Function at 0x10003e3c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r13, r8
mov ebp, edx
mov r12, rcx
mov r14d, 1
cmp edx, r14d
je 0x10003e588
cmp edx, 2
je 0x10003e588
cmp edx, 3
jne 0x10003e421
lea rdx, [rcx + 8]
mov rcx, r8
call fcn.10001e1c8
mov eax, r14d
jmp 0x10003e6e9
cmp edx, 0xe
jne 0x10003e448
xor esi, esi
cmp dword [rcx + 0x28], esi
je 0x10003e441
lea rdx, [rcx + 0x10]
mov rcx, r8
call fcn.10001e1c8
mov eax, r14d
jmp 0x10003e6e9
xor eax, eax
jmp 0x10003e6e9
call fcn.10003f274
xor esi, esi
cmp eax, esi
jne 0x10003e45a
xor eax, eax
jmp 0x10003e6e9
cmp ebp, 0xb
jne 0x10003e468
lea rdi, [0x10000dfb0]
jmp 0x10003e494
cmp ebp, 0xc
jne 0x10003e476
lea rdi, [0x10000dfc8]
jmp 0x10003e494
cmp ebp, 0xd
jne 0x10003e484
lea rdi, [0x10000b6a8]
jmp 0x10003e494
cmp ebp, 7
jne 0x10003e576
lea rdi, [0x10000dff0]
mov dword [rsp + 0x78], esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10003e567
mov ecx, dword [rsp + 0x78]
cmp ecx, r14d
jbe 0x10003e567
add ecx, 4
mov dword [rsp + 0x78], ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, rsi
jne 0x10003e4eb
xor eax, eax
jmp 0x10003e6e9
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x78]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10003e530
mov rcx, rbx
call 0x10005ccc0
xor eax, eax
jmp 0x10003e6e9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov r8d, ecx
mov rdx, rbx
mov rcx, r13
call fcn.10001e7fc
mov rcx, rbx
call 0x10005ccc0
cmp dword [rsp + 0x78], esi
seta sil
mov eax, esi
jmp 0x10003e6e9
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10003e6e9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10003e6e9
call fcn.10003f274
xor esi, esi
cmp eax, esi
jne 0x10003e59a
xor eax, eax
jmp 0x10003e6e9
lea rcx, [rsp + 0x88]
call fcn.10001e06c
nop
mov rbx, qword [rsp + 0x88]
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x10003e5db
mov edx, edi
lea rcx, [rsp + 0x88]
call fcn.10001edf8
mov rbx, qword [rsp + 0x88]
cmp dword [rbx - 0xc], edi
jge 0x10003e5eb
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], si
mov eax, dword [rbx - 0x10]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x100008568]
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
cmp ecx, esi
jl 0x10003e6de
cmp ecx, dword [rbx - 0xc]
jg 0x10003e6de
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], si
cmp r11d, esi
je 0x10003e66d
lea rcx, [rsp + 0x88]
call fcn.10001f3ec
xor eax, eax
jmp 0x10003e6e9
cmp dword [rbx - 0x10], esi
jne 0x10003e674
jmp 0x10003e6cd
cmp ebp, r14d
jne 0x10003e68f
lea rdx, [rsp + 0x88]
mov rcx, r13
call fcn.10001e1c8
nop
mov esi, r14d
jmp 0x10003e6cd
lea rcx, [rsp + 0x30]
call fcn.10001e06c
nop
lea rcx, [r12 + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x88]
call fcn.10002f9d0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10001e1c8
nop
lea rcx, [rsp + 0x30]
call fcn.10001f3ec
nop
mov esi, r14d
lea rcx, [rsp + 0x88]
call fcn.10001f3ec
mov eax, esi
jmp 0x10003e6e9
mov ecx, 0x80070057
call fcn.10001f28c
nop
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret