Function at 0x10a4f20
Capabilities:
Check if file exists
Query or enumerate registry key
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113957b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x41c4
call fcn.010840f0
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0x4160], eax
mov dword [ebp - 0x4190], edi
mov dword [ebp - 0x4164], ecx
mov dword [ebp - 0x4124], ebx
mov dword [ebp - 0x4184], ebx
mov dword [ebp - 0x4180], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4188], ebx
mov dword [ebp - 0x417c], ebx
mov esi, dword [edi]
mov dword [ebp - 0x4168], ebx
mov dword [ebp - 0x414c], ebx
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 3
mov dword [ebp - 0x415c], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x4150], eax
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 4
call eax
add eax, 0x10
mov dword [ebp - 0x4194], eax
mov dword [ebp - 0x41b4], ebx
mov dword [ebp - 0x41b0], ebx
mov dword [ebp - 0x41ac], ebx
mov dword [ebp - 0x41a8], ebx
mov dword [ebp - 0x41c4], ebx
mov dword [ebp - 0x41c0], ebx
mov dword [ebp - 0x41bc], ebx
mov dword [ebp - 0x41b8], ebx
mov dword [ebp - 0x41a4], ebx
mov dword [ebp - 0x41a0], ebx
mov dword [ebp - 0x419c], ebx
mov dword [ebp - 0x4198], ebx
push ebx
push 0x101025c
lea ecx, [ebp - 0x4124]
push ecx
push 0x10101e8
lea edx, [ebp - 0x4120]
push 2
push edx
mov byte [ebp - 4], 8
call fcn.01075110
add esp, 0x18
push ebx
lea ecx, [ebp - 0x4184]
call fcn.01096870
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jl 0x10a587b
cmp dword [ebp - 0x4160], ebx
mov byte [ebp - 4], 0xa
jne 0x10a5871
cmp dword [ebp + 0xc], ebx
ja 0x10a5871
call fcn.010c81a0
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jl 0x10a587b
lea eax, [ebp - 0x4168]
push eax
call fcn.010c68c0
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jge 0x10a50da
call fcn.01127f00
cmp al, bl
je 0x10a587b
mov ecx, dword [ebp - 0x4124]
push ecx
push 0x100b430
push 0x1010170
push 3
call fcn.01128b70
add esp, 0x10
jmp 0x10a587b
cmp dword [ebp - 0x4168], ebx
jne 0x10a50f1
mov dword [ebp - 0x4124], 0x80048062
jmp 0x10a587b
test byte [ebp + 8], 0x20
je 0x10a5102
mov dword [ebp - 0x4124], ebx
jmp 0x10a587b
mov edx, dword [0x11608e8]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x414c]
call fcn.01071d80
cmp eax, ebx
je 0x10a516d
jle 0x10a512e
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4124], eax
call fcn.01127f00
cmp al, bl
je 0x10a515e
mov eax, dword [ebp - 0x4124]
mov ecx, dword [0x11608e8]
push eax
push ecx
push 0x1010134
push 0x10100c0
push ebx
call fcn.01128b70
add esp, 0x14
mov dword [ebp - 0x4124], 0x8004804e
jmp 0x10a587b
mov eax, dword [ebp - 0x414c]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x415c]
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, ebx
je 0x10a51d3
jle 0x10a519b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4124], eax
call fcn.01127f00
cmp al, bl
je 0x10a51c4
mov ecx, dword [ebp - 0x4124]
push ecx
push 0x1010078
push 0x1010000
push ebx
call fcn.01128b70
add esp, 0x10
mov dword [ebp - 0x4124], 0x8004804e
jmp 0x10a587b
cmp esi, 0xffffffff
jne 0x10a51eb
mov edx, dword [ebp - 0x415c]
mov dword [edi], edx
mov dword [ebp - 0x4124], ebx
jmp 0x10a587b
mov dword [ebp - 0x4148], ebx
call fcn.010f91e0
lea ecx, [ebp - 0x4150]
push ecx
mov ecx, eax
call fcn.010a3870
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
lea esp, [esp]
cmp edi, dword [ebp - 0x415c]
jae 0x10a53e6
lea ecx, [ebp - 0x4134]
call fcn.01099650
push 0x3ffe
lea edx, [ebp - 0x4012]
push ebx
push edx
mov word [ebp - 0x4014], bx
call fcn.01084910
mov dword [ebp - 0x4138], ebx
add esp, 0xc
mov dword [ebp - 0x418c], 0x2000
mov dword [ebp - 0x4138], ebx
mov dword [ebp - 0x413c], 0x100c630
lea ecx, [ebp - 0x4128]
call fcn.01099650
lea ecx, [ebp - 0x4144]
mov byte [ebp - 4], 0xd
call fcn.01099680
mov dword [ebp - 0x4130], ebx
mov dword [ebp - 0x412c], ebx
mov eax, dword [0x1162a90]
mov dword [ebp - 0x4178], ebx
mov dword [ebp - 0x4174], ebx
mov dword [ebp - 0x4170], ebx
mov dword [ebp - 0x416c], ebx
mov dword [ebp - 0x4158], eax
mov dword [ebp - 0x4154], ebx
mov eax, dword [ebp - 0x414c]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x418c]
push ecx
lea edx, [ebp - 0x4014]
push edx
push edi
push eax
mov byte [ebp - 4], 0x11
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x10a538b
cmp eax, ebx
je 0x10a541a
jle 0x10a52f5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4124], eax
call fcn.01127f00
cmp al, bl
je 0x10a5325
mov ecx, dword [ebp - 0x4124]
mov edx, dword [0x11608e8]
push ecx
push edx
push 0x100ffb0
push 0x100ff38
push ebx
call fcn.01128b70
add esp, 0x14
mov dword [ebp - 0x4124], 0x8004804e
mov eax, dword [ebp - 0x412c]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0x10a5343
push eax
call fcn.01098230
lea ecx, [ebp - 0x4130]
mov byte [ebp - 4], 0xe
call fcn.010979a0
lea ecx, [ebp - 0x4144]
mov byte [ebp - 4], 0xd
call fcn.010996b0
lea ecx, [ebp - 0x4128]
call fcn.0111cdb0
lea ecx, [ebp - 0x413c]
mov byte [ebp - 4], 0xb
call fcn.0109b4c0
lea ecx, [ebp - 0x4134]
call fcn.0111cdb0
jmp 0x10a587b
mov eax, dword [ebp - 0x412c]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0x10a539f
push eax
call fcn.01098230
lea ecx, [ebp - 0x4130]
mov byte [ebp - 4], 0xe
call fcn.010979a0
lea ecx, [ebp - 0x4144]
mov byte [ebp - 4], 0xd
call fcn.010996b0
lea ecx, [ebp - 0x4128]
call fcn.0111cdb0
lea ecx, [ebp - 0x413c]
mov byte [ebp - 4], 0xb
call fcn.0109b4c0
lea ecx, [ebp - 0x4134]
mov byte [ebp - 4], 0xa
call fcn.0111cdb0
mov ecx, dword [ebp - 0x4148]
shl ecx, 4
push ecx
mov dword [ebp - 0x4124], ebx
call fcn.010726d0
cmp eax, ebx
mov edx, dword [ebp - 0x4164]
mov dword [edx], eax
jne 0x10a5789
mov dword [ebp - 0x4124], 0x8007000e
jmp 0x10a587b
lea eax, [ebp - 0x4014]
push eax
call fcn.010c6d40
cmp al, bl
jne 0x10a5726
lea ecx, [ebp - 0x4128]
push ecx
push ecx
lea edx, [ebp - 0x4150]
mov ecx, esp
mov dword [ebp - 0x41cc], esp
push edx
call fcn.010827d0
lea eax, [ebp - 0x4014]
push eax
call fcn.010a4c40
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jne 0x10a5703
mov eax, dword [ebp - 0x4128]
cmp dword [eax - 0xc], ebx
je 0x10a5703
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10a5703
call fcn.01127f00
cmp al, bl
je 0x10a54a6
mov ecx, dword [ebp - 0x4128]
push ecx
push 0x100fef0
push 0x100fe78
push 3
call fcn.01128b70
add esp, 0x10
lea edx, [ebp - 0x4128]
push edx
lea ecx, [ebp - 0x4144]
call fcn.0109c210
lea eax, [ebp - 0x4014]
push eax
lea ecx, [ebp - 0x4140]
call fcn.0107f660
lea ecx, [ebp - 0x4144]
push ecx
lea ecx, [ebp - 0x4158]
call fcn.01096270
test eax, eax
jne 0x10a5532
call fcn.01127f00
cmp al, bl
je 0x10a5513
call esi
test eax, eax
jg 0x10a54f3
call esi
jmp 0x10a54ff
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x100fe08
push 0x100fd90
push ebx
call fcn.01128b70
add esp, 0x10
cmp dword [ebp - 0x4154], ebx
je 0x10a5726
mov edx, dword [ebp - 0x4158]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10a5726
lea eax, [ebp - 0x4130]
push eax
mov eax, dword [ebp - 0x4160]
lea ecx, [ebp - 0x4138]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x412c]
push edx
push 0x800
and ecx, 0xffffffb7
push eax
or ecx, 0x10
push ecx
call fcn.010cb510
mov esi, dword [ebp - 0x4158]
push ebx
push esi
mov dword [ebp - 0x4124], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, ebx
je 0x10a563d
cmp dword [ebp - 0x4124], ebx
mov dword [ebp - 0x4154], ebx
jl 0x10a563d
mov eax, dword [ebp - 0x412c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10a55a0
sub eax, edx
sar eax, 1
mov esi, eax
lea edx, [esi + esi + 2]
push edx
call fcn.010726d0
cmp eax, ebx
mov dword [ebp - 0x4178], eax
jne 0x10a55d4
mov dword [ebp - 0x4124], 0x8007000e
jmp 0x10a532f
mov ecx, dword [ebp - 0x412c]
push ecx
add esi, 1
push esi
push eax
call fcn.01074500
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jl 0x10a532f
lea edx, [ebp - 0x4170]
push edx
mov edx, dword [ebp - 0x4138]
lea eax, [ebp - 0x416c]
push eax
lea ecx, [ebp - 0x4174]
push ecx
push edx
call fcn.0109cd70
cmp eax, ebx
mov dword [ebp - 0x4124], eax
jl 0x10a532f
lea eax, [ebp - 0x4178]
push eax
lea ecx, [ebp - 0x41a4]
call fcn.01098f60
add dword [ebp - 0x4148], 1
jmp 0x10a569a
call fcn.01127f00
cmp al, bl
je 0x10a568a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10a5658
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10a5668
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x4144]
mov edx, dword [ebp - 0x4124]
push ecx
push edx
push eax
push 0x100fce0
push 0x100fc68
push ebx
call fcn.01128b70
add esp, 0x18
cmp dword [ebp - 0x4154], ebx
je 0x10a569a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x412c]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0x10a56ae
push eax
call fcn.01098230
lea ecx, [ebp - 0x4130]
mov byte [ebp - 4], 0xe
call fcn.010979a0
lea ecx, [ebp - 0x4144]
mov byte [ebp - 4], 0xd
call fcn.010996b0
lea ecx, [ebp - 0x4128]
call fcn.0111cdb0
lea ecx, [ebp - 0x413c]
mov byte [ebp - 4], 0xb
call fcn.0109b4c0
lea ecx, [ebp - 0x4134]
mov byte [ebp - 4], 0xa
call fcn.0111cdb0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add edi, 1
jmp 0x10a5210
call fcn.01127f00
cmp al, bl
je 0x10a5726
mov eax, dword [ebp - 0x4124]
push eax
push 0x100fbf8
push 0x100fb80
push ebx
call fcn.01128b70
add esp, 0x10
mov eax, dword [ebp - 0x412c]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0x10a573a
push eax
call fcn.01098230
lea ecx, [ebp - 0x4130]
mov byte [ebp - 4], 0xe
call fcn.010979a0
lea ecx, [ebp - 0x4144]
mov byte [ebp - 4], 0xd
call fcn.010996b0
lea ecx, [ebp - 0x4128]
call fcn.0111cdb0
lea ecx, [ebp - 0x413c]
mov byte [ebp - 4], 0xb
call fcn.0109b4c0
lea ecx, [ebp - 0x4134]
mov byte [ebp - 4], 0xa
call fcn.0111cdb0
add edi, 1
jmp 0x10a5210
xor esi, esi
mov edi, edx
lea ecx, [ecx]
mov eax, dword [ebp - 0x4148]
cmp esi, eax
jae 0x10a57c8
push esi
lea ecx, [ebp - 0x41a4]
call fcn.01095c20
mov edx, dword [eax]
mov ecx, esi
shl ecx, 4
add ecx, dword [edi]
add esi, 1
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x10a5790
mov ecx, dword [ebp - 0x4190]
mov dword [ecx], eax
mov dword [ebp - 4], 9
jmp 0x10a587b
mov dword [ebp - 0x4124], 0x8004805e
mov esi, dword [ebp - 0x4124]
lea ecx, [ebp - 0x4120]
mov byte [ebp - 4], 8
call fcn.01075230
mov eax, dword [ebp - 0x41a4]
cmp eax, ebx
je 0x10a58a3
push eax
call fcn.01083cad
add esp, 4
mov eax, dword [ebp - 0x41c4]
cmp eax, ebx
je 0x10a58b6
push eax
call fcn.01083cad
add esp, 4
mov eax, dword [ebp - 0x41b4]
cmp eax, ebx
je 0x10a58c9
push eax
call fcn.01083cad
add esp, 4
mov eax, dword [ebp - 0x4194]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10a58ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x4150]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10a5915
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x414c]
cmp eax, ebx
je 0x10a5926
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x417c]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x10a593a
push eax
call fcn.01098230
mov edi, dword [ebp - 0x4188]
cmp edi, ebx
mov byte [ebp - 4], bl
je 0x10a595f
lea ecx, [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x10a595f
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
cmp dword [ebp - 0x4184], ebx
je 0x10a596f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0x14