Function at 0x100d9d70
Capabilities:
Check os version
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10174b9a
mov eax, dword fs:[0]
push eax
sub esp, 0xb00
mov eax, dword [0x10206870]
xor eax, esp
mov dword [esp + 0xaf8], eax
push ebx
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0xb10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x108]
xor edi, edi
mov dword [esp + 0x90], esi
mov dword [esp + 0x80], edi
mov dword [esp + 0x60], eax
cmp eax, edi
je 0x100da9ee
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x1c]
mov dword [esp + 0x54], ebx
cmp ebx, edi
je 0x100da9ee
push 0x94
lea ecx, [esp + 0x470]
push edi
push ecx
mov dword [esi + 0x10c], 1
call fcn.1003f7d0
add esp, 0xc
lea edx, [esp + 0x46c]
push edx
mov dword [esp + 0x470], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.1007d480
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x470]
cmp eax, 6
jb 0x100d9e43
jne 0x100d9e49
cmp dword [esp + 0x474], 2
jae 0x100d9e49
mov dword [esi + 0x10c], edi
mov eax, dword [ebx + 0x9c]
cmp eax, edi
je 0x100da9ee
cmp dword [ebx + 0x94], edi
je 0x100da9ee
cmp dword [ebx + 0xa0], edi
je 0x100da9ee
cmp dword [ebx + 0x90], edi
je 0x100da9ee
cmp dword [ebx + 0x8c], edi
je 0x100da9ee
cmp dword [ebx + 0xa8], edi
je 0x100da9ee
cmp dword [ebx + 0xd0], edi
je 0x100da9ee
cmp dword [ebx + 0xd8], edi
je 0x100da9ee
cmp dword [ebx + 0xdc], edi
je 0x100da9ee
cmp dword [ebx + 0xe0], edi
je 0x100da9ee
cmp dword [ebx + 0xe4], edi
je 0x100da9ee
push 0x12
push 0
push 0
push 0x101f4ad8
call eax
mov edi, eax
mov dword [esp + 0x50], edi
cmp edi, 0xffffffff
je 0x100da9e5
mov ecx, dword [ebx + 0x8c]
lea eax, [esp + 0x3e4]
push eax
push 0
push 0x101f4ad8
push 0
push edi
mov dword [esp + 0x6c], 0
mov dword [esp + 0x3f8], 0x1c
call ecx
test eax, eax
je 0x100da9dc
mov ecx, dword [ebx + 0x94]
push 0
lea edx, [esp + 0x30]
push edx
push 0
push 0
lea eax, [esp + 0x3f4]
push eax
push edi
mov dword [esp + 0x3fc], 0x1c
mov dword [esp + 0x44], 0
call ecx
test eax, eax
jne 0x100da9b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100da9b2
mov edx, dword [esp + 0x2c]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [esp + 0x400]
push eax
mov dword [esi], 5
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [ebx + 0x94]
push edx
push esi
lea eax, [esp + 0x3f4]
push eax
push edi
mov dword [esp + 0x74], esi
mov dword [esp + 0x418], 0x1c
call ecx
test eax, eax
je 0x100da9ab
push 0x548
call fcn.1003ddbb
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0xb18], 0
test eax, eax
je 0x100d9fe0
push eax
call fcn.100e42f0
mov esi, eax
jmp 0x100d9fe2
xor esi, esi
mov edx, dword [esp + 0x58]
push 0xf003f
push 2
push 0
push 1
lea eax, [esp + 0x410]
mov dword [esp + 0xb28], 0xffffffff
push eax
mov dword [esi + 0x3d4], edx
mov ecx, dword [ebx + 0xa8]
push edi
call ecx
cmp eax, 0xffffffff
je 0x100da06d
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x508]
push ecx
push 0
push 2
push str.LevelZeroDriverPath
push 0
push eax
mov dword [esp + 0x30], 0x200
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x100da06d
push 0x200
call fcn.1003de3e
mov edx, dword [esp + 0x64]
add esp, 4
lea ecx, [esp + 0x504]
push ecx
push 0x200
push eax
mov dword [edx + 0x1c], eax
call fcn.1003dc98
add esp, 0xc
mov ecx, dword [ebx + 0xa0]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x414]
push eax
push edi
mov dword [esp + 0x30], 0
call ecx
test eax, eax
jne 0x100da0f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100da0f1
mov edx, dword [esp + 0x14]
push edx
call fcn.1003de3e
mov edx, dword [esp + 0x54]
add esp, 4
push 0
mov edi, eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [ebx + 0xa0]
push edi
push 0
push 0
lea ecx, [esp + 0x414]
push ecx
push edx
call eax
test eax, eax
je 0x100da0e8
push edi
lea ecx, [esi + 0x10]
push 0x100
push ecx
call fcn.1013b440
add esp, 0xc
push edi
call fcn.1003e211
add esp, 4
mov edi, dword [esp + 0x5c]
add edi, 4
push str.ven_
push edi
call fcn.1003de50
add esp, 8
test eax, eax
je 0x100da12b
lea edx, [esp + 0x18]
push edx
push str.ven__X
push eax
call fcn.1003e793
add esp, 0xc
test eax, eax
jle 0x100da12b
mov eax, dword [esp + 0x18]
mov dword [esi + 0x3f8], eax
push str.dev_
push edi
call fcn.1003de50
add esp, 8
test eax, eax
je 0x100da15e
lea ecx, [esp + 0x18]
push ecx
push str.dev__X
push eax
call fcn.1003e793
add esp, 0xc
test eax, eax
jle 0x100da15e
mov edx, dword [esp + 0x18]
mov dword [esi + 0x3fc], edx
push str.rev_
push edi
call fcn.1003de50
add esp, 8
test eax, eax
je 0x100da191
lea ecx, [esp + 0x18]
push ecx
push str.rev__X
push eax
call fcn.1003e793
add esp, 0xc
test eax, eax
jle 0x100da191
mov edx, dword [esp + 0x18]
mov dword [esi + 0x400], edx
push str.subsys_
push edi
call fcn.1003de50
add esp, 8
test eax, eax
je 0x100da1da
lea ecx, [esp + 0x18]
push ecx
push str.subsys__X
push eax
call fcn.1003e793
add esp, 0xc
test eax, eax
jle 0x100da1da
mov eax, dword [esp + 0x18]
mov edx, eax
and edx, 0xffff
sar eax, 0x10
and eax, 0xffff
mov dword [esi + 0x404], edx
mov dword [esi + 0x408], eax
push 0x200
lea eax, [esp + 0x708]
push eax
push 0xffffffffffffffff
push edi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebx + 0xd0]
lea edx, [esp + 0x64]
lea ecx, [esp + 0x704]
push edx
mov dword [esp + 0x68], ecx
call eax
test eax, eax
jne 0x100da97a
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x8c]
mov dword [esi + 0x3e4], ecx
mov edx, dword [esp + 0x70]
mov dword [esi + 0x3e8], edx
test eax, eax
je 0x100da27d
mov ecx, dword [ebx + 0xe4]
mov dword [esp + 0xb0], eax
lea eax, [esp + 0xb0]
push eax
call ecx
test eax, eax
jne 0x100da27d
mov edx, dword [esp + 0xbc]
cmp edx, dword [esi + 0x3e8]
jne 0x100da27d
mov eax, dword [esp + 0xb8]
cmp eax, dword [esi + 0x3e4]
jne 0x100da27d
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x3c8], 1
mov dword [ecx + 0x20], esi
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0xe0]
lea eax, [esp + 0xa0]
push ecx
mov dword [esp + 0x24], 6
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0xc
call edx
test eax, eax
jne 0x100da2dd
mov eax, dword [esp + 0xa0]
cmp eax, 0xffffffff
je 0x100da2dd
mov ecx, dword [esp + 0xa8]
mov dword [esi + 0x3ec], eax
mov eax, dword [esp + 0xa4]
mov dword [esi + 0x3f0], eax
mov dword [esi + 0x3f4], ecx
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0xe0]
lea eax, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 4
call edx
test eax, eax
jne 0x100da320
mov eax, dword [esp + 0x14]
mov dword [esi + 0x3ac], eax
mov ecx, dword [esp + 0x68]
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebx + 0xe0]
lea edx, [esp + 0x84]
mov edi, 8
push eax
mov dword [esp + 0x24], 0x12
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
call ecx
test eax, eax
jne 0x100da3a7
mov eax, dword [esp + 0x84]
movzx edx, ax
push edx
shr eax, 0x10
push eax
mov eax, dword [esp + 0x90]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
lea edx, [esi + 0x350]
push 0x20
push edx
call fcn.1013b440
add esp, 0x1c
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xe0]
lea ecx, [esp + 0x94]
push edx
mov dword [esp + 0x24], 0x31
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edi
call eax
push 0x320
lea ecx, [esp + 0xc8]
push 0
push ecx
call fcn.1003f7d0
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
add esp, 0xc
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc8], edx
mov edx, dword [ebx + 0xdc]
push ecx
mov dword [esp + 0xc8], 0
mov dword [esp + 0xd0], eax
call edx
test eax, eax
jne 0x100da938
mov eax, dword [esp + 0xd8]
mov dword [esi + 0x3dc], eax
mov ecx, dword [esp + 0xd4]
mov dword [esi + 0x3d8], ecx
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edx, 0x48
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003de3e
mov edi, eax
add esp, 4
mov dword [esp + 0xac], edi
mov dword [esp + 0xb18], 1
test edi, edi
je 0x100da486
mov eax, dword [esp + 0x14]
push 0x48
mov ebx, fcn.100031a0
mov ecx, edi
call fcn.100031d0
jmp 0x100da488
xor edi, edi
mov dword [esp + 0xb18], 0xffffffff
push 0x48
mov dword [esi + 0x420], edi
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100da4b0
mov ecx, eax
call fcn.100031a0
jmp 0x100da4b2
xor eax, eax
push 0x101c6c98
push 0x20
push eax
mov dword [esi + 0x424], eax
call fcn.1003dc98
xor ebx, ebx
add esp, 0xc
cmp dword [esi + 0x3dc], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x14], ebx
jle 0x100da82b
xor edi, edi
jmp 0x100da500
push 0x4e
lea eax, [esp + 0x420]
push 0
push eax
call fcn.1003f7d0
movzx ecx, byte [esp + 0x20]
mov edx, dword [esp + 0x74]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x428], ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x60]
lea eax, [esp + 0x428]
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0xe0]
push ecx
mov dword [esp + 0x24], 0x19
mov dword [esp + 0x2c], 0x4e
call eax
test eax, eax
jne case.default.0x100da58f
mov ecx, dword [esi + 0x420]
mov edx, dword [esp + 0x420]
mov dword [edi + ecx + 0x40], edx
mov eax, dword [esp + 0x420]
cmp eax, 8
ja case.default.0x100da58f
jmp dword [eax*4 + 0x100daa14]
test ebx, ebx
jne 0x100da5b8
mov eax, dword [esi + 0x420]
push 0x101c6c9c
add eax, edi
push 0x20
push eax
call fcn.1003dc98
add esp, 0xc
inc ebx
jmp case.default.0x100da58f
mov ecx, dword [esi + 0x420]
push ebx
push str.3D__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc ebx
jmp case.default.0x100da58f
cmp dword [esp + 0x34], 0
jne 0x100da5ff
mov edx, dword [esi + 0x420]
push str.Video_Decode
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x34]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x34]
mov ecx, dword [esi + 0x420]
push eax
push str.Video_Decode__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x34]
jmp case.default.0x100da58f
cmp dword [esp + 0x38], 0
jne 0x100da64d
mov edx, dword [esi + 0x420]
push str.Video_Encode
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x38]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x38]
mov ecx, dword [esi + 0x420]
push eax
push str.Video_Encode__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x38]
jmp case.default.0x100da58f
cmp dword [esp + 0x3c], 0
jne 0x100da69b
mov edx, dword [esi + 0x420]
push str.Video_Processing
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x3c]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x3c]
mov ecx, dword [esi + 0x420]
push eax
push str.Video_Processing__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x3c]
jmp case.default.0x100da58f
cmp dword [esp + 0x40], 0
jne 0x100da6e9
mov edx, dword [esi + 0x420]
push str.Scene_Assembly
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x40]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x40]
mov ecx, dword [esi + 0x420]
push eax
push str.Scene_Assembly__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x40]
jmp case.default.0x100da58f
cmp dword [esp + 0x44], 0
jne 0x100da737
mov edx, dword [esi + 0x420]
push str.Copy
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x44]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x44]
mov ecx, dword [esi + 0x420]
push eax
push str.Copy__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x44]
jmp case.default.0x100da58f
cmp dword [esp + 0x48], 0
jne 0x100da785
mov edx, dword [esi + 0x420]
push str.Overlay
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x48]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x48]
mov ecx, dword [esi + 0x420]
push eax
push str.Overlay__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x48]
jmp case.default.0x100da58f
cmp dword [esp + 0x4c], 0
jne 0x100da7cd
mov edx, dword [esi + 0x420]
push str.Crypto
add edx, edi
push 0x20
push edx
call fcn.1003dc98
add esp, 0xc
inc dword [esp + 0x4c]
jmp case.default.0x100da58f
mov eax, dword [esp + 0x4c]
mov ecx, dword [esi + 0x420]
push eax
push str.Crypto__d
add ecx, edi
push 0x20
push ecx
call fcn.1013b440
add esp, 0x10
inc dword [esp + 0x4c]
jmp case.default.0x100da58f
mov edx, dword [esi + 0x420]
push 0
push 0
push 0x20
add edx, edi
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x438]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
inc eax
add edi, 0x48
cmp eax, dword [esi + 0x3dc]
mov dword [esp + 0x14], eax
jl 0x100da500
xor edi, edi
cmp dword [esi + 0x3d8], edi
mov dword [esi + 0x418], edi
mov dword [esi + 0x41c], edi
mov dword [esi + 0x410], edi
mov dword [esi + 0x414], edi
jle 0x100da938
mov ebx, dword [esp + 0x54]
jmp 0x100da860
push 0x320
lea ecx, [esp + 0xc8]
push 0
push ecx
call fcn.1003f7d0
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
add esp, 0xc
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc8], edx
mov edx, dword [ebx + 0xdc]
push ecx
mov dword [esp + 0xc8], 3
mov dword [esp + 0xd0], eax
mov dword [esp + 0x3e0], edi
call edx
test eax, eax
jne 0x100da92b
mov eax, dword [esp + 0x90]
cmp dword [eax + 0x10c], 0
je 0x100da8ff
cmp dword [esp + 0xfc], 0
jne 0x100da8e9
mov ecx, dword [esp + 0xd4]
add dword [esi + 0x410], ecx
mov edx, dword [esp + 0xd8]
adc dword [esi + 0x414], edx
jmp 0x100da92b
mov eax, dword [esp + 0xd4]
add dword [esi + 0x418], eax
mov ecx, dword [esp + 0xd8]
jmp 0x100da925
mov eax, dword [esp + 0xd4]
xor ecx, ecx
cmp dword [esp + 0xf4], ecx
jne 0x100da91f
add dword [esi + 0x410], eax
adc dword [esi + 0x414], ecx
jmp 0x100da92b
add dword [esi + 0x418], eax
adc dword [esi + 0x41c], ecx
inc edi
cmp edi, dword [esi + 0x3d8]
jl 0x100da860
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0x74]
push edx
mov dword [esi + 0x438], eax
mov dword [esi + 0x43c], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov ebx, dword [esp + 0x54]
mov dword [esi + 0x428], eax
mov dword [esi + 0x42c], ecx
cmp dword [esi + 0x3ec], 0xffffffff
je 0x100da999
mov edi, dword [esp + 0x60]
call fcn.1007dd90
mov dword [esp + 0x80], 1
jmp 0x100da9a3
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x5c]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x58]
mov edx, dword [ebx + 0x8c]
lea ecx, [esp + 0x3e4]
push ecx
inc eax
push eax
push 0x101f4ad8
push 0
push edi
mov dword [esp + 0x6c], eax
call edx
test eax, eax
jne 0x100d9f20
mov eax, dword [ebx + 0x90]
push edi
call eax
mov eax, dword [esp + 0x80]
jmp 0x100da9f0
xor eax, eax
mov ecx, dword [esp + 0xb10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xaf8]
xor ecx, esp
call fcn.1003dc89
mov esp, ebp
pop ebp
ret