [esp + 0x3c]
push eax
call fcn.1003c1aa
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x12e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x12d0]
xor ecx, esp
call fcn.1003c13d
mov esp, ebp
pop ebp
ret