Function at 0x1000110d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, r9
mov rdi, r8
mov rsi, rdx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x44], 0x208
lea rcx, [rsp + 0x30]
call fcn.100013400
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1000227a3
cmp dword [rsp + 0x40], 1
jne 0x1000227a3
mov bl, 1
jmp 0x100011163
lea rcx, [rsp + 0x30]
call fcn.1000012a0
mov r13d, 8
cmp bl, r12b
je 0x10001122b
mov word [rsp + 0x266], r12w
cmp word [rsp + 0x60], r12w
je 0x1000227c5
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1000036ac
nop
lea rcx, [rsp + 0x30]
call fcn.100001674
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x38]
call fcn.100013400
nop
lea rcx, [rsp + 0x38]
call fcn.100001674
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.100010d50
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.100011474
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], r13w
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x1000227ab
lea rcx, [rsp + 0x38]
call fcn.1000012a0
nop
lea rcx, [rsp + 0x30]
call fcn.1000012a0
cmp word [rsp + 0x60], r12w
je 0x1000227c5
mov dword [rsp + 0x44], 0x208
lea rcx, [rsp + 0x30]
call fcn.10000581c
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1000227cc
cmp dword [rsp + 0x40], 1
jne 0x1000227cc
mov bl, 1
jmp 0x100011289
lea rcx, [rsp + 0x30]
call fcn.1000012a0
cmp bl, r12b
je 0x10001134b
mov word [rsp + 0x266], r12w
cmp word [rsp + 0x60], r12w
je 0x10001134b
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1000036ac
nop
lea rcx, [rsp + 0x38]
call fcn.100001674
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x30]
call fcn.10000581c
nop
lea rcx, [rsp + 0x30]
call fcn.100001674
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.100010d50
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.100011474
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], r13w
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x1000227d4
lea rcx, [rsp + 0x30]
call fcn.1000012a0
nop
lea rcx, [rsp + 0x38]
call fcn.1000012a0
mov dword [rsp + 0x44], 4
lea rcx, [rsp + 0x30]
call fcn.1000057f0
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1000227ef
cmp dword [rsp + 0x40], 4
jne 0x1000227ef
mov bl, 1
jmp 0x10001139d
lea rcx, [rsp + 0x30]
call fcn.1000012a0
cmp bl, r12b
je 0x100011442
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1000036ac
nop
lea rcx, [rsp + 0x38]
call fcn.100001674
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x30]
call fcn.1000057f0
nop
lea rcx, [rsp + 0x30]
call fcn.100001674
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
mov edi, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.100010d50
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.100011474
mov rbx, rax
mov esi, 0x13
cmp word [rax], si
je 0x10001142a
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbx], si
mov dword [rbx + 8], edi
lea rcx, [rsp + 0x30]
call fcn.1000012a0
nop
lea rcx, [rsp + 0x38]
call fcn.1000012a0
mov al, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100001100
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov bl, r12b
jmp 0x100011163
lea ecx, [r13 + 2]
mov word [rbx], cx
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242f0
nop
jmp 0x100023ea6
xor al, al
jmp 0x100011444
mov bl, r12b
jmp 0x100011289
mov ecx, 0xa
mov word [rbx], cx
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242f0
nop
jmp 0x100023ea7
mov bl, r12b
jmp 0x10001139d