Function at 0x140003c98
Capabilities:
Check if file exists
Query or enumerate registry value
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x388
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x14007f040]
xor rax, rsp
mov qword [rsp + 0x380], rax
call fcn.140003bea
test eax, eax
js 0x140003cf2
mov ecx, ebx
lea rax, [rcx - 0x80000000]
mov esi, 0x80070057
cmp rax, 0xffffffff80000001
jb 0x140003cf4
lea rax, [rcx + rcx]
xor edx, edx
cmp word [rdi + rdx], 0
je 0x140003d21
add rdx, 2
cmp rax, rdx
jne 0x140003ce0
jmp 0x140003cf4
mov esi, eax
mov ecx, 2
call fcn.140004b6b
test al, al
jne 0x140003d5e
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1400174b0
mov eax, esi
add rsp, 0x388
pop rbx
pop rdi
pop rsi
pop r14
ret
mov word [rdi + rdx], 0x5c
lea rcx, [rcx*2 - 2]
cmp rcx, rdx
jne 0x140003d43
add rdi, rdx
mov word [rdi], 0
mov esi, 0x8007007a
jmp 0x140003cf4
mov word [rdi + rdx + 2], 0
xor ecx, ecx
cmp word [rdi + rcx], 0
je 0x140003db5
add rcx, 2
cmp rax, rcx
jne 0x140003d4c
jmp 0x140003cf4
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, 0x1e2
mov r9d, 2
call fcn.140004bc4
mov rcx, rdi
call fcn.140005022
lea rdx, str.Failed_to_get_registered_stub_path:
mov r8d, 0x24
mov rcx, rax
call fcn.14004c59f
mov rcx, rax
mov edx, esi
call fcn.14004b4ea
mov rcx, rdi
call fcn.140004e8a
jmp 0x140003d02
mov rdx, rcx
neg rdx
xor r8d, r8d
lea r9, [0x1400704c8]
lea r10, [rdi + r8]
movzx r11d, word [r8 + r9]
test r11w, r11w
je 0x140003df5
mov word [r10 + rcx], r11w
add rdx, 0xfffffffffffffffe
add r8, 2
mov r10, rax
add r10, rdx
jne 0x140003dc5
sub rdi, rdx
add rdi, 0xfffffffffffffffe
jmp 0x140003d37
mov word [rcx + r10], 0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140003f11
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov esi, 0x8000ffff
cmovs esi, ecx
mov ecx, 2
call fcn.140004b6b
test al, al
je 0x140003d02
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov r8d, 0x1df
mov r9d, 2
call fcn.140004bc4
mov rcx, rbx
call fcn.140005022
lea rdx, str.Invalid_registered_stub_path:
mov r8d, 0x1e
mov rcx, rax
call fcn.14004c59f
mov r14, rax
mov rcx, rdi
call fcn.140033254
mov rcx, r14
mov rdx, rdi
mov r8, rax
call fcn.14004c59f
lea rdx, [0x14006f6d6]
mov r8d, 1
mov rcx, rax
call fcn.14004c59f
mov rcx, rax
mov edx, esi
call fcn.14004b4ea
mov rcx, rbx
jmp 0x140003dab
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x206
mov r9d, 2
call fcn.140004bc4
mov rcx, rdi
call fcn.140005022
lea rdx, str.Failed_to_query_last_stub_path:
mov r8d, 0x20
mov rcx, rax
call fcn.14004c59f
mov rcx, rax
mov edx, esi
call fcn.14004b4ea
mov rcx, rdi
call fcn.140004e8a
jmp 0x140003ff3
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x150]
mov qword [rcx + 8], rax
xor eax, eax
mov qword [rcx], rax
mov dword [rcx + 8], eax
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x2011f
lea r8, str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov rdx, 0xffffffff80000001
xor r9d, r9d
call fcn.14004cb70
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140003ff3
lea rsi, [rsp + 0x170]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140049940
lea r9, [rsp + 0x40]
mov dword [r9], 0xaaaaaaaa
lea rax, [rsp + 0x16c]
mov dword [rax], 0x208
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea rdx, str.LastStubPath
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000400f
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x140004056
mov ecx, 2
call fcn.140004b6b
test al, al
jne 0x140003ebd
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x140003d02
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003d02
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x140004036
mov eax, dword [rsp + 0x16c]
test rax, rax
je 0x140004056
test al, 1
jne 0x140004036
cmp word [rsp + rax + 0x16e], 0
je 0x140004060
mov esi, 0x8007000d
jmp 0x140003fe1
xor esi, esi
jmp 0x140003ff3
mov esi, eax
mov ecx, 2
call fcn.140004b6b
test al, al
je 0x140003ff3
jmp 0x14000418c
mov word [rsp + 0x170], 0
lea rcx, [rsp + 0x170]
mov rdx, rdi
call fcn.1400331b4
test eax, eax
je 0x14000403d
call fcn.140016820
test eax, eax
js 0x140004041
test rdi, rdi
je 0x1400040db
mov rcx, rdi
call fcn.140033254
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x150]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rdx, str.LastStubPath
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jle 0x1400040e2
movzx esi, si
or esi, 0x80070000
mov ecx, 2
call fcn.140004b6b
test al, al
je 0x140003ff3
jmp 0x140004152
mov esi, 0x8007000d
jmp 0x1400040c7
js 0x1400040c7
xor esi, esi
xor ecx, ecx
call fcn.140004b6b
test al, al
je 0x140003ff3
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rbx, [rsp + 0x40]
xor esi, esi
mov rcx, rbx
mov r8d, 0x1fd
xor r9d, r9d
call fcn.140004bc4
mov rcx, rbx
call fcn.140005022
lea rdx, str.Updated_last_stub_path_to
mov r8d, 0x1a
mov rcx, rax
call fcn.14004c59f
mov r14, rax
mov rcx, rdi
call fcn.140033254
mov rcx, r14
mov rdx, rdi
mov r8, rax
call fcn.14004c59f
mov rcx, rbx
jmp 0x140003f07
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x1ff
mov r9d, 2
call fcn.140004bc4
mov rcx, rdi
call fcn.140005022
lea rdx, str.Failed_to_update_last_stub_path:
mov r8d, 0x21
jmp 0x140003ef2
lea rdx, str....._third_partyie_to_edge_bhoie_to_edge_util.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x202
mov r9d, 2
call fcn.140004bc4
mov rcx, rdi
call fcn.140005022
lea rdx, str.Failed_to_refresh_elevation_policy:
mov r8d, 0x24
jmp 0x140003ef2