Function at 0x106cca0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [0x0109d1a0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor esi, esi
mov edi, r8d
mov r12d, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rcx + 0xb68], rsi
mov rbx, rcx
call fcn.0106c8c4
lea rcx, [rbx + 0x99c]
lea rdx, [rbx + 0xa3c]
mov r8d, 0xa0
call fcn.01083500
cmp r12d, esi
mov dword [rbx + 0xc0], 0x7fff
mov dword [rbx + 0xbc], 0x7fff
mov ebp, esi
je 0x106cf02
cmp edi, esi
je 0x106cf02
mov ecx, dword [rbx + 0xd8]
mov eax, edi
cmp ecx, 0x10
je 0x106cd4f
cmp ecx, 0x50
je 0x106cd4a
mov edi, esi
cmp dword [rbx + 0xb70], edi
jne 0x106cf0a
jmp 0x106cefb
and edi, 0xf
jmp 0x106cd56
movzx edi, dil
shr edi, 4
cmp edi, esi
je 0x106cd39
cmp dword [rbx + 0xb70], edi
jne 0x106cd69
shr eax, 0x18
test al, al
jns 0x106cd39
lea r8, [rsp + 0x40]
lea rdx, [0x010674b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
jne 0x106cefb
mov rax, qword [rsp + 0x40]
lea r8, [0x010675f0]
lea rcx, [rsp + 0x50]
mov r9d, r12d
mov edx, 0x20
mov dword [rsp + 0x20], edi
mov qword [rbx + 0xb68], rax
call fcn.0107e7ac
mov rcx, qword [rbx + 0xb68]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov word [rsp + 0x90], si
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
jne 0x106ceea
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x01067600]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov ebp, 4
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x106ce1d
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0xbc], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x01067630]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x106ce5d
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0xc0], eax
jmp 0x106ceb7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x01067658]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x106cea3
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0xc0], eax
mov dword [rbx + 0xbc], eax
jmp 0x106ceb7
mov dword [rbx + 0xc0], 0x7fff
mov dword [rbx + 0xbc], 0x7fff
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.0106c4c0
lea rcx, [rbx + 0x99c]
lea rdx, [rbx + 0xa3c]
mov r8d, 0xa0
mov ebp, eax
call fcn.01083500
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0xb68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, esi
jne 0x106cf02
mov esi, 0x80004005
jmp 0x106cf46
cmp dword [rbx + 0xb70], edi
je 0x106cf10
mov dword [rbx + 0xb70], edi
mov ecx, dword [rbx + 0xc0]
movss xmm1, dword [0x01068580]
cvtsi2ss xmm0, rcx
divss xmm0, xmm1
movss dword [rbx + 0xc8], xmm0
mov ecx, dword [rbx + 0xbc]
cvtsi2ss xmm0, rcx
divss xmm0, xmm1
movss dword [rbx + 0xc4], xmm0
mov eax, esi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0107dbd0
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret