Function at 0x10a3fd8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov qword [rax - 0x58], rbx
mov qword [rax + 0x20], rbx
mov rsi, rbx
mov qword [rax - 0x40], rbx
mov rdi, rbx
mov qword [rax - 0x50], rbx
lea r15d, [rbx + 0x28]
mov qword [rax - 0x48], rbx
mov r14d, ebx
mov dword [rax + 0x10], ebx
lea r13d, [rbx + 1]
lea ecx, [rbx + 0x10]
call fcn.010a691c
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, rbx
je 0x10a425e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 9]
xor r8d, r8d
lea rdx, [0x0108d100]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10a425e
cmp rdi, rbx
jne 0x10a4091
lea ecx, [r15 + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.010a691c
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
je 0x10a425e
jmp 0x10a4099
add r14d, r13d
mov dword [rsp + 0x44], r14d
cmp rsi, rbx
je 0x10a40af
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x10a40ca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov dword [rsp + 0xc0], r15d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xc0]
mov r8, rdi
mov edx, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x10a412c
mov rcx, rdi
call fcn.010a67f8
mov rdi, rbx
mov qword [rsp + 0x58], rbx
mov r15d, dword [rsp + 0xc0]
add r15d, 1
mov dword [rsp + 0x48], r15d
jmp 0x10a405a
cmp eax, 0x103
je 0x10a425e
cmp eax, ebx
jne 0x10a425e
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10a405a
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x0108d0d8]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10a405a
cmp dword [rsp + 0xb0], 4
jne 0x10a405a
mov ecx, ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [r12]
and eax, 0xf
sub eax, r13d
je 0x10a41e7
cmp eax, 7
je 0x10a41e7
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, ebx
jne 0x10a405a
mov dword [rsp + 0xb0], 3
mov dword [rsp + 0xb8], 0x10
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, [0x0108d0f0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10a405a
cmp dword [rsp + 0xb0], 3
jne 0x10a405a
cmp dword [rsp + 0xb8], 0x10
jne 0x10a405a
mov r13d, ebx
cmp rdi, rbx
je 0x10a426b
mov rcx, rdi
call fcn.010a67f8
cmp r12, rbx
je 0x10a4278
mov rcx, r12
call fcn.010a67f8
cmp rsi, rbx
je 0x10a4286
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbx
je 0x10a42a1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x10a42b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13d, ebx
sete bl
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret