Function at 0x108a1c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0xcc], 1
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov dword [rcx + 0x50], edi
mov qword [rcx + 0x58], rdi
mov dword [rcx + 0x60], edi
mov dword [rcx + 0x64], edi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0x78], rdi
mov qword [rcx + 0x80], rdi
mov qword [rcx + 0x88], rdi
mov qword [rcx + 0xa0], rdi
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xb0], rdi
mov qword [rcx + 0xb8], rdi
mov qword [rcx + 0xc0], rdi
mov dword [rcx + 0xc8], edi
mov dword [rcx + 0xd0], edi
mov dword [rcx + 0xd4], edi
lea r9, [0x01083a20]
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01083a38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01083a50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01083a70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01083a90]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [0x010c22e8], edi
mov dword [rbx + 0x64], 1
mov qword [rbx + 0x48], rax
je 0x108a369
lea rcx, [0x01083ab0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x010c227c], eax
add eax, 0xffff4000
cmp eax, 0x3fff
ja 0x108a313
lea rdx, [0x01083ae0]
xor ecx, ecx
call fcn.010875cc
jmp 0x108a32a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01083b80]
xor ecx, ecx
mov r8d, eax
call fcn.010875cc
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call fcn.0108a460
mov r8d, dword [rsp + 0x40]
cmp r8d, edi
je 0x108a361
lea rdx, [0x01083c30]
xor ecx, ecx
call fcn.010875cc
mov r11d, dword [rsp + 0x40]
mov dword [rbx + 0xcc], r11d
cmp dword [0x010c22e8], edi
jne 0x108a375
cmp dword [0x010c22e4], edi
je 0x108a449
cmp dword [0x010c22b0], 6
jne 0x108a449
cmp dword [0x010c22b4], 1
jne 0x108a449
cmp qword [0x010c2338], rdi
jne 0x108a449
lea rdx, [0x01083c70]
mov ecx, 0x1d
call fcn.010875cc
lea r8, [rsp + 0x50]
lea rdx, [0x01082528]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x108a417
lea rax, [rsp + 0x40]
lea rdx, [0x01083cc0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x108a417
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.0108add8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0x78]
cmp r11, rdi
je 0x108a449
lea rcx, [0x01083ce8]
xor r8d, r8d
xor edx, edx
call r11
mov qword [0x010c2338], rax
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret