Function at 0x10901e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
and qword [rax - 0x38], 0
and dword [rax + 0x10], 0
mov rsi, rcx
lea r8, [rax - 0x38]
lea rdx, [0x010823e8]
mov r15d, 4
mov rcx, 0xffffffff80000002
mov dword [rax + 0x18], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x40]
lea ebx, [r15 - 2]
test rcx, rcx
lea r12d, [r15 - 3]
je 0x1090737
lea rax, [rsp + 0x90]
lea rdx, [0x01083478]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x109072c
mov r8d, dword [rsp + 0x88]
lea ebp, [rbx + 0x1c]
lea rdx, [0x010834a0]
or dword [rsi], r8d
mov ecx, ebp
call fcn.01091f4c
mov r8d, dword [rsi]
lea rdx, [0x01083500]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], r12b
je 0x10902af
lea rdx, [0x01082d60]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], bl
je 0x10902c1
lea rdx, [0x01082db0]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0x18
jae 0x10902d5
lea rdx, [0x01082e10]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0x1c
jae 0x10902e9
lea rdx, [0x01082e90]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0x1d
jae 0x10902fd
lea rdx, [0x01082ef0]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], 0x10
je 0x1090310
lea rdx, [0x01082f38]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], 0x20
je 0x1090323
lea rdx, [0x01082f80]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], 0x40
je 0x1090336
lea rdx, [0x01082fd0]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], 0x80
je 0x109034e
lea rdx, [0x01083020]
mov ecx, ebp
call fcn.01091f4c
call fcn.01090fdc
bt dword [rsi], 8
jae 0x1090367
lea rdx, [0x01083070]
mov ecx, ebp
call fcn.01091f4c
call fcn.0109113c
test byte [rsi], r15b
je 0x109037a
lea rdx, [0x010830b0]
mov ecx, ebp
call fcn.01091f4c
test byte [rsi], 8
je 0x1090394
lea rdx, [0x01083108]
mov ecx, ebp
call fcn.01091f4c
mov dword [0x010e53a0], r12d
bt dword [rsi], 0x10
jae 0x10903af
lea rdx, [0x01083580]
mov ecx, ebp
call fcn.01091f4c
mov dword [0x010e53b0], r12d
bt dword [rsi], 0x11
jae 0x10903ca
lea rdx, [0x010835c0]
mov ecx, ebp
call fcn.01091f4c
mov dword [0x010e53b4], r12d
bt dword [rsi], 0x12
jae 0x10903e5
lea rdx, [0x01083620]
mov ecx, ebp
call fcn.01091f4c
mov dword [0x010e53bc], r12d
bt dword [rsi], 9
jae 0x10903f9
lea rdx, [0x01083150]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0xb
jae 0x109040d
lea rdx, [0x01083670]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0xc
jae 0x1090421
lea rdx, [0x010836d0]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0xd
jae 0x1090435
lea rdx, [0x01083750]
mov ecx, ebp
call fcn.01091f4c
bt dword [rsi], 0xe
jae 0x1090450
lea rdx, [0x010837d0]
mov ecx, ebp
call fcn.01091f4c
mov dword [0x010e53a8], r12d
bt dword [rsi], 0xa
jae 0x109062c
lea rdx, [0x010831c0]
mov ecx, ebp
call fcn.01091f4c
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x30], 0
and dword [rsp + 0x98], 0
lea rax, [rsp + 0x90]
lea rdx, [0x01083810]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1090523
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083840]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1090523
mov ebx, dword [rsp + 0x30]
mov edi, dword [rsp + 0x98]
lea rdx, [0x0108c8a0]
lea ecx, [rax + 0x1d]
mov r8d, ebx
call fcn.01091f4c
lea rdx, [0x0108c900]
mov r8d, edi
mov ecx, 0x1d
call fcn.01091f4c
mov dword [0x010d8fe0], ebx
mov dword [0x010d8fe4], edi
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x34], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [0x01083870]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1090583
mov ebx, dword [rsp + 0x34]
test ebx, ebx
je 0x1090583
lea rdx, [0x0108c960]
lea ecx, [rax + 0x1d]
