Function at 0x107b008
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov qword [rax - 0x58], rbx
mov qword [rax + 0x20], rbx
mov rsi, rbx
mov qword [rax - 0x40], rbx
mov rdi, rbx
mov qword [rax - 0x50], rbx
lea r15d, [rbx + 0x28]
mov qword [rax - 0x48], rbx
mov r14d, ebx
mov dword [rax + 0x10], ebx
lea r13d, [rbx + 1]
lea ecx, [rbx + 0x10]
call fcn.0107d614
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, rbx
je 0x107b28e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 9]
xor r8d, r8d
lea rdx, [0x010683d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x107b28e
cmp rdi, rbx
jne 0x107b0c1
lea ecx, [r15 + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0107d614
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
je 0x107b28e
jmp 0x107b0c9
add r14d, r13d
mov dword [rsp + 0x44], r14d
cmp rsi, rbx
je 0x107b0df
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x107b0fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov dword [rsp + 0xc0], r15d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xc0]
mov r8, rdi
mov edx, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x107b15c
mov rcx, rdi
call fcn.0107d4f0
mov rdi, rbx
mov qword [rsp + 0x58], rbx
mov r15d, dword [rsp + 0xc0]
add r15d, 1
mov dword [rsp + 0x48], r15d
jmp 0x107b08a
cmp eax, 0x103
je 0x107b28e
cmp eax, ebx
jne 0x107b28e
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x107b08a
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x010683a0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x107b08a
cmp dword [rsp + 0xb0], 4
jne 0x107b08a
mov ecx, ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [r12]
and eax, 0xf
sub eax, r13d
je 0x107b217
cmp eax, 7
je 0x107b217
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, ebx
jne 0x107b08a
mov dword [rsp + 0xb0], 3
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x010683b8]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x107b08a
cmp dword [rsp + 0xb0], 3
jne 0x107b08a
cmp dword [rsp + 0xb8], 0x10
jne 0x107b08a
mov r13d, ebx
cmp rdi, rbx
je 0x107b29b
mov rcx, rdi
call fcn.0107d4f0
cmp r12, rbx
je 0x107b2a8
mov rcx, r12
call fcn.0107d4f0
cmp rsi, rbx
je 0x107b2b6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x107b2d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x107b2e1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13d, ebx
sete bl
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret