Function at 0x100260a
Capabilities:
Print debug messages
Query environment variable
Query or enumerate registry value
Set current directory
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0xa38]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10026d0
mov edi, 0x80000002
push edi
mov dword [ebp - 0xa34], ebx
call esi
test eax, eax
je 0x1003d9c
call fcn.010028f1
test eax, eax
je 0x1003e5e
call fcn.0100296b
test eax, eax
jne 0x1003e64
cmp dword [ebp - 0xa34], ebx
jne 0x1003e8f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
jne 0x1003eb0
xor edi, edi
inc edi
push edi
push ebx
push ebx
push ebx
push ebx
mov esi, 0x10028e0
push esi
call fcn.01002737
test eax, eax
jne 0x10026b9
push edi
push ebx
push ebx
push edi
push 0x10022d0
push esi
call fcn.01002737
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100148d
leave
ret
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa48]
push eax
push ebx
push 0x10043fc
push dword [ebp - 0xa38]
mov dword [ebp - 0xa40], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0xa38]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0xa34], ebx
je 0x1002652
lea eax, [ebp - 0xa38]
push eax
push 0x20019
push ebx
push 0x10043a8
push edi
call esi
test eax, eax
jne 0x1003e53
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa20]
push eax
lea eax, [ebp - 0xa48]
push eax
push ebx
push 0x1004384
push dword [ebp - 0xa38]
mov dword [ebp - 0xa40], 0x208
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1003e3c
cmp word [ebp - 0xa20], bx
jne 0x1003e42
mov dword [ebp - 0xa34], ebx
push dword [ebp - 0xa38]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1002652
mov dword [ebp - 0xa34], ebx
jmp 0x1002652
inc eax
jmp 0x10026bb
xor edi, edi
inc edi
push edi
push edi
push edi
push ebx
push ebx
mov esi, 0x1004370
push esi
call fcn.01002737
test eax, eax
jne 0x100266c
push edi
push edi
push edi
push edi
push ebx
push esi
call fcn.01002737
jmp 0x100266c
push ebx
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa20]
push eax
call fcn.01001573
test eax, eax
je 0x1002693
xor eax, eax
jmp 0x10026bb
lea eax, [ebp - 0xa23]
push eax
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa2c]
push eax
push 0xffffffffffffffff
mov byte [ebp - 0xa21], 1
mov byte [ebp - 0xa22], bl
mov dword [ebp - 0xa3c], ebx
mov dword [ebp - 0xa30], ebx
mov dword [ebp - 0xa2c], ebx
mov dword [ebp - 0xa28], ebx
mov byte [ebp - 0xa24], bl
mov byte [ebp - 0xa23], bl
call sub.WINSTA.dll_WinStationGetInitialApplication
cmp al, bl
jne 0x1003f27
mov eax, dword [ebp - 0xa2c]
cmp eax, ebx
jne 0x1003f4e
push 0x1004320
call sub.ntdll.dll_DbgPrint
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1003ea9
cmp dword [ebp - 0xa2c], ebx
je 0x10041f3
cmp byte [ebp - 0xa24], bl
jne 0x1003f59
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 0xa21], bl
jmp 0x1004093
mov byte [ebp - 0xa21], bl
jmp 0x1004099
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp - 0xa28], ebx
je 0x1003fbf
mov esi, 0x101
push esi
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0xa28]
call edi
test eax, eax
jne 0x1003fac
push dword [ebp - 0xa28]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.010021a9
cmp eax, ebx
jge 0x1003fac
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 0xa21], bl
jmp 0x100409f
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [ebp - 0xa21], al
lea eax, [ebp - 0x208]
mov dword [ebp - 0xa30], eax
cmp byte [ebp - 0xa21], bl
jne 0x1004001
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1d4]
push dword [ebp - 0xa28]
push 0x10042e0
call sub.ntdll.dll_DbgPrint
add esp, 0xc
mov byte [ebp - 0xa22], 1
jmp 0x100409f
push 0x208
lea eax, [ebp - 0x610]
push eax
call fcn.01004a1c
test al, al
je 0x100406d
mov esi, 0x104
push esi
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x610]
push eax
call edi
test eax, eax
jne 0x100404c
lea eax, [ebp - 0x610]
push eax
push esi
lea eax, [ebp - 0x818]
push eax
call fcn.010021a9
cmp eax, ebx
jl 0x1003f97
push ebx
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x818]
push eax
call fcn.01001573
test al, al
jne 0x100406d
push 0x100429c
call sub.ntdll.dll_DbgPrint
pop ecx
xor eax, eax
cmp byte [ebp - 0xa23], bl
push 1
sete al
lea eax, [eax + eax + 3]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xa2c]
call fcn.01001573
mov byte [ebp - 0xa21], al
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0xa30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa44], eax
call fcn.01004af1
test eax, eax
jne 0x10040b9
call fcn.01004b48
cmp byte [ebp - 0xa21], bl
jne 0x10041cc
push ebx
push 1
lea eax, [ebp - 0xa3c]
push eax
push ebx
push dword [ebp - 0xa44]
xor esi, esi
push ebx
push 0x11ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
push 0x100
lea ecx, [ebp - 0x408]
push ecx
cmp dword [ebp - 0xa3c], ebx
je 0x1004159
cmp byte [ebp - 0xa22], 1
setne al
add eax, 0x643
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
cmp edi, ebx
je 0x100414b
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x100414b
push dword [ebp - 0xa30]
lea eax, [ebp - 0x408]
push dword [ebp - 0xa3c]
push eax
push 0x200
push esi
call fcn.01003051
add esp, 0x14
push dword [ebp - 0xa3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10041aa
cmp byte [ebp - 0xa22], 1
setne al
add eax, 0x645
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
cmp edi, ebx
je 0x10041cc
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10041aa
push dword [ebp - 0xa30]
lea eax, [ebp - 0x408]
push dword [ebp - 0xa44]
push eax
push 0x200
push esi
call fcn.01003051
add esp, 0x14
cmp edi, ebx
je 0x10041cc
cmp esi, ebx
je 0x10041cc
push 0x1004210
push 0x4010
push ebx
push esi
push ebx
push ebx
call fcn.01004c3d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xa2c]
call sub.WINSTA.dll_WinStationFreeMemory
cmp dword [ebp - 0xa28], ebx
je 0x1003ea9
push dword [ebp - 0xa28]
call sub.WINSTA.dll_WinStationFreeMemory
jmp 0x1003ea9
cmp dword [ebp - 0xa28], ebx
je 0x1002693
push dword [ebp - 0xa28]
call sub.WINSTA.dll_WinStationFreeMemory
jmp 0x1002693