Function at 0x14000d3c0
Capabilities:
Check os version
Query or enumerate registry value
Set thread local storage value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov edi, edx
mov r15, rcx
mov dword [0x14012591c], edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [0x1401256f8]
test rax, rax
je 0x14000d413
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r13d, 0x20
bt r15d, 8
jae 0x14000d500
mov dword [0x1401250cc], 0x100
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d452
lea r9, str.BootExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.140012770
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d476
lea r9, str.SetupExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.140012770
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d49a
lea r9, str.Execute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.140012770
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d4be
lea r9, str.S0InitialCommand
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.140012770
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14000d500
call qword [sym.imp.KERNEL32.dll_GetVersion]
shr ax, 8
cmp al, 1
jb 0x14000d500
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d500
mov word [rsp + 0x20], r13w
lea r9, str.ServiceControlManagerExtension
lea r8, str.SystemCurrentControlSetControl
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.14000c8c0
bt r15d, 0x12
jae 0x14000d518
mov dword [0x1401250cc], 0x40000
xor ecx, ecx
call fcn.140020c30
bt r15d, 0x13
jae 0x14000dbb3
mov dword [0x1401250cc], 0x80000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d561
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.14001acd0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400a82b0
test edi, 0xfffffffd
jne 0x14000d595
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
mov rdx, qword [0x140119a18]
xor ecx, ecx
call fcn.14001acd0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400a82b0
mov rax, qword [0x1401256f8]
test rax, rax
je 0x14000d5b9
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d5ed
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.14001acd0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400a82b0
test edi, 0xfffffffd
jne 0x14000d621
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
mov rdx, qword [0x140119a18]
xor ecx, ecx
call fcn.14001acd0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400a82b0
mov rax, qword [0x1401256f8]
test rax, rax
je 0x14000d642
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14000d676
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
mov rdx, qword [0x140119a10]
xor ecx, ecx
call fcn.14001acd0
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400a82b0
test edi, 0xfffffffd
jne 0x14000d6aa
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.1400a8238
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
invalid
invalid
invalid
invalid