Function at 0x140003fc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.14017a5e0
sub rsp, rax
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1168], rbx
mov rax, qword [0x1402388b0]
xor rax, rsp
mov qword [rbp + 0x1010], rax
mov ebx, r8d
mov dword [rsp + 0x38], ebx
mov r14d, edx
mov r15, rcx
xor esi, esi
lea r12d, [rsi + 1]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea rcx, str.Try_to_find_Office_application...
call fcn.140006670
mov ecx, r14d
dec ecx
je 0x140004059
dec ecx
je 0x140004050
dec ecx
je 0x140004047
dec ecx
jne 0x140004059
lea rcx, [r15 + 0x1f8]
jmp 0x14000405c
lea rcx, [r15 + 0x150]
jmp 0x14000405c
lea rcx, [r15 + 0xa8]
jmp 0x14000405c
mov rcx, r15
lea rdx, [rbp - 0x30]
call fcn.140003500
nop
mov r8d, 6
lea rcx, [rbp - 0x30]
call fcn.140005230
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400047fc
call fcn.140006cbc
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400040c7
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov dword [rbp - 0x80], 0x104
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140004106
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140005a40
mov rbx, qword [rsp + 0x40]
lea r9, [rbp - 0x80]
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r13d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140177580
test eax, eax
js 0x1400047f1
cmp eax, dword [rbx - 0xc]
jg 0x1400047f1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
test r13d, r13d
jne 0x1400047c3
mov word [rbp + 0x10], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x12]
call fcn.1401793b0
mov r9, rbx
lea r8, str.CLSID_:__s
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.140178534
lea rcx, [rbp + 0x10]
call fcn.140006670
call fcn.140006cbc
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400041a1
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, str.LocalServer32
mov rax, rcx
shr rax, 0x10
mov qword [rbp - 0x58], rax
test rax, rax
jne 0x1400041eb
movzx ebx, cx
mov ecx, ebx
call fcn.140007d0c
test rax, rax
je 0x1400041ff
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400056c0
jmp 0x1400041ff
mov r8d, 0xe
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140005aa0
nop
call fcn.140006cbc
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000421e
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, str.CLSID_
mov r13, rax
shr r13, 0x10
test r13, r13
jne 0x140004264
movzx ebx, ax
mov ecx, ebx
call fcn.140007d0c
test rax, rax
je 0x140004278
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400056c0
jmp 0x140004278
mov r8d, 6
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140005aa0
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.1400050a0
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400050a0
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9d, dword [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400042db
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400042f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000430e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140004327
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140006cbc
mov rdx, rax
mov ecx, esi
test ebx, ebx
jne 0x140004646
test rax, rax
setne cl
test ecx, ecx
jne 0x14000434e
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rbp - 0x7c], 0x104
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14000438d
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140005a40
mov rbx, qword [rsp + 0x50]
lea r9, [rbp - 0x7c]
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140177580
test eax, eax
js 0x14000463b
cmp eax, dword [rbx - 0xc]
jg 0x14000463b
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140005800
nop
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx - 0x10]
test edx, edx
jns 0x1400043ec
mov ecx, 0x80070057
call fcn.140005b90
int3
mov r8d, r12d
sub r8d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edx
or eax, r8d
jge 0x14000440c
lea