Function at 0x1003f8e
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [sym.imp.NTDLL.DLL_RtlInitUnicodeString]
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push str.REGISTRYMACHINESOFTWAREMicrosoftOS_2_Subsystem_for_NT1.0config.sys
push eax
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 8]
push 0x20019
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.NTDLL.DLL_NtOpenKey]
cmp eax, ebx
jl 0x101c337
lea eax, [ebp - 0x1c]
push str.Flags
push eax
call esi
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.NTDLL.DLL_NtQueryValueKey]
push eax
lea eax, [ebp - 0x6c]
push 0x20
push eax
lea eax, [ebp - 0x1c]
push 2
push eax
push dword [ebp - 8]
call edi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x101c394
cmp dword [ebp - 0x68], 4
jne 0x101c4d6
cmp dword [ebp - 0x64], 4
jne 0x101c4d6
mov eax, dword [ebp - 0x60]
push str.config.sys
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
lea eax, [ebp - 0x1c]
push 2
push eax
push dword [ebp - 8]
call edi
cmp eax, 0xc0000034
je 0x101c4d6
cmp eax, 0xc000003a
je 0x101c4d6
cmp eax, 0xc0000039
je 0x101c4d6
cmp eax, 0xc0000023
jne 0x1004088
test byte [ebp - 0xc], 2
jne 0x1004088
test byte [ebp - 0xc], 1
jne 0x101c3b8
push dword [ebp - 8]
call dword [sym.imp.NTDLL.DLL_NtClose]
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 0xc000003a
je 0x101c350
cmp eax, 0xc0000034
je 0x101c350
cmp eax, 0xc0000039
jne 0x1004091
push 0x104
push 0x1022c38
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x101c386
push ebx
push ebx
push 0x1000
push 0x10000
push ebx
push 2
call dword [sym.imp.NTDLL.DLL_RtlCreateHeap]
cmp eax, ebx
mov dword [0x1022c30], eax
jne 0x101c4e4
cmp dword [ebp - 4], ebx
je 0x1004091
jmp 0x101c4ce
push dword [ebp - 8]
call dword [sym.imp.NTDLL.DLL_NtClose]
cmp dword [ebp - 0x10], 0xc000003a
je 0x101c350
cmp dword [ebp - 0x10], 0xc0000034
je 0x101c350
cmp dword [ebp - 0x10], 0xc0000039
jmp 0x101c34a
lea eax, [ebp - 0x1c]
push str.FileTimeSizeStamp
push eax
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x6c]
push 0x20
push eax
lea eax, [ebp - 0x1c]
push 2
push eax
push dword [ebp - 8]
call edi
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.NTDLL.DLL_NtClose]
cmp edi, ebx
jge 0x101c40a
cmp edi, 0xc000003a
je 0x101c350
cmp edi, 0xc0000034
je 0x101c350
cmp edi, 0xc0000039
jmp 0x101c34a
cmp dword [ebp - 0x68], 3
jne 0x101c350
cmp dword [ebp - 0x64], 0x10
jne 0x101c350
cmp dword [0x7ffe02c0], 1
jne 0x101c497
push str.DosDevicesA:CONFIG.SYS
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x1c]
push 0x20
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x34]
push 1
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x18
push eax
lea eax, [ebp - 4]
push 0x120089
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.NTDLL.DLL_NtOpenFile]
cmp eax, ebx
jl 0x101c350
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call fcn.0101cc89
cmp eax, ebx
jge 0x101c49e
push dword [ebp - 4]
call dword [sym.imp.NTDLL.DLL_NtClose]
mov dword [ebp - 4], ebx
jmp 0x101c350
push str.DosDevicesC:CONFIG.SYS
jmp 0x101c42c
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x60]
jne 0x101c350
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x5c]
jne 0x101c350
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jne 0x101c350
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x54]
jne 0x101c350
push dword [ebp - 4]
jmp 0x100408b
push dword [ebp - 8]
call dword [sym.imp.NTDLL.DLL_NtClose]
jmp 0x101c350
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0101bff8
push dword [0x1022c30]
call dword [sym.imp.NTDLL.DLL_RtlDestroyHeap]
jmp 0x1004091