Function at 0x1400042e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
mov r12, rdx
mov qword [rbp - 0x10], rsi
mov rdi, rcx
mov dword [rbp + 0x40], esi
mov r13d, esi
mov dword [rbp + 0x50], esi
mov r14d, esi
test rcx, rcx
je 0x14000431b
mov eax, esi
cmp word [rcx], si
jne 0x140004320
mov eax, 1
test eax, eax
je 0x14000432e
mov ebx, 0x80070057
jmp 0x140004517
test r12, r12
je 0x140004324
cmp qword [rdx], rsi
jne 0x140004324
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftSharedXMLProgIDs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
mov r15d, 0x80070000
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140004381
cmp ebx, 0x80070002
jne 0x140004517
jmp 0x1400043ed
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x58]
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
mov dword [rbp + 0x58], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400043e1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ecx, ecx
mov r15d, eax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x1400044d6
mov ebx, 0x8007000e
jmp 0x140004517
cmp ebx, 0x80070002
jne 0x1400044f9
mov ebx, esi
test rdi, rdi
je 0x1400043fb
mov eax, esi
cmp word [rdi], si
jne 0x140004400
mov eax, 1
test eax, eax
je 0x14000440b
mov ebx, 0x80070057
jmp 0x140004437
lea r15, str.InfoPath.Document
mov rdx, qword [r15]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000442f
inc esi
add r15, 8
cmp esi, 1
jb 0x140004412
jmp 0x140004435
mov r13d, 1
xor esi, esi
test ebx, ebx
js 0x140004517
test r13d, r13d
je 0x1400044f9
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, rdi
call fcn.140005e08
test eax, eax
js 0x14000448f
mov edx, dword [rbp + 0x40]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x14000448f
lea r8, [rbp + 0x40]
mov rdx, rax
mov rcx, rdi
call fcn.140005e08
test eax, eax
jns 0x14000448f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, rsi
test r14, r14
lea r8, [rbp + 0x50]
mov rdx, rdi
cmovne rdx, r14
call fcn.1400047dc
mov ebx, eax
test eax, eax
js 0x140004509
cmp dword [rbp + 0x50], esi
je 0x1400044f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ecx, ecx
mov r15d, eax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x1400044d6
mov ebx, 0x8007000e
jmp 0x140004509
or r9, 0xffffffffffffffff
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
cmp eax, 0x50
jne 0x1400044f5
mov ebx, 0x8007007a
jmp 0x1400044fb
mov qword [r12], rsi
xor esi, esi
test rsi, rsi
je 0x140004509
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r14, r14
je 0x140004517
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140004526
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret