Function at 0x100e6400
Capabilities:
Check for peb ntglobalflag flag
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101250e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1016e750]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x1016f5d0]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [0x1017045d], 0
mov dword [esp + 0x54], eax
je 0x100e649f
test al, 1
je 0x100e64b9
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x2c]
push dword [esp + 0x20]
push edi
push dword [esp + 0x20]
push esi
push ebx
call dword [0x10172944]
jmp 0x100e6ac5
or eax, 1
push eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
mov edx, ebx
call fcn.100e8600
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100e6541
cmp dword [ebx + 0x3c], 0
je 0x100e6514
test esi, esi
jne 0x100e6514
push ecx
mov eax, esp
push dword [esp + 0x20]
push esi
push dword [ebx + 0x20]
push dword [esp + 0x24]
push str.KeyValueInformationClass_d__Key_s__Index_d__InfoLength_d
push eax
call fcn.10044f30
add esp, 0x18
call fcn.100e5f30
add esp, 4
jmp 0x100e6514
mov esi, dword [esp + 0x30]
test ebx, ebx
je 0x100e6541
mov edx, dword [esp + 0x58]
mov ecx, dword [ebx + 0x38]
call fcn.100e88f0
cmp dword [ebx + 0x30], 0xffffffff
mov esi, eax
mov eax, dword [esp + 0x40]
mov ecx, 1
cmove eax, ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x40], eax
mov dword [ebx + 0x30], esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x2c]
push dword [esp + 0x20]
push edi
push dword [esp + 0x20]
push esi
push dword [esp + 0x3c]
call dword [0x10172944]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
test edx, edx
je 0x100e6582
cmp edx, 1
jne 0x100e6a49
test esi, esi
js 0x100e6a49
test edi, edi
je 0x100e6a49
test ebx, ebx
je 0x100e6a49
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x100e6a49
mov ecx, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x10]
je 0x100e6a4d
test eax, eax
jne 0x100e69db
mov eax, edx
sub eax, 0
je 0x100e65d3
dec eax
jne 0x100e6a5f
lea esi, [edi + 0x14]
mov edi, dword [edi + 0x10]
jmp 0x100e65d9
lea esi, [edi + 0xc]
mov edi, dword [edi + 8]
xor eax, eax
mov word [esp + 0x48], di
mov dword [esp + 0x4a], eax
mov word [esp + 0x4e], ax
mov word [esp + 0x4a], di
mov dword [esp + 0x18], esi
mov dword [esp + 0x4c], esi
shr edi, 1
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x100e69d1
test esi, esi
jne 0x100e661a
test edi, edi
jne 0x100e6998
mov eax, dword [edx]
mov ecx, edx
push 2
push edi
call dword [eax]
test eax, eax
je 0x100e69cc
lea esi, [eax + 0x10]
mov dword [esp + 0x34], esi
test edi, edi
js 0x100e6998
cmp edi, dword [esi - 8]
jg 0x100e6998
lea eax, [edi + edi]
mov dword [esi - 0xc], edi
push eax
push dword [esp + 0x1c]
xor ecx, ecx
push eax
push esi
mov word [eax + esi], cx
call fcn.10103d20
add esp, 0xc
mov dword [esp + 0x8c], 0
mov ecx, esp
mov dword [esp + 0x68], esp
push 0x1012ec40
call fcn.10023fc0
mov byte [esp + 0x8c], 1
lea edi, [esi - 0x10]
push ecx
mov ecx, dword [edi]
mov dword [esp + 0x68], esp
mov dword [esp + 0x28], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x100e66b0
cmp ecx, dword [edi]
jne 0x100e66b0
mov ecx, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x100e66f4
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [esp + 0x20], edx
test edx, edx
je 0x100e69cc
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.10103d20
mov ecx, dword [esp + 0x30]
add esp, 0x10
lea eax, [ecx + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
push ecx
mov byte [esp + 0x94], 2
mov ecx, esp
push dword [ebx + 0x20]
call fcn.10023fc0
lea ecx, [esp + 0x68]
mov byte [esp + 0x94], 0
call fcn.10044c80
add esp, 0xc
mov byte [esp + 0x88], 3
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x100e677f
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x100e676e
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x100e676e
call fcn.10024750
mov dword [esp + 0x20], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x100e6765
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x20]
lea esi, [eax + 0x10]
mov dword [esp + 0x34], esi
jmp 0x100e677f
push dword [edx - 0xc]
lea ecx, [esp + 0x38]
push edx
call fcn.10024680
mov esi, dword [esp + 0x34]
mov byte [esp + 0x88], 0
or ecx, 0xffffffff
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100e67a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, esi
lea ecx, [esp + 0x38]
call fcn.1003dbd0
mov byte [esp + 0x88], 4
mov eax, dword [0x10173394]
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0x18], 0
test eax, eax
je 0x100e67e4
lea edx, [esp + 0x18]
push edx
push 0x10
lea edx, [esp + 0x70]
push edx
push 0
lea edx, [esp + 0x58]
push edx
push ecx
call eax
jmp 0x100e67fe
lea eax, [esp + 0x18]
push eax
push 0x10
lea eax, [esp + 0x70]
push eax
push 0
lea eax, [esp + 0x58]
push eax
push ecx
call dword [0x101746b8]
test eax, eax
je 0x100e6814
cmp eax, reloc.OLEAUT32.dll_SysFreeString
je 0x100e6814
cmp eax, 0xc0000004
je 0x100e6814
xor al, al
jmp 0x100e6816
mov al, 1
push str._VAL_
lea edx, [esp + 0x3c]
movzx edi, al
lea ecx, [esp + 0x48]
call fcn.10026820
add esp, 4
mov byte [esp + 0x88], 5
mov edx, 1
mov ecx, dword [esp + 0x44]
call fcn.10029a80
test eax, eax
je 0x100e6883
mov ecx, dword [eax]
push eax
mov dword [esp + 0x24], ecx
call fcn.10103713
mov byte [esp + 0x8c], 4
add esp, 4
mov edx, dword [esp + 0x44]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100e687d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x20]
jmp 0x100e68ab
mov byte [esp + 0x88], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x44]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100e68a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
test al, 2
je 0x100e6901
push dword [esp + 0x38]
lea eax, [esp + 0x54]
push str.Hiding_deleted_Value_during_enumeration:__s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x88], 6
mov ecx, 0x1015475c
mov edx, dword [eax]
call fcn.10043b30
mov byte [esp + 0x88], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x50]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100e6909
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100e6909
test edi, edi
je 0x100e69a2
mov edx, dword [esp + 0x28]
push 0
call fcn.100e8600
mov edi, eax
add esp, 4
test edi, edi
je 0x100e6940
push 8
call fcn.10104809
mov ecx, dword [esp + 0x34]
add esp, 4
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0x38]
mov dword [eax], ecx
mov dword [edi + 0x38], eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0x88], 0
or ecx, 0xffffffff
mov edx, dword [esp + 0x38]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100e6966
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x88], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
mov edi, dword [esp + 0x3c]
test ecx, ecx
jg 0x100e6510
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100e6510
push 0x80070057
call fcn.100223c0
lea ecx, [esp + 0x38]
call fcn.10024080
lea ecx, [esp + 0x34]
mov dword [esp + 0x88], 0xffffffff
call fcn.10024080
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x3c]
jmp 0x100e6a5f
call fcn.10024740
push 0x80004005
call fcn.100223c0
cmp eax, 0x8000001a
jne 0x100e6a4d
mov eax, dword [esp + 0x40]
test eax, eax
je 0x100e6a03
test esi, esi
je 0x100e6a03
cmp dword [ebx + 0x28], 0xffffffff
jne 0x100e6a03
lea eax, [esp + 0x60]
xor edx, edx
push eax
call fcn.100e7580
add esp, 4
mov eax, dword [ebx + 0x28]
cmp eax, 0xffffffff
je 0x100e6a0f
cmp esi, eax
jae 0x100e6a12
mov dword [ebx + 0x28], esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x2c]
sub esi, dword [ebx + 0x28]
push dword [esp + 0x20]
mov eax, dword [ebx + 0x3c]
push edi
push dword [esp + 0x20]
mov dword [esp + 0x38], eax
push esi
push eax
call dword [0x10172944]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x100e6a5f
cmp eax, reloc.OLEAUT32.dll_SysFreeString
je 0x100e6a5f
cmp eax, 0xc0000023
jne 0x100e6a99
test ebx, ebx
je 0x100e6aa7
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x100e6a99
mov ecx, dword [esp + 0x28]
cmp ecx, eax
jne 0x100e6a99
test edi, edi
je 0x100e6a99
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100e6a99
lea edx, [esp + 0x10]
push edx
push eax
push dword [esp + 0x24]
mov edx, esi
push edi
push dword [esp + 0x24]
push 0
call fcn.100e6340
add esp, 0x18
test ebx, ebx
je 0x100e6aa7
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esp + 0x54]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10103392
mov esp, ebp
pop ebp
ret 0x18