Function at 0x1000110f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, r9
mov rdi, r8
mov rsi, rdx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x44], 0x208
lea rcx, [rsp + 0x30]
call fcn.1000133ec
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x100022793
cmp dword [rsp + 0x40], 1
jne 0x100022793
mov bl, 1
jmp 0x100011187
lea rcx, [rsp + 0x30]
call fcn.1000012b0
mov r13d, 8
cmp bl, r12b
je 0x10001124f
mov word [rsp + 0x266], r12w
cmp word [rsp + 0x60], r12w
je 0x1000227b5
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1000036b8
nop
lea rcx, [rsp + 0x30]
call fcn.100001680
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x38]
call fcn.1000133ec
nop
lea rcx, [rsp + 0x38]
call fcn.100001680
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.100010d80
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.100011498
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], r13w
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x10002279b
lea rcx, [rsp + 0x38]
call fcn.1000012b0
nop
lea rcx, [rsp + 0x30]
call fcn.1000012b0
cmp word [rsp + 0x60], r12w
je 0x1000227b5
mov dword [rsp + 0x44], 0x208
lea rcx, [rsp + 0x30]
call fcn.100005860
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1000227bc
cmp dword [rsp + 0x40], 1
jne 0x1000227bc
mov bl, 1
jmp 0x1000112ad
lea rcx, [rsp + 0x30]
call fcn.1000012b0
cmp bl, r12b
je 0x10001136f
mov word [rsp + 0x266], r12w
cmp word [rsp + 0x60], r12w
je 0x10001136f
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1000036b8
nop
lea rcx, [rsp + 0x38]
call fcn.100001680
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x30]
call fcn.100005860
nop
lea rcx, [rsp + 0x30]
call fcn.100001680
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.100010d80
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.100011498
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], r13w
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x1000227c4
lea rcx, [rsp + 0x30]
call fcn.1000012b0
nop
lea rcx, [rsp + 0x38]
call fcn.1000012b0
mov dword [rsp + 0x44], 4
lea rcx, [rsp + 0x30]
call fcn.100005834
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1000227df
cmp dword [rsp + 0x40], 4
jne 0x1000227df
mov bl, 1
jmp 0x1000113c1
lea rcx, [rsp + 0x30]
call fcn.1000012b0
cmp bl, r12b
je 0x100011466
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1000036b8
nop
lea rcx, [rsp + 0x38]
call fcn.100001680
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x30]
call fcn.100005834
nop
lea rcx, [rsp + 0x30]
call fcn.100001680
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
mov edi, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.100010d80
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.100011498
mov rbx, rax
mov esi, reloc.OLEAUT32.dll_SafeArrayGetLBound
cmp word [rax], si
je 0x10001144e
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], si
mov dword [rbx + 8], edi
lea rcx, [rsp + 0x30]
call fcn.1000012b0
nop
lea rcx, [rsp + 0x38]
call fcn.1000012b0
mov al, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100001100
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov bl, r12b
jmp 0x100011187
lea ecx, [r13 + 2]
mov word [rbx], cx
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242ec
nop
jmp 0x100023e96
xor al, al
jmp 0x100011468
mov bl, r12b
jmp 0x1000112ad
mov ecx, 0xa
mov word [rbx], cx
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242ec
nop
jmp 0x100023e97
mov bl, r12b
jmp 0x1000113c1