mov r8d, ebx
call fcn.01091f4c
mov dword [0x010d8fec], ebx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083890]
mov qword [rsp + 0x28], rax
lea rax, [0x010d9090]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x010d9090]
mov edx, 0x1f40
test eax, eax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x90], r15d
cmovne ecx, edx
and dword [rsp + 0x38], 0
mov qword [rsp + 0x28], rax
mov dword [0x010d9090], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x010838a8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 2
test eax, eax
jne 0x109062c
mov eax, dword [0x010e5370]
cmp dword [rsp + 0x38], 0
cmovne eax, r12d
mov dword [0x010e5370], eax
bt dword [rsi], 0x1e
mov eax, dword [0x010e5378]
cmovb eax, r12d
bt dword [rsi], 0x13
mov dword [0x010e5378], eax
mov eax, dword [0x010e537c]
cmovb eax, r12d
bt dword [rsi], 0x1f
mov dword [0x010e537c], eax
jae 0x109066f
lea rdx, [0x010838d0]
mov ecx, ebp
mov dword [0x010e5398], r12d
call fcn.01091f4c
bt dword [rsi], 0xf
jae 0x109068a
lea rdx, [0x01083920]
mov ecx, ebp
mov dword [0x010e53ac], r12d
call fcn.01091f4c
bt dword [rsi], 0x14
jae 0x10906a5
lea rdx, [0x01083980]
mov ecx, ebp
mov dword [0x010e53c0], r12d
call fcn.01091f4c
bt dword [rsi], 0x15
jae 0x10906c0
lea rdx, [0x01083a10]
mov ecx, ebp
mov dword [0x010e53c4], r12d
call fcn.01091f4c
bt dword [rsi], 0x16
jae 0x10906db
lea rdx, [0x01083a70]
mov ecx, ebp
mov dword [0x010e53c8], r12d
call fcn.01091f4c
bt dword [rsi], 0x19
jae 0x10906f6
lea rdx, [0x01083ad0]
mov ecx, ebp
mov dword [0x010e53d0], r12d
call fcn.01091f4c
bt dword [rsi], 0x1a
jae 0x1090711
lea rdx, [0x01083b50]
mov ecx, ebp
mov dword [0x010e53d4], r12d
call fcn.01091f4c
bt dword [rsi], 0x17
jae 0x109072c
lea rdx, [0x01083ba0]
mov ecx, ebp
mov dword [0x010e53d8], r12d
call fcn.01091f4c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
lea rdx, [0x01083c10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10909b8
lea rax, [rsp + 0x90]
lea rdx, [0x01083c50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10907a3
cmp dword [rsp + 0x88], eax
je 0x10909ad
mov dword [0x010e5380], r12d
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083c70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10907f8
mov eax, dword [rsp + 0x88]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010e5384], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083c90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x109084d
mov eax, dword [rsp + 0x88]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010e5388], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083cc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10908a2
mov eax, dword [rsp + 0x88]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010e538c], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083cf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1090900
test byte [rsp + 0x88], r12b
je 0x1090900
mov eax, dword [0x010e539c]
test byte [rsp + 0x88], bl
mov dword [0x010e5390], r12d
cmovne eax, r12d
mov dword [0x010e539c], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083d08]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x109095f
cmp dword [rsp + 0x88], r12d
jne 0x1090949
mov dword [0x010e5394], r12d
jmp 0x109095f
mov eax, dword [0x010e5394]
cmp dword [rsp + 0x88], ebx
cmove eax, ebx
mov dword [0x010e5394], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x90]
lea rdx, [0x01083d20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10909ad
mov eax, dword [0x010e53a4]
cmp dword [rsp + 0x88], 0
cmovne eax, r12d
mov dword [0x010e53a4], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret