Function at 0x14003b940
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3a0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140118a50]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, rdx
mov qword [rsp + 0x38], rdx
mov r15, rcx
mov qword [rsp + 0x58], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov rdi, qword [rcx + 8]
mov dword [rbp - 0x20], r14d
mov bl, r14b
lea r12d, [r14 + 4]
mov dword [rbp + 0x30], r12d
mov dword [rbp - 0x18], r14d
mov dword [rbp + 0x28], r12d
mov qword [rbp - 0x10], r14
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftHvsiOffice
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ecx, ax
mov r13d, 0x80070000
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003ba2b
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.OfficeWDAGEnabledOnHost
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003ba2b
cmp dword [rbp - 0x18], 1
sete bl
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14003ba3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14003ba76
lea r8, [rbp - 0x20]
lea rdx, [0x1400d6668]
mov rcx, qword [rdi]
call fcn.140029c70
test eax, eax
jns 0x14003ba6b
test byte [0x14011a1c0], r12b
je 0x14003ba66
mov r8d, eax
call fcn.14003a9b0
mov eax, r14d
jmp 0x14003ba6e
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x14003c263
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.14003c4d0
mov eax, 7
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x18], r14
mov word [rbp + 8], r14w
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xa0], r14
mov word [rbp + 0x90], r14w
xor r8d, r8d
lea rdx, [0x1400ced70]
lea rcx, [rbp + 0x90]
call fcn.140006190
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
movdqu xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r14
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
lea rcx, [rbp + 0x150]
call fcn.14003b0ac
nop
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x150]
call fcn.140051790
lea r8, [rsp + 0x60]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x150]
call fcn.140051b04
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 8]
call fcn.14003b8ac
test al, al
jne 0x14003c22e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
cmp byte [r15 + 0x48], r14b
je 0x14003bb68
mov rax, qword [r15 + 0x20]
cmp qword [r15 + 0x18], rax
jne 0x14003bb92
mov byte [rsp + 0x20], r14b
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x90]
mov rcx, r15
call fcn.14003cae0
lea rdx, [rsp + 0x40]
lea rcx, [r15 + 0x18]
call fcn.14003f614
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r14
call fcn.140040ff8
mov qword [rbp + 0x80], rax
mov rbx, qword [rsp + 0x40]
or r12, 0xffffffffffffffff
cmp rbx, qword [rsp + 0x48]
je 0x14003bc8f
mov al, byte [0x14011a1b2]
mov byte [rsp + 0x20], al
mov r9, rbx
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x80]
call fcn.140041364
mov rdi, qword [rbx + 0x20]
jmp 0x14003bc70
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.14003b7e4
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003bc0e
mov rax, qword [rax]
mov r8, qword [rbp + 0x18]
mov rcx, r8
cmp r11, r8
cmovb rcx, r11
test rcx, rcx
jmp 0x14003bc3b
movzx r9d, word [rax]
movzx r10d, word [rdx]
cmp r9w, r10w
jne 0x14003bc86
add rax, 2
add rdx, 2
sub rcx, 1
jne 0x14003bc21
mov eax, r14d
mov esi, r14d
cmp r11, r8
setne sil
cmovb esi, r12d
test eax, eax
cmovne esi, eax
cmp qword [rbp + 0x58], 8
jb 0x14003bc64
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test esi, esi
je 0x14003c298
add rdi, 0x20
cmp rdi, qword [rbx + 0x28]
jne 0x14003bbe6
add rbx, 0xe8
jmp 0x14003bbb5
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14003bc40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r14
mov r12, qword [rbp + 0xd0]
mov rbx, r12
mov qword [rbp - 0x10], rbx
mov r13, qword [rbp + 0xd8]
cmp r12, r13
je 0x14003be9d
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.14003c2dc
nop
mov rdi, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
mov qword [rbp + 0x30], rsi
cmp rdi, rsi
je 0x14003be71
or rbx, 0xffffffffffffffff
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], r14
mov word [rbp + 0x40], r14w
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.140003a6c
nop
mov r13, qword [rbp + 0x80]
mov rdx, qword [r13 + 8]
cmp byte [rdx + 0x19], r14b
jne 0x14003be2f
mov r15, r13
mov r12, qword [rbp + 0x50]
mov r13, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x40]
lea rax, [rdx + 0x20]
lea r8, [rbp + 0x40]
cmp r13, 8
cmovae r8, rsi
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003bd54
mov rax, qword [rax]
mov rcx, r12
cmp r11, r12
cmovb rcx, r11
test rcx, rcx
jmp 0x14003bd7d
movzx r9d, word [rax]
movzx r10d, word [r8]
cmp r9w, r10w
jne 0x14003bda0
add rax, 2
add r8, 2
sub rcx, 1
jne 0x14003bd63
mov ecx, r14d
mov eax, r14d
cmp r11, r12
setne al
cmovb eax, ebx
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
je 0x14003bda9
mov rdx, qword [rdx + 0x10]
jmp 0x14003bdaf
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003bd82
mov r15, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], r14b
je 0x14003bd36
mov r13, qword [rbp + 0x80]
cmp r15, r13
mov rsi, qword [rbp + 0x30]
je 0x14003be2f
lea rax, [r15 + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003bdd7
mov rax, qword [rax]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov rcx, r10
cmp r12, r10
cmovb rcx, r12
test rcx, rcx
jmp 0x14003be12
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x14003bf64
add rdx, 2
add rax, 2
sub rcx, 1
jne 0x14003bdf4
mov ecx, r14d
mov eax, r14d
cmp r12, r10
setne al
cmovb eax, ebx
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
je 0x14003be32
mov r15, r13
cmp r15, r13
je 0x14003be48
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xe8]
call fcn.14003fd60
nop
cmp qword [rbp + 0x58], 8
jb 0x14003be59
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rdi, 0x20
cmp rdi, rsi
jne 0x14003bcee
mov rbx, qword [rbp - 0x10]
mov r13, qword [rbp + 0xd8]
lea rcx, [rbp + 0x1a0]
call fcn.1400347f8
add rbx, 0xe8
mov qword [rbp - 0x10], rbx
cmp rbx, r13
jne 0x14003bcbf
mov r15, qword [rsp + 0x58]
mov r12, qword [rbp + 0xd0]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xb0]
call fcn.14003b72c
nop
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp + 0xb0]
call fcn.14002772c
mov r8d, 1
mov rdx, qword [rsp + 0x38]
call fcn.14003eb80
lea rcx, [rbp + 0x100]
call fcn.140035cf8
nop
lea rcx, [rbp + 0x100]
call fcn.140047db0
mov rdi, qword [rsp + 0x60]
mov rbx, rdi
mov rsi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x14003bf19
lea r8, [rbp + 8]
mov rdx, rbx
lea rcx, [rbp + 0x100]
call fcn.1400488a4
add rbx, 0x98
cmp rbx, rsi
jne 0x14003befa
lea rcx, [rbp + 0x100]
call fcn.1400482fc
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_time]
mov qword [rbp + 0x28], rax
call fcn.14001f8f8
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x28]
lea r8, [rbp + 8]
lea rcx, [rax + 0x4b00]
call fcn.14003f40c
test al, al
je 0x14003c1d4
mov rbx, qword [rbp + 0xe8]
jmp 0x14003bfb7
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003be17
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], r14
mov word [rbp + 0x40], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140003a6c
nop
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14003e250
nop
cmp qword [rbp + 0x58], 8
jb 0x14003bfb3
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rbx, 0x20
cmp rbx, qword [rbp + 0xf0]
jne 0x14003bf70
cmp byte [r15 + 0x48], r14b
je 0x14003c022
mov r9, r13
mov r8, r12
mov rdx, qword [r15 + 0x20]
lea rcx, [r15 + 0x18]
call fcn.140041590
lea rdx, [rbp + 8]
lea rcx, [r15 + 0x30]
call fcn.14003fd60
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x150]
call fcn.1400519b4
mov r9, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rdx, qword [r15 + 0x38]
lea rcx, [r15 + 0x30]
call fcn.1400417e4
nop
lea rcx, [rbp - 0x10]
call fcn.14003435c
nop
lea rax, vtable.Uev::TemplateIndex.0
mov qword [rbp + 0x100], rax
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x14003c054
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x118], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0x108]
call fcn.1400373c0
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0xc8], 8
jb 0x14003c085
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xc8], 7
mov qword [rbp + 0xc0], r14
mov word [rbp + 0xb0], r14w
lea rcx, [rbp + 0xe8]
call fcn.14003435c
nop
lea rcx, [rbp + 0x80]
call fcn.14003f1e4
nop
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x14003c0ed
mov rbx, r15
cmp r15, qword [rsp + 0x48]
je 0x14003c0e3
mov rcx, rbx
call fcn.1400347f8
add rbx, 0xe8
cmp rbx, qword [rsp + 0x48]
jne 0x14003c0cd
mov rcx, r15
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
lea rcx, [rbp + 0x150]
call fcn.14003b040
nop
test r12, r12
je 0x14003c125
mov rbx, r12
cmp r12, r13
je 0x14003c11b
mov rcx, rbx
call fcn.1400347f8
add rbx, 0xe8
cmp rbx, r13
jne 0x14003c107
mov rcx, r12
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
test rdi, rdi
je 0x14003c150
mov rbx, rdi
cmp rdi, rsi
je 0x14003c146
mov rcx, rbx
call fcn.140042690
add rbx, 0x98
cmp rbx, rsi
jne 0x14003c132
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0xa8], 8
jb 0x14003c167
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov ebx, 7
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xa0], r14
mov word [rbp + 0x90], r14w
cmp qword [rbp + 0x20], 8
jb 0x14003c193
mov rcx, qword [rbp + 8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x18], r14
mov word [rbp + 8], r14w
lea rcx, [rsp + 0x78]
call fcn.14003435c
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400b6250
mov rbx, qword [rsp + 0x3f0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x68
call fcn.140099438
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14003c217
lea rdx, str.Unable_to_set_template_registration_timestamp
lea rcx, [rbp + 0x40]
call fcn.140005f98
nop
mov dword [rsp + 0x30], 1
mov r8d, dword [rbp - 0x20]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.140005678
mov r14, rax
mov qword [rsp + 0x38], r14
lea rdx, [0x14010f170]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.Template_ID_already_exists
lea rcx, [rbp + 0xb0]
call fcn.140005f98
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x60]
call fcn.14003aaa0
lea rdx, [0x14010f090]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.SLAPI_check_failed._The_template_cannot_be_added.
lea rcx, [rbp + 0xb0]
call fcn.140005f98
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x40]
call fcn.14003aa18
lea rdx, [0x14010ef58]
lea rcx, [rbp + 0x40]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.The_template_has_been_previously_replaced
lea rcx, [rbp + 0x40]
call fcn.140005f98
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14003ac20
lea rdx, [0x14010f100]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
int3