Function at 0x100f0490
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10251377
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0x18
mov dword [ebp - 4], 0
call fcn.1006e6a7
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 4
mov dword [ebx + 0xc], eax
push eax
call esi
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
push 0x18
mov byte [ebp - 4], 3
call fcn.1006e6a7
add esp, 4
mov dword [ebx + 0x28], eax
push eax
call esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebx + 0x30], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebx + 0x34], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebx + 0x38], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebx + 0x3c], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebx + 0x40], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebx + 0x44], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebx + 0x48], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 0x4c], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebx + 0x50], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebx + 0x54], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebx + 0x58], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebx + 0x5c], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebx + 0x60], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebx + 0x64], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebx + 0x68], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebx + 0x6c], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebx + 0x2c], 0
mov dword [ebx + 0x70], eax
push str.advapi32.dll
mov dword [sym.WMCommon.dll_class_WM::GMRegHookHandler__WM::GMRegHookHandler::sm_regHookHandler], ebx
call esi
mov edi, eax
push str.kernel32.dll
mov dword [ebp - 0x14], edi
call esi
mov esi, eax
lea eax, [ebp - 0x124]
push 0x110
mov dword [ebp - 0x10], esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x124]
cmp eax, 5
ja 0x100f0641
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1026ff48
push edi
call esi
push 0x1026ff58
push edi
mov dword [ebx + 0x40], eax
call esi
push 0x1026ff28
push edi
mov dword [ebx + 0x44], eax
call esi
push 0x1026ff38
push edi
mov dword [ebx + 0x38], eax
call esi
jmp 0x100f06c7
cmp eax, 6
jb 0x100f0693
jne 0x100f0651
cmp dword [ebp - 0x120], 2
jbe 0x100f0693
push str.KernelBase.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x1026ff48
push edi
call esi
push 0x1026ff58
push edi
mov dword [ebx + 0x40], eax
call esi
push 0x1026ff28
push dword [ebp - 0x14]
mov dword [ebx + 0x44], eax
call esi
push 0x1026ff38
push dword [ebp - 0x14]
mov dword [ebx + 0x38], eax
call esi
jmp 0x100f06c7
push 0x1026ff48
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
push 0x1026ff58
push dword [ebp - 0x10]
mov dword [ebx + 0x40], eax
call esi
push 0x1026ff28
push edi
mov dword [ebx + 0x44], eax
call esi
push 0x1026ff38
push edi
mov dword [ebx + 0x38], eax
call esi
mov edi, dword [ebp - 0x10]
push 0x1026ff90
push edi
mov dword [ebx + 0x3c], eax
call esi
push 0x1026ffa0
push edi
mov dword [ebx + 0x48], eax
call esi
push 0x1026ff68
push edi
mov dword [ebx + 0x4c], eax
call esi
push 0x1026ff7c
push edi
mov dword [ebx + 0x58], eax
call esi
push 0x1026ffd0
push edi
mov dword [ebx + 0x5c], eax
call esi
push 0x1026ffe0
push edi
mov dword [ebx + 0x60], eax
call esi
push 0x1026ffb0
push edi
mov dword [ebx + 0x64], eax
call esi
push 0x1026ffc0
push edi
mov dword [ebx + 0x68], eax
call esi
push 0x1026fff0
push edi
mov dword [ebx + 0x6c], eax
call esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebx + 0x70], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret