Function at 0x14004cda0
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
mov rdi, rcx
lea rcx, str.UOCF
mov qword [rbp - 0x51], r15
mov r14d, r15d
mov dword [rbp - 0x61], r15d
mov esi, r15d
mov dword [rbp - 0x59], r15d
lea eax, [r15 + 4]
mov dword [rbp - 0x5d], eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
cmp rdx, 0x52
ja 0x14004cfe6
lea r8, [rbp - 0x39]
mov rcx, rdi
call fcn.140051c48
mov dword [rbp - 0x69], eax
test eax, eax
jne 0x14004cfe6
lea rdx, [rbp - 0x39]
mov byte [rbp - 0x35], r15b
lea rcx, str.UOCF
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [rbp - 0x69]
mov ebx, 0x5dd
test eax, eax
cmovne ecx, ebx
mov dword [rbp - 0x69], ecx
test ecx, ecx
jne 0x14004cfd4
lea rax, [rbp - 0x51]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftOffice16.0Common
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp - 0x69], eax
test eax, eax
jne 0x14004ceaa
mov rcx, qword [rbp - 0x51]
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x59]
lea rax, [rbp - 0x61]
xor r8d, r8d
lea rdx, str.OrgchartSkipCRC
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x61], r15d
jne 0x14004cec5
mov rcx, rdi
call fcn.140053938
mov dword [rbp - 0x69], eax
mov ecx, eax
test eax, eax
jne 0x14004cfd4
mov r13d, 0xfffe
mov ecx, 2
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov qword [0x140096ef8], rax
test rcx, rcx
mov eax, r15d
mov edx, 0x2714
cmove eax, edx
mov dword [rbp - 0x69], eax
test eax, eax
jne 0x14004cfeb
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov qword [0x140096f00], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [0x140096f00]
lea r9, [rbp - 0x69]
mov r8d, r13d
mov dword [0x140096ef0], eax
mov rcx, rdi
mov dword [0x140096ef4], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004cf52
or eax, 0xffffffff
jmp 0x14004cfeb
mov dword [rbp - 0x65], r15d
mov r13d, 4
lea r8, [rbp - 0x49]
mov rcx, rdi
lea rdx, [rbp - 0x65]
call fcn.140051bac
mov dword [rbp - 0x69], eax
mov ecx, eax
test eax, eax
jne 0x14004cfc9
mov eax, dword [rbp - 0x65]
sub eax, 1
je 0x14004cfb6
sub eax, 1
je 0x14004cf9a
cmp eax, 1
jne 0x14004cfc0
mov eax, 0x3e9
cmp word [0x1400a77a2], ax
ja 0x14004cfd8
lea esi, [rcx + 1]
jmp 0x14004cf5c
cmp word [0x1400a77a2], r13w
mov eax, r15d
mov r14d, 1
setne al
mov dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], eax
jmp 0x14004cf5c
cmp word [0x1400a77a2], r15w
jne 0x14004cfdf
cmp dword [rbp - 0x65], 0x4002
jne 0x14004cf5c
test r14d, r14d
je 0x14004cfd2
test esi, esi
jne 0x14004cfd4
mov ecx, ebx
mov eax, ecx
jmp 0x14004cfeb
mov eax, 0x5e4
jmp 0x14004cfeb
mov eax, 0x5df
jmp 0x14004cfeb
mov eax, 0x5dd
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008a940
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret