Function at 0x100ec480
Capabilities:
Get thread local storage value
Query or enumerate registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10125438
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [esp + 0x14], esi
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push str.COM_IsClassToVirtualize:_checking_if_CLSID_exists_in_HKLM_or_HKCU
push eax
mov dword [esp + 0x24], 0
call fcn.10044f30
add esp, 8
mov dword [esp + 0x40], 0
mov ecx, str.hkCOM
mov edx, dword [esp + 0x20]
call fcn.10043b30
mov dword [esp + 0x40], 0xffffffff
or edi, 0xffffffff
mov edx, dword [esp + 0x20]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100ec514
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Registry_CurrentUser_SoftwareClassesCLSID_
lea ecx, [esp + 0x24]
call fcn.10023fc0
push esi
mov edx, eax
mov dword [esp + 0x44], 1
lea ecx, [esp + 0x2c]
call fcn.10026820
add esp, 4
mov byte [esp + 0x40], 2
lea edx, [esp + 0x1c]
mov ecx, dword [eax]
push 0x20019
call fcn.100e4da0
mov byte [esp + 0x44], 1
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, edi
add edx, 0xfffffff0
mov dword [esp + 0x24], eax
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec577
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x40], 0xffffffff
mov ecx, edi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec59c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x24], 0
jge 0x100ec635
push str.RegistryMachineSoftwareClassesCLSID_
lea ecx, [esp + 0x24]
call fcn.10023fc0
push esi
mov edx, eax
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x2c]
call fcn.10026820
add esp, 4
mov byte [esp + 0x40], 4
lea edx, [esp + 0x1c]
mov ecx, dword [eax]
push 0x20019
call fcn.100e4da0
mov byte [esp + 0x44], 3
mov esi, eax
mov edx, dword [esp + 0x2c]
add esp, 4
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec608
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x40], 0xffffffff
mov ecx, edi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec62d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
js 0x100ec910
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100ec651
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x40], 5
push 0xa28
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0xa28
call fcn.10104809
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push str.COM_IsClassToVirtualize:_checking_if_CLSID_has_a_LocalServer32_executable_server
push eax
call fcn.10044f30
add esp, 8
mov byte [esp + 0x40], 6
mov ecx, str.hkCOM
mov edx, dword [esp + 0x20]
call fcn.10043b30
mov byte [esp + 0x40], 5
mov ecx, edi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec6cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1c]
push str.LocalServer32
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x100ec8d9
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push str.CLSID_s
push eax
call fcn.10036910
add esp, 0xc
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x20], eax
or eax, 1
push eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100ec765
push ecx
mov eax, esp
push dword [esp + 0x18]
push str._COM_conflict:_class_exists_in_both_virtual_and_real_registry:__s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100ec410
add esp, 4
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
push 0xa
push str._Embedding
call fcn.10024680
mov edx, dword [esp + 0x18]
test edx, edx
jne 0x100ec790
xor ecx, ecx
jmp 0x100ec7b1
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x2c], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ec7a0
sub ecx, dword [esp + 0x2c]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.10024680
push 0x1012fb2c
push 0x1012fb2c
mov ecx, ebx
call fcn.10024380
mov ecx, eax
call fcn.100243f0
push eax
mov ecx, ebx
call fcn.100244b0
mov eax, dword [esp + 0x20]
and eax, 0xfffffffe
push eax
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x1012ec60
lea ecx, [esp + 0x18]
call fcn.10023fc0
push 1
push ecx
mov ecx, esp
mov byte [esp + 0x48], 7
push dword [esp + 0x20]
call fcn.10023fc0
lea edx, [esp + 0x1c]
mov ecx, ebx
call fcn.1002bed0
add esp, 8
lea ecx, [esp + 0x14]
call fcn.10024250
mov ecx, eax
call fcn.100242d0
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x100ec842
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
call fcn.100244b0
mov byte [esp + 0x40], 5
mov ecx, edi
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec864
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x20]
push dword [0x1016f5d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jle 0x100ec8d1
push 0x7e
push eax
call fcn.101033a1
add esp, 8
test eax, eax
je 0x100ec8d1
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x100ec8d1
push ecx
mov eax, esp
push dword [ebx]
push str.COM_IsClassToVirtualize:_SFN_s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100ec410
add esp, 4
mov ecx, ebx
call fcn.10046cd0
push ecx
mov eax, esp
push dword [ebx]
push str.COM_IsClassToVirtualize:_LFN_s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100ec410
add esp, 4
mov dword [esp + 0x2c], 1
push dword [esp + 0x18]
call fcn.10103713
add esp, 4
push dword [esp + 0x1c]
call dword [0x10174f34]
add esi, 0xfffffff0
mov dword [esp + 0x40], 0xffffffff
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100ec910
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x24]
push ebx
push str.COM_IsClassToVirtualize:_result_d
push eax
call fcn.10044f30
add esp, 0xc
mov dword [esp + 0x40], 8
mov ecx, str.hkCOM
mov edx, dword [esp + 0x24]
call fcn.10043b30
mov dword [esp + 0x40], 0xffffffff
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x100ec960
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret