Function at 0x10003d2d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r13, r8
mov ebp, edx
mov r12, rcx
mov r14d, 1
cmp edx, r14d
je 0x10003d498
cmp edx, 2
je 0x10003d498
cmp edx, 3
jne 0x10003d331
lea rdx, [rcx + 8]
mov rcx, r8
call fcn.10001f050
mov eax, r14d
jmp 0x10003d5f9
cmp edx, 0xe
jne 0x10003d358
xor esi, esi
cmp dword [rcx + 0x28], esi
je 0x10003d351
lea rdx, [rcx + 0x10]
mov rcx, r8
call fcn.10001f050
mov eax, r14d
jmp 0x10003d5f9
xor eax, eax
jmp 0x10003d5f9
call fcn.10003e454
xor esi, esi
cmp eax, esi
jne 0x10003d36a
xor eax, eax
jmp 0x10003d5f9
cmp ebp, 0xb
jne 0x10003d378
lea rdi, [0x10000e358]
jmp 0x10003d3a4
cmp ebp, 0xc
jne 0x10003d386
lea rdi, [0x10000e370]
jmp 0x10003d3a4
cmp ebp, 0xd
jne 0x10003d394
lea rdi, [0x10000be18]
jmp 0x10003d3a4
cmp ebp, 7
jne 0x10003d486
lea rdi, [0x10000e398]
mov dword [rsp + 0x78], esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003d477
mov ecx, dword [rsp + 0x78]
cmp ecx, r14d
jbe 0x10003d477
add ecx, 4
mov dword [rsp + 0x78], ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, rsi
jne 0x10003d3fb
xor eax, eax
jmp 0x10003d5f9
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x78]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10003d440
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
jmp 0x10003d5f9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov r8d, ecx
mov rdx, rbx
mov rcx, r13
call fcn.10001ff98
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp dword [rsp + 0x78], esi
seta sil
mov eax, esi
jmp 0x10003d5f9
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10003d5f9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10003d5f9
call fcn.10003e454
xor esi, esi
cmp eax, esi
jne 0x10003d4aa
xor eax, eax
jmp 0x10003d5f9
lea rcx, [rsp + 0x88]
call fcn.100020360
nop
mov rbx, qword [rsp + 0x88]
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x10003d4eb
mov edx, edi
lea rcx, [rsp + 0x88]
call fcn.100020154
mov rbx, qword [rsp + 0x88]
cmp dword [rbx - 0xc], edi
jge 0x10003d4fb
mov ecx, 0x80070057
call fcn.1000201f8
int3
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], si
mov eax, dword [rbx - 0x10]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1000055d8]
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
cmp ecx, esi
jl 0x10003d5ee
cmp ecx, dword [rbx - 0xc]
jg 0x10003d5ee
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], si
cmp r11d, esi
je 0x10003d57d
lea rcx, [rsp + 0x88]
call fcn.10002006c
xor eax, eax
jmp 0x10003d5f9
cmp dword [rbx - 0x10], esi
jne 0x10003d584
jmp 0x10003d5dd
cmp ebp, r14d
jne 0x10003d59f
lea rdx, [rsp + 0x88]
mov rcx, r13
call fcn.10001f050
nop
mov esi, r14d
jmp 0x10003d5dd
lea rcx, [rsp + 0x30]
call fcn.100020360
nop
lea rcx, [r12 + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x88]
call fcn.100032a84
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10001f050
nop
lea rcx, [rsp + 0x30]
call fcn.10002006c
nop
mov esi, r14d
lea rcx, [rsp + 0x88]
call fcn.10002006c
mov eax, esi
jmp 0x10003d5f9
mov ecx, 0x80070057
call fcn.1000201f8
nop
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret