Function at 0x109dd90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0x124], 1
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov dword [rcx + 0x50], edi
mov qword [rcx + 0x58], rdi
mov dword [rcx + 0x60], edi
mov dword [rcx + 0x64], edi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov qword [rcx + 0xd8], rdi
mov qword [rcx + 0xf0], rdi
mov qword [rcx + 0xf8], rdi
mov qword [rcx + 0x100], rdi
mov qword [rcx + 0x108], rdi
mov qword [rcx + 0x110], rdi
mov qword [rcx + 0x118], rdi
mov dword [rcx + 0x120], edi
mov dword [rcx + 0x128], edi
mov dword [rcx + 0x12c], edi
lea r9, [0x01089740]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01089758]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01089770]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01089790]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x010897b0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [0x010e537c], edi
mov dword [rbx + 0x64], 1
mov qword [rbx + 0x48], rax
je 0x109df41
lea rcx, [0x010897d0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x010e5300], eax
add eax, 0xffff4000
cmp eax, 0x3fff
ja 0x109deeb
lea rdx, [0x01089800]
xor ecx, ecx
call fcn.01091f4c
jmp 0x109df02
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x010898a0]
xor ecx, ecx
mov r8d, eax
call fcn.01091f4c
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call fcn.0109e670
mov r8d, dword [rsp + 0x40]
cmp r8d, edi
je 0x109df39
lea rdx, [0x01089950]
xor ecx, ecx
call fcn.01091f4c
mov r11d, dword [rsp + 0x40]
mov dword [rbx + 0x124], r11d
cmp dword [0x010e537c], edi
jne 0x109df4d
cmp dword [0x010e5378], edi
je 0x109e024
cmp dword [0x010e5334], 6
jne 0x109e024
cmp dword [0x010e5338], 1
jne 0x109e024
cmp qword [0x010e53e8], rdi
jne 0x109e024
lea rdx, [0x01089990]
mov ecx, 0x1d
call fcn.01091f4c
lea r8, [rsp + 0x50]
lea rdx, [0x01084640]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x109dfef
lea rax, [rsp + 0x40]
lea rdx, [0x010899e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x109dfef
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.0109f39c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0xc8]
cmp r11, rdi
je 0x109e024
lea rcx, [0x01089a08]
xor r8d, r8d
xor edx, edx
call r11
mov qword [0x010e53e8], rax
lea rdx, [rsp + 0x40]
lea rcx, str._VREXT
mov dword [rsp + 0x40], 0xff
call fcn.010a1340
mov r11d, dword [rsp + 0x40]
lea rcx, [rbx + 0x78]
mov dword [rbx + 0x130], r11d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret