Function at 0x10a0f74
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov qword [rax - 0x58], rbx
mov qword [rax + 0x20], rbx
mov rsi, rbx
mov qword [rax - 0x40], rbx
mov rdi, rbx
mov qword [rax - 0x50], rbx
lea r15d, [rbx + 0x28]
mov qword [rax - 0x48], rbx
mov r14d, ebx
mov dword [rax + 0x10], ebx
lea r13d, [rbx + 1]
lea ecx, [rbx + 0x10]
call fcn.010a36c8
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, rbx
je 0x10a11fa
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 9]
xor r8d, r8d
lea rdx, [0x010996a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10a11fa
cmp rdi, rbx
jne 0x10a102d
lea ecx, [r15 + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.010a36c8
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
je 0x10a11fa
jmp 0x10a1035
add r14d, r13d
mov dword [rsp + 0x44], r14d
cmp rsi, rbx
je 0x10a104b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x10a1066
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov dword [rsp + 0xc0], r15d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xc0]
mov r8, rdi
mov edx, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x10a10c8
mov rcx, rdi
call fcn.010a35a4
mov rdi, rbx
mov qword [rsp + 0x58], rbx
mov r15d, dword [rsp + 0xc0]
add r15d, 1
mov dword [rsp + 0x48], r15d
jmp 0x10a0ff6
cmp eax, 0x103
je 0x10a11fa
cmp eax, ebx
jne 0x10a11fa
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10a0ff6
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x01099678]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10a0ff6
cmp dword [rsp + 0xb0], 4
jne 0x10a0ff6
mov ecx, ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [r12]
and eax, 0xf
sub eax, r13d
je 0x10a1183
cmp eax, 7
je 0x10a1183
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, ebx
jne 0x10a0ff6
mov dword [rsp + 0xb0], 3
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x01099690]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10a0ff6
cmp dword [rsp + 0xb0], 3
jne 0x10a0ff6
cmp dword [rsp + 0xb8], 0x10
jne 0x10a0ff6
mov r13d, ebx
cmp rdi, rbx
je 0x10a1207
mov rcx, rdi
call fcn.010a35a4
cmp r12, rbx
je 0x10a1214
mov rcx, r12
call fcn.010a35a4
cmp rsi, rbx
je 0x10a1222
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x10a123d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x10a124d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13d, ebx
sete bl
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret