Function at 0x14003a980
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x390
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140119ad0]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rsi, rdx
mov qword [rsp + 0x38], rdx
mov r15, rcx
mov qword [rsp + 0x58], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov rdi, qword [rcx + 8]
mov dword [rbp - 0x14], r14d
mov bl, r14b
lea r12d, [r14 + 4]
mov dword [rbp + 0x68], r12d
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0x20], r12d
mov qword [rbp + 0x50], r14
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftHvsiOffice
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ecx, ax
mov r13d, 0x80070000
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003aa6b
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, str.OfficeWDAGEnabledOnHost
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003aa6b
cmp dword [rbp - 0x18], 1
sete bl
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14003aa7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14003aab6
lea r8, [rbp - 0x14]
lea rdx, str.AppMan_UEV_Subscription_Active
mov rcx, qword [rdi]
call fcn.140029a50
test eax, eax
jns 0x14003aaab
test byte [0x14011b2c0], r12b
je 0x14003aaa6
mov r8d, eax
call fcn.1400399e0
mov eax, r14d
jmp 0x14003aaae
mov eax, dword [rbp - 0x14]
test eax, eax
je 0x14003b2a4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.14003b510
mov eax, 7
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x40], r14
mov word [rbp + 0x30], r14w
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x90], r14
mov word [rbp + 0x80], r14w
xor r8d, r8d
lea rdx, [0x1400cfdc0]
lea rcx, [rbp + 0x80]
call fcn.1400061d0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r14
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
lea rcx, [rbp + 0x140]
call fcn.14003a0ec
nop
xor r9d, r9d
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x140]
call fcn.140051b0c
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x140]
call fcn.140051e80
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x30]
call fcn.14003a8ec
test al, al
jne 0x14003b26f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea rbx, [r15 + 0x18]
cmp byte [r15 + 0x48], r14b
je 0x14003abab
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003abd4
mov byte [rsp + 0x20], r14b
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x80]
mov rcx, r15
call fcn.14003bb20
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14003e654
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
call fcn.140040004
mov qword [rbp + 0x70], rax
mov rbx, qword [rsp + 0x40]
or r12, 0xffffffffffffffff
cmp rbx, qword [rsp + 0x48]
je 0x14003acc5
mov al, byte [0x14011b26d]
mov byte [rsp + 0x20], al
mov r9, rbx
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140040364
mov rdi, qword [rbx + 0x20]
jmp 0x14003aca6
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.14003a828
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003ac44
mov rax, qword [rax]
mov r8, qword [rbp + 0x40]
mov rcx, r8
cmp r11, r8
cmovb rcx, r11
test rcx, rcx
jmp 0x14003ac71
movzx r9d, word [rax]
movzx r10d, word [rdx]
cmp r9w, r10w
jne 0x14003acbc
add rax, 2
add rdx, 2
sub rcx, 1
jne 0x14003ac57
mov eax, r14d
mov esi, r14d
cmp r11, r8
setne sil
cmovb esi, r12d
test eax, eax
cmovne esi, eax
cmp qword [rbp + 8], 8
jb 0x14003ac9a
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test esi, esi
je 0x14003b2d9
add rdi, 0x20
cmp rdi, qword [rbx + 0x28]
jne 0x14003ac1c
add rbx, 0xe8
jmp 0x14003abee
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14003ac76
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r14
mov r12, qword [rbp + 0xc0]
mov rbx, r12
mov r13, qword [rbp + 0xc8]
cmp r12, r13
je 0x14003aede
or r15, 0xffffffffffffffff
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.14003b31c
nop
mov rdi, qword [rbp + 0x1b0]
mov rsi, qword [rbp + 0x1b8]
mov qword [rbp + 0x50], rsi
cmp rdi, rsi
je 0x14003aeb6
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r9, r15
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.140003abc
nop
mov r12, qword [rbp + 0x70]
mov rdx, qword [r12 + 8]
cmp byte [rdx + 0x19], r14b
jne 0x14003ae78
mov r13, r12
mov r12, qword [rbp + 8]
mov r15, qword [rbp - 0x10]
or rsi, 0xffffffffffffffff
lea rax, [rdx + 0x20]
lea r8, [rbp - 0x10]
cmp r12, 8
cmovae r8, r15
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003ad84
mov rax, qword [rax]
mov rcx, qword [rbp]
cmp r11, rcx
cmovb rcx, r11
test rcx, rcx
jmp 0x14003adae
movzx r9d, word [rax]
movzx r10d, word [r8]
cmp r9w, r10w
jne 0x14003add2
add rax, 2
add r8, 2
sub rcx, 1
jne 0x14003ad94
mov ecx, r14d
mov eax, r14d
cmp r11, qword [rbp]
setne al
cmovb eax, esi
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
je 0x14003addb
mov rdx, qword [rdx + 0x10]
jmp 0x14003ade1
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003adb3
mov r13, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], r14b
je 0x14003ad66
mov r12, qword [rbp + 0x70]
cmp r13, r12
mov rsi, qword [rbp + 0x50]
je 0x14003ae74
lea rax, [r13 + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003ae0a
mov rax, qword [rax]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov rcx, r10
cmp qword [rbp], r10
cmovb rcx, qword [rbp]
test rcx, rcx
jmp 0x14003ae43
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x14003ae6b
add rdx, 2
add rax, 2
sub rcx, 1
jne 0x14003ae29
mov ecx, r14d
mov eax, r14d
cmp qword [rbp], r10
setne al
mov r15, 0xffffffffffffffff
cmovb eax, r15d
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
jne 0x14003ae78
jmp 0x14003ae7b
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003ae48
or r15, 0xffffffffffffffff
mov r13, r12
cmp r13, r12
je 0x14003ae91
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.14003ed78
nop
cmp qword [rbp + 8], 8
jb 0x14003aea2
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rdi, 0x20
cmp rdi, rsi
jne 0x14003ad20
mov r13, qword [rbp + 0xc8]
lea rcx, [rbp + 0x190]
call fcn.1400337f8
add rbx, 0xe8
cmp rbx, r13
jne 0x14003acf5
mov r15, qword [rsp + 0x58]
mov r12, qword [rbp + 0xc0]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xa0]
call fcn.14003a770
nop
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.14002751c
mov r8d, 1
mov rdx, qword [rsp + 0x38]
call fcn.14003dbc0
lea rcx, [rbp + 0xf0]
call fcn.140034cfc
nop
lea rcx, [rbp + 0xf0]
call fcn.140048110
mov rdi, qword [rsp + 0x60]
mov rbx, rdi
mov rsi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x14003af5a
lea r8, [rbp + 0x30]
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140048c0c
add rbx, 0x98
cmp rbx, rsi
jne 0x14003af3b
lea rcx, [rbp + 0xf0]
call fcn.140048664
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_time]
mov qword [rbp + 0x68], rax
call fcn.14001f70c
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x30]
lea rcx, [rax + 0x4d60]
call fcn.14003e44c
test al, al
je 0x14003b215
mov rbx, qword [rbp + 0xd8]
cmp rbx, qword [rbp + 0xe0]
je 0x14003b004
or rsi, 0xffffffffffffffff
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140003abc
nop
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.14003d290
nop
cmp qword [rbp + 8], 8
jb 0x14003aff2
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rbx, 0x20
cmp rbx, qword [rbp + 0xe0]
jne 0x14003afb0
mov rsi, qword [rsp + 0x68]
cmp byte [r15 + 0x48], r14b
je 0x14003b066
lea rcx, [r15 + 0x18]
mov r9, r13
mov r8, r12
mov rdx, qword [r15 + 0x20]
call fcn.140040590
lea rdx, [rbp + 0x30]
lea rcx, [r15 + 0x30]
call fcn.14003ed78
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.140051d30
mov r9, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rdx, qword [r15 + 0x38]
lea rcx, [r15 + 0x30]
call fcn.1400407e4
nop
lea rcx, [rbp + 0x50]
call fcn.14003335c
nop
lea rax, vtable.Uev::TemplateIndex.0
mov qword [rbp + 0xf0], rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x14003b098
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x108], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0xf8]
call fcn.1400363d0
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0xb8], 8
jb 0x14003b0c9
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], r14
mov word [rbp + 0xa0], r14w
lea rcx, [rbp + 0xd8]
call fcn.14003335c
nop
lea rcx, [rbp + 0x70]
call fcn.14003e224
nop
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x14003b12e
mov rbx, r15
cmp r15, qword [rsp + 0x48]
je 0x14003b124
mov rcx, rbx
call fcn.1400337f8
add rbx, 0xe8
cmp rbx, qword [rsp + 0x48]
jne 0x14003b10e
mov rcx, r15
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
lea rcx, [rbp + 0x140]
call fcn.14003a080
nop
test r12, r12
je 0x14003b166
mov rbx, r12
cmp r12, r13
je 0x14003b15c
mov rcx, rbx
call fcn.1400337f8
add rbx, 0xe8
cmp rbx, r13
jne 0x14003b148
mov rcx, r12
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
test rdi, rdi
je 0x14003b191
mov rbx, rdi
cmp rdi, rsi
je 0x14003b187
mov rcx, rbx
call fcn.140041694
add rbx, 0x98
cmp rbx, rsi
jne 0x14003b173
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0x98], 8
jb 0x14003b1a8
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov ebx, 7
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0x90], r14
mov word [rbp + 0x80], r14w
cmp qword [rbp + 0x48], 8
jb 0x14003b1d4
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x40], r14
mov word [rbp + 0x30], r14w
lea rcx, [rsp + 0x78]
call fcn.14003335c
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400b6c20
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x68
call fcn.140099e88
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14003b258
lea rdx, str.Unable_to_set_template_registration_timestamp
lea rcx, [rbp - 0x10]
call fcn.140005fd8
nop
mov dword [rsp + 0x30], 1
mov r8d, dword [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400056b8
mov r14, rax
mov qword [rsp + 0x38], r14
lea rdx, [0x140110840]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.Template_ID_already_exists
lea rcx, [rbp + 0xa0]
call fcn.140005fd8
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.140039ad0
lea rdx, [0x140110760]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.SLAPI_check_failed._The_template_cannot_be_added.
lea rcx, [rbp + 0xa0]
call fcn.140005fd8
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x10]
call fcn.140039a48
lea rdx, [0x140110628]
lea rcx, [rbp - 0x10]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.The_template_has_been_previously_replaced
lea rcx, [rbp - 0x10]
call fcn.140005fd8
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140039c50
lea rdx, [0x1401107d0]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
int3