Function at 0x10018010
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a37d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10086014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
call fcn.10017a10
add esp, 4
mov byte [0x10089128], al
call fcn.1003af90
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003b460
push 0xa
xor eax, eax
mov dword [ebp - 0x28], 0
push str.ws2_32.dll
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.1000f820
mov eax, 0xc90
mov dword [ebp - 4], 0
cmp word [0x1008935c], ax
je 0x100180b0
push ecx
push str.connect
mov edx, 0x10017ad0
mov ecx, 0x100894a0
call fcn.10017fc0
add esp, 8
cmp byte [0x10089128], 0
je 0x100180c5
mov eax, str.KernelBase.dll
mov ecx, 0xe
jmp 0x100180cf
mov eax, str.advapi32.dll
mov ecx, 0xc
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.1000f820
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x100181c8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExA
push esi
call edi
test eax, eax
je 0x10018124
push ecx
push str.RegOpenKeyExA
mov edx, 0x10017c00
mov dword [0x1008913c], eax
mov ecx, 0x1008913c
call fcn.10017fc0
add esp, 8
push str.RegOpenKeyExW
push esi
call edi
test eax, eax
je 0x1001814d
push ecx
push str.RegOpenKeyExW
mov edx, 0x10017c40
mov dword [0x10089138], eax
mov ecx, 0x10089138
call fcn.10017fc0
add esp, 8
push str.RegQueryValueExA
push esi
call edi
test eax, eax
je 0x10018176
push ecx
push str.RegQueryValueExA
mov edx, 0x10017d40
mov dword [0x10089130], eax
mov ecx, 0x10089130
call fcn.10017fc0
add esp, 8
push str.RegQueryValueExW
push esi
call edi
test eax, eax
je 0x1001819f
push ecx
push str.RegQueryValueExW
mov edx, 0x10017dd0
mov dword [0x1008912c], eax
mov ecx, 0x1008912c
call fcn.10017fc0
add esp, 8
push str.RegCloseKey
push esi
call edi
test eax, eax
je 0x100181c8
push ecx
push str.RegCloseKey
mov edx, 0x10017c80
mov dword [0x10089134], eax
mov ecx, 0x10089134
call fcn.10017fc0
add esp, 8
cmp byte [0x10089128], 0
je 0x1001820f
push 0xe
push str.KernelBase.dll
lea ecx, [ebp - 0x28]
call fcn.1000f820
push ecx
push 0x1007a344
mov edx, 0x10017e60
mov ecx, 0x100894bc
call fcn.10017fc0
add esp, 4
mov edx, 0x10017ed0
mov ecx, 0x100894c0
push 0x1007a354
call fcn.10017fc0
add esp, 8
cmp byte [0x1008949c], 0
je 0x10018256
push 0xb
push str.shell32.dll
lea ecx, [ebp - 0x28]
call fcn.1000f820
push ecx
push 0x1007a37c
mov edx, 0x10017f40
mov ecx, 0x100894c4
call fcn.10017fc0
add esp, 4
mov edx, 0x10017f80
mov ecx, 0x100894c8
push 0x1007a390
call fcn.10017fc0
add esp, 8
call fcn.1003aff0
test eax, eax
mov ecx, str.failed
mov esi, str.succeeded
mov edx, str.Detouring_transaction
cmovne esi, ecx
mov ecx, 0x100884f8
call fcn.10011ab0
mov edx, esi
mov ecx, eax
call fcn.10011ab0
mov dl, 0xa
mov ecx, eax
call fcn.100115f0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100182c1
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100182b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100182dc
push edx
push ecx
call fcn.1003c31e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c310
mov esp, ebp
pop ebp
ret
call fcn.100475cc
int3