Function at 0x109f1c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0xcc], 1
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov dword [rcx + 0x50], edi
mov qword [rcx + 0x58], rdi
mov dword [rcx + 0x60], edi
mov dword [rcx + 0x64], edi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0x78], rdi
mov qword [rcx + 0x80], rdi
mov qword [rcx + 0x88], rdi
mov qword [rcx + 0xa0], rdi
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xb0], rdi
mov qword [rcx + 0xb8], rdi
mov qword [rcx + 0xc0], rdi
mov dword [rcx + 0xc8], edi
mov dword [rcx + 0xd0], edi
mov dword [rcx + 0xd4], edi
lea r9, [0x01098a20]
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01098a38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01098a50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01098a70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x01098a90]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [0x010d72e8], edi
mov dword [rbx + 0x64], 1
mov qword [rbx + 0x48], rax
je 0x109f369
lea rcx, [0x01098ab0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x010d727c], eax
add eax, 0xffff4000
cmp eax, 0x3fff
ja 0x109f313
lea rdx, [0x01098ae0]
xor ecx, ecx
call fcn.0109c5cc
jmp 0x109f32a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01098b80]
xor ecx, ecx
mov r8d, eax
call fcn.0109c5cc
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call fcn.0109f460
mov r8d, dword [rsp + 0x40]
cmp r8d, edi
je 0x109f361
lea rdx, [0x01098c30]
xor ecx, ecx
call fcn.0109c5cc
mov r11d, dword [rsp + 0x40]
mov dword [rbx + 0xcc], r11d
cmp dword [0x010d72e8], edi
jne 0x109f375
cmp dword [0x010d72e4], edi
je 0x109f449
cmp dword [0x010d72b0], 6
jne 0x109f449
cmp dword [0x010d72b4], 1
jne 0x109f449
cmp qword [0x010d7338], rdi
jne 0x109f449
lea rdx, [0x01098c70]
mov ecx, 0x1d
call fcn.0109c5cc
lea r8, [rsp + 0x50]
lea rdx, [0x01097528]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x109f417
lea rax, [rsp + 0x40]
lea rdx, [0x01098cc0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x109f417
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.0109fdd8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0x78]
cmp r11, rdi
je 0x109f449
lea rcx, [0x01098ce8]
xor r8d, r8d
xor edx, edx
call r11
mov qword [0x010d7338], rax
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret