Function at 0x1075d48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0x124], 1
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov dword [rcx + 0x50], edi
mov qword [rcx + 0x58], rdi
mov dword [rcx + 0x60], edi
mov dword [rcx + 0x64], edi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov qword [rcx + 0xd8], rdi
mov qword [rcx + 0xf0], rdi
mov qword [rcx + 0xf8], rdi
mov qword [rcx + 0x100], rdi
mov qword [rcx + 0x108], rdi
mov qword [rcx + 0x110], rdi
mov qword [rcx + 0x118], rdi
mov dword [rcx + 0x120], edi
mov dword [rcx + 0x128], edi
mov dword [rcx + 0x12c], edi
mov dword [rcx + 0x134], edi
mov dword [rcx + 0x138], edi
lea r9, [0x01067b50]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01067b68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01067b80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01067ba0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01067bc0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [0x010aaf7c], edi
mov dword [rbx + 0x64], 1
mov qword [rbx + 0x48], rax
je 0x1075ebb
lea rcx, [0x01067be0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
mov dword [0x010aaf00], eax
call fcn.010766c8
mov r11d, dword [rsp + 0x40]
cmp r11d, edi
je 0x1075eb3
mov dword [rbx + 0x124], r11d
cmp dword [0x010aaf7c], edi
jne 0x1075ec7
cmp dword [0x010aaf78], edi
je 0x1075f8d
cmp dword [0x010aaf34], 6
jne 0x1075f8d
cmp dword [0x010aaf38], 1
jne 0x1075f8d
cmp qword [0x010aafe8], rdi
jne 0x1075f8d
lea r8, [rsp + 0x50]
lea rdx, [0x01067c10]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x1075f58
lea rax, [rsp + 0x40]
lea rdx, [0x01067c38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x1075f58
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.01076fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0xc8]
cmp r11, rdi
je 0x1075f8d
lea rcx, [0x01067c60]
xor r8d, r8d
xor edx, edx
call r11
mov qword [0x010aafe8], rax
lea rdx, [rsp + 0x40]
lea rcx, str._VREXT
mov dword [rsp + 0x40], 0xff
call fcn.01078cc4
mov r11d, dword [rsp + 0x40]
lea rcx, [rbx + 0x78]
mov dword [rbx + 0x130], r11d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret