Function at 0x100f8600
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101265d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x14], 0
je 0x100f869a
cmp dword [0x10175120], 0
jne 0x100f869a
push edi
lea eax, [ebp + 0x14]
push str.Skipping_hook__VirtEngine_disabled_:__hs
push eax
call fcn.10044f30
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, str.DllMain
mov edx, dword [ebp + 0x14]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f8686
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10175964]
or ebx, 0xffffffff
test eax, eax
jne 0x100f8740
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f86c6
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x14]
push dword [0x1017507c]
push str.SoftwareVOS_sHooks
push eax
call fcn.10036910
mov esi, dword [ebp + 0x14]
add esp, 0xc
push 0x10175964
push esi
call fcn.1002ec70
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ecx, dword [0x10175964]
test eax, eax
mov dword [ebp - 4], 0xffffffff
cmovne ecx, ebx
add esi, 0xfffffff0
mov dword [0x10175964], ecx
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f8737
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x10175964]
test eax, eax
je 0x100f87be
cmp eax, 0xffffffff
je 0x100f87be
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x14], 1
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 4
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100f87a7
cmp dword [ebp + 0x14], eax
jne 0x100f87be
push ecx
mov eax, esp
push edi
push str.Skipping_hook:__hs
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push edi
push dword [0x10175964]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [0x10173650], 0
je 0x100f888b
mov ecx, str.NtCreateFile
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100f87f2
test dl, dl
je 0x100f87ee
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100f87f2
add eax, 2
add ecx, 2
test dl, dl
jne 0x100f87d2
xor eax, eax
jmp 0x100f87f7
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f885b
mov ecx, 0x10148704
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100f8822
test dl, dl
je 0x100f881e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100f8822
add eax, 2
add ecx, 2
test dl, dl
jne 0x100f8802
xor eax, eax
jmp 0x100f8827
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f885b
mov ecx, str.NtSetInformationFile
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100f8852
test dl, dl
je 0x100f884e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100f8852
add eax, 2
add ecx, 2
test dl, dl
jne 0x100f8832
xor eax, eax
jmp 0x100f8857
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100f888b
mov ecx, dword [ebp - 0x10]
mov edx, edi
call fcn.100f8580
push 1
push 3
mov esi, eax
call fcn.1001abb4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.1001807c
push 0
push 3
mov esi, eax
call fcn.1001abb4
jmp 0x100f88dc
mov eax, dword [0x10173664]
mov esi, dword [ebp + 0xc]
mov dword [eax*4 + 0x10173450], esi
inc eax
cmp dword [0x101746d4], 0
mov dword [0x10173664], eax
je 0x100f88ca
push ecx
mov eax, esp
push edi
push str.Forcing_Mixture_mode_for_WINE:__S
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
mov eax, 2
jmp 0x100f88cc
xor eax, eax
push eax
push esi
push dword [ebp + 8]
push edi
push dword [ebp - 0x10]
call fcn.1001814c
mov esi, eax
test esi, esi
jne 0x100f892e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x10]
push str._Failed_hooking__S__LE_d
push eax
call fcn.10044f30
add esp, 0x10
mov dword [ebp - 4], 2
mov ecx, str.DllMain
mov edx, dword [ebp - 0x10]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100f892e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret