Function at 0x108bf74
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov qword [rax - 0x58], rbx
mov qword [rax + 0x20], rbx
mov rsi, rbx
mov qword [rax - 0x40], rbx
mov rdi, rbx
mov qword [rax - 0x50], rbx
lea r15d, [rbx + 0x28]
mov qword [rax - 0x48], rbx
mov r14d, ebx
mov dword [rax + 0x10], ebx
lea r13d, [rbx + 1]
lea ecx, [rbx + 0x10]
call fcn.0108e6c8
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, rbx
je 0x108c1fa
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 9]
xor r8d, r8d
lea rdx, [0x010846a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x108c1fa
cmp rdi, rbx
jne 0x108c02d
lea ecx, [r15 + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0108e6c8
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
je 0x108c1fa
jmp 0x108c035
add r14d, r13d
mov dword [rsp + 0x44], r14d
cmp rsi, rbx
je 0x108c04b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x108c066
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov dword [rsp + 0xc0], r15d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xc0]
mov r8, rdi
mov edx, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x108c0c8
mov rcx, rdi
call fcn.0108e5a4
mov rdi, rbx
mov qword [rsp + 0x58], rbx
mov r15d, dword [rsp + 0xc0]
add r15d, 1
mov dword [rsp + 0x48], r15d
jmp 0x108bff6
cmp eax, 0x103
je 0x108c1fa
cmp eax, ebx
jne 0x108c1fa
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x108bff6
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x01084678]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x108bff6
cmp dword [rsp + 0xb0], 4
jne 0x108bff6
mov ecx, ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [r12]
and eax, 0xf
sub eax, r13d
je 0x108c183
cmp eax, 7
je 0x108c183
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, ebx
jne 0x108bff6
mov dword [rsp + 0xb0], 3
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x01084690]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x108bff6
cmp dword [rsp + 0xb0], 3
jne 0x108bff6
cmp dword [rsp + 0xb8], 0x10
jne 0x108bff6
mov r13d, ebx
cmp rdi, rbx
je 0x108c207
mov rcx, rdi
call fcn.0108e5a4
cmp r12, rbx
je 0x108c214
mov rcx, r12
call fcn.0108e5a4
cmp rsi, rbx
je 0x108c222
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x108c23d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x108c24d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13d, ebx
sete bl
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret