Function at 0x106a6bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
sub rsp, 0x50
and qword [rax - 0x28], 0
and dword [rax + 0x10], 0
mov rbx, rcx
lea r8, [rax - 0x28]
lea rdx, [0x010668e8]
mov ebp, 4
mov rcx, 0xffffffff80000002
mov dword [rax + 0x18], ebp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x40]
lea esi, [rbp - 3]
test rcx, rcx
je 0x106aa70
lea rax, [rsp + 0x80]
lea rdx, [0x01066b50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106aa12
mov eax, dword [rsp + 0x78]
or dword [rbx], eax
test byte [rbx], 0x80
je 0x106a745
call fcn.0106b17c
bt dword [rbx], 8
jae 0x106a750
call fcn.0106b27c
test byte [rbx], 8
mov eax, dword [0x010aafa0]
cmovne eax, esi
bt dword [rbx], 0x10
mov dword [0x010aafa0], eax
mov eax, dword [0x010aafb4]
cmovb eax, esi
bt dword [rbx], 0x11
mov dword [0x010aafb4], eax
mov eax, dword [0x010aafb8]
cmovb eax, esi
bt dword [rbx], 0x12
mov dword [0x010aafb8], eax
mov eax, dword [0x010aafc0]
cmovb eax, esi
bt dword [rbx], 0xe
mov dword [0x010aafc0], eax
mov eax, dword [0x010aafa8]
cmovb eax, esi
bt dword [rbx], 0xa
mov dword [0x010aafa8], eax
jae 0x106a941
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x88], 0
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x80]
lea rdx, [0x01066b70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106a84c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066ba0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106a84c
mov eax, dword [rsp + 0x88]
mov dword [0x0109efe0], eax
mov eax, dword [rsp + 0x30]
mov dword [0x0109efe4], eax
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x34], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [0x01066bd0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106a8a0
mov eax, dword [rsp + 0x34]
mov ecx, dword [0x0109efec]
test eax, eax
cmovne ecx, eax
mov dword [0x0109efec], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066bf0]
mov qword [rsp + 0x28], rax
lea rax, [0x0109f07c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x0109f07c]
mov edx, 0x1f40
test eax, eax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], ebp
cmovne ecx, edx
and dword [rsp + 0x38], 0
mov qword [rsp + 0x28], rax
mov dword [0x0109f07c], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x01066c08]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106a941
mov eax, dword [0x010aaf70]
cmp dword [rsp + 0x38], 0
cmovne eax, esi
mov dword [0x010aaf70], eax
bt dword [rbx], 0x1e
mov eax, dword [0x010aaf78]
cmovb eax, esi
bt dword [rbx], 0x13
mov dword [0x010aaf78], eax
mov eax, dword [0x010aaf7c]
cmovb eax, esi
bt dword [rbx], 0x1f
mov dword [0x010aaf7c], eax
mov eax, dword [0x010aaf98]
cmovb eax, esi
bt dword [rbx], 0xf
mov dword [0x010aaf98], eax
mov eax, dword [0x010aafac]
cmovb eax, esi
bt dword [rbx], 0x14
mov dword [0x010aafac], eax
mov eax, dword [0x010aafc4]
cmovb eax, esi
bt dword [rbx], 0x15
mov dword [0x010aafc4], eax
mov eax, dword [0x010aafc8]
cmovb eax, esi
bt dword [rbx], 0x16
mov dword [0x010aafc8], eax
mov eax, dword [0x010aafcc]
cmovb eax, esi
bt dword [rbx], 0x19
mov dword [0x010aafcc], eax
mov eax, dword [0x010aafd4]
cmovb eax, esi
bt dword [rbx], 0x1a
mov dword [0x010aafd4], eax
mov eax, dword [0x010aafd8]
cmovb eax, esi
bt dword [rbx], 0x1b
mov dword [0x010aafd8], eax
mov eax, dword [0x010aafdc]
cmovb eax, esi
bt dword [rbx], 0x17
mov dword [0x010aafdc], eax
mov eax, dword [0x010aafe0]
cmovb eax, esi
mov dword [0x010aafe0], eax
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, [0x01066c28]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106aa65
mov eax, dword [0x010aafb0]
test byte [rsp + 0x78], sil
cmovne eax, esi
mov dword [0x010aafb0], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
lea rdx, [0x01066c48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x106acc0
lea rax, [rsp + 0x80]
lea rdx, [0x01066c88]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106aad5
cmp dword [rsp + 0x78], eax
je 0x106acb5
mov dword [0x010aaf80], esi
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066ca8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106ab24
mov eax, dword [rsp + 0x78]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010aaf84], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066cc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106ab73
mov eax, dword [rsp + 0x78]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010aaf88], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066cf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106abc2
mov eax, dword [rsp + 0x78]
shr eax, 0x10
movzx ecx, al
shr ax, 8
movzx eax, al
shl ecx, 8
add ecx, eax
mov dword [0x010aaf8c], ecx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066d28]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 2
test eax, eax
jne 0x106ac1a
test byte [rsp + 0x78], sil
je 0x106ac1a
mov eax, dword [0x010aaf9c]
test byte [rsp + 0x78], bl
mov dword [0x010aaf90], esi
cmovne eax, esi
mov dword [0x010aaf9c], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066d40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106ac6e
cmp dword [rsp + 0x78], esi
jne 0x106ac5b
mov dword [0x010aaf94], esi
jmp 0x106ac6e
mov eax, dword [0x010aaf94]
cmp dword [rsp + 0x78], ebx
cmove eax, ebx
mov dword [0x010aaf94], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea rdx, [0x01066d58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106acb5
mov eax, dword [0x010aafa4]
cmp dword [rsp + 0x78], 0
cmovne eax, esi
mov dword [0x010aafa4], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret