Function at 0x14009f110
Capabilities:
Create thread
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x23d
jne 0x14009f2aa
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009f16c
call fcn.1400c1f80
lea rcx, str.Doing_iCPL_exit_poll...
mov edx, 7
mov qword [rsp + 0x28], rcx
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov rcx, rax
mov dword [rsp + 0x20], 0x3d0
lea r8, str.TrayWnd::OnTimer
call fcn.1400c23b0
xor ebx, ebx
lea r8, [0x1400a5b60]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x40]
call fcn.1400a0860
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LoggingEnabledTime
mov dword [rsp + 0x80], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009f28b
cmp dword [rsp + 0x88], 4
jne 0x14009f28b
mov rcx, qword [rsp + 0x40]
mov ebx, dword [rsp + 0x78]
test rcx, rcx
je 0x14009f202
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14009f3db
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time32]
sub eax, ebx
cmp eax, 0x93a80
jbe 0x14009f3db
call fcn.1400c1f80
cmp dword [rax + 0x78], 4
jl 0x14009f266
call fcn.1400c1f80
lea rcx, str.Disabling_logging_after__d_sec
mov dword [rsp + 0x30], 0x93a80
mov qword [rsp + 0x28], rcx
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov rcx, rax
mov dword [rsp + 0x20], 0x2b4
lea r8, str.TrayWnd::CheckLogging
mov edx, 4
call fcn.1400c23b0
xor edx, edx
xor ecx, ecx
call fcn.1400cfbc0
lea rcx, [rsp + 0x40]
call fcn.1400a0860
mov rcx, qword [rsp + 0x40]
lea rdx, str.LoggingEnabledTime
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009f3db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.1400c1f80
cmp rbx, 0x23e
jne 0x14009f2d9
cmp dword [rax + 0x78], 7
jl 0x14009f31c
call fcn.1400c1f80
lea rcx, str.Doing_device_registration_heartbeat...
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x3d7
jmp 0x14009f301
cmp rbx, 0x23f
jne 0x14009f346
cmp dword [rax + 0x78], 7
jl 0x14009f31c
call fcn.1400c1f80
lea rcx, str.Doing_device_registration_retry...
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x3dc
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov edx, 7
lea r8, str.TrayWnd::OnTimer
mov rcx, rax
call fcn.1400c23b0
xor ebx, ebx
lea r8, [0x1400a6360]
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp rbx, 0x240
jne 0x14009f39d
cmp dword [rax + 0x78], 7
jl 0x14009f389
call fcn.1400c1f80
lea rcx, str.Trying_to_update_Outlook_addin
mov edx, 7
mov qword [rsp + 0x28], rcx
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov rcx, rax
mov dword [rsp + 0x20], 0x3e1
lea r8, str.TrayWnd::OnTimer
call fcn.1400c23b0
xor edx, edx
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp fcn.1400a74e0
cmp dword [rax + 0x78], 7
jl 0x14009f3db
call fcn.1400c1f80
lea rcx, str.Unknown_timerID:__u
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rcx
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov rcx, rax
mov dword [rsp + 0x20], 0x3ed
lea r8, str.TrayWnd::OnTimer
mov edx, 7
call fcn.1400c23b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret