Function at 0x10003a8dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rbx, qword [0x1000888e8]
lea rax, [rsp + 0x40]
lea rdx, [0x1000255f0]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003ab28
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
lea rdx, [0x100025700]
xor r8d, r8d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003aaf9
cmp dword [rsp + 0x30], 1
jne 0x10003aaf9
movdqu xmm0, xmmword [0x1000254f0]
movdqu xmm1, xmmword [0x100025500]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x100]
mov edi, esi
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [0x100025510]
movdqu xmmword [rsp + 0x70], xmm1
movdqu xmm1, xmmword [0x100025520]
movdqu xmmword [rsp + 0x80], xmm0
movdqu xmm0, xmmword [0x100025530]
movdqu xmmword [rsp + 0x90], xmm1
movdqu xmm1, xmmword [0x100025540]
movdqu xmmword [rsp + 0xa0], xmm0
movdqu xmm0, xmmword [0x100025550]
movdqu xmmword [rsp + 0xb0], xmm1
movdqu xmm1, xmmword [0x100025560]
movdqu xmmword [rsp + 0xc0], xmm0
movdqu xmm0, xmmword [0x100025570]
movdqu xmmword [rsp + 0xd0], xmm1
movdqu xmm1, xmmword [0x100025580]
movdqu xmmword [rsp + 0xe0], xmm0
movdqu xmmword [rsp + 0xf0], xmm1
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov r11d, esi
movsxd rax, r11d
add rax, rax
lea rcx, [rsp + rax*8 + 0x60]
lea rax, [rsp + 0x48]
mov rdx, qword [rcx]
cmp rdx, qword [rax]
jne 0x10003aa77
mov rdx, qword [rcx + 8]
cmp rdx, qword [rax + 8]
jne 0x10003aa77
mov eax, esi
jmp 0x10003aa7c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x10003aa8b
inc r11d
cmp r11d, 0xa
jb 0x10003aa51
jmp 0x10003aa8e
mov edi, r11d
lea ecx, [rdi + 1]
call fcn.100051e1c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov edi, 4
lea r9, [rsp + 0x30]
lea rdx, [0x100025720]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003ab1d
cmp dword [rsp + 0x30], edi
jne 0x10003ab1d
mov ecx, dword [rsp + 0x38]
call fcn.100051c48
mov r8d, dword [rsp + 0x38]
lea rdx, [0x100025748]
mov ecx, edi
call fcn.1000527f4
jmp 0x10003ab1d
mov ecx, dword [0x100088e40]
call fcn.100051c48
mov r11d, dword [0x100088e40]
inc r11d
cmp r11d, 0x1e
cmova r11d, esi
mov dword [0x100088e40], r11d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100088844], esi
je 0x10003ab72
mov rcx, qword [0x1000888e8]
cmp rcx, rsi
je 0x10003ab46
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, esi
jne 0x10003ab6b
mov rcx, rbx
mov qword [0x1000888e8], rbx
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, esi
jne 0x10003ab6b
lea rdx, [0x100025768]
mov ecx, 2
call fcn.1000527a0
xor ecx, ecx
call fcn.100051f58
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret