Function at 0x106c4c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x0109d1a0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebx, ebx
test rdx, rdx
mov r12, rdx
mov rsi, rcx
je 0x106c890
lea r13, [rcx + 0xb4c]
lea rax, [rsp + 0x30]
lea rdx, [0x01067540]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r14d, r14d
cmp dword [r13], ebx
jle 0x106c888
lea rbp, [rsi + 0xa3e]
add r14d, 1
lea r8, [0x01067558]
lea rcx, [rsp + 0xa0]
mov r9d, r14d
mov edx, 0x20
call fcn.0107e7ac
and word [rsp + 0x2a0], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x106c874
lea ebx, [rax + 1]
mov rdi, rbp
lea r15d, [rax + 2]
lea r8, [0x01067568]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x34]
mov eax, r11d
mov edx, r11d
and r11d, 0xff0f
and eax, 0x80
and edx, 0xffff0000
mov dword [rsp + 0x34], r11d
mov dword [rsp + 0x48], eax
xor ecx, ecx
mov eax, 0x10000
shl eax, cl
test edx, eax
je 0x106c624
mov eax, ecx
shl eax, 4
or r11d, eax
xor edx, edx
add ecx, 1
cmp ecx, 0xa
jl 0x106c60f
lea r8, [0x01067580]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x34], r11d
mov word [rdi - 2], r11w
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x48], 0
movzx r11d, word [rsp + 0x34]
mov word [rdi], r11w
jne 0x106c770
lea r8, [0x01067590]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106c700
mov eax, dword [rsp + 0x34]
shr eax, 8
jmp 0x106c772
lea r8, [0x010675a8]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x34]
cvtsi2ss xmm0, r11
divss xmm0, dword [0x01068584]
call fcn.0108e730
movzx eax, ax
jmp 0x106c772
xor eax, eax
lea r8, [0x010675c0]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x34], eax
mov word [rdi + 2], ax
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106c7db
mov edx, dword [rsp + 0x38]
sar edx, 8
jmp 0x106c84a
lea r8, [0x010675d8]
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov edx, 0x20
mov dword [rsp + 0x30], 4
call fcn.0107e7ac
mov rcx, qword [rsp + 0x40]
and word [rsp + 0x90], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x38]
shl r11d, 8
mov eax, 0x51eb851f
imul r11d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov word [rdi + 4], dx
add rdi, 8
add ebx, 1
sub r15, 1
mov dword [rsp + 0x38], edx
jne 0x106c593
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ebx, [r15 + 1]
jmp 0x106c876
xor ebx, ebx
add rbp, 0x10
cmp r14d, dword [r13]
jl 0x106c542
test ebx, ebx
jne 0x106c890
mov rcx, rsi
call fcn.0106c8c4
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.0107dbd0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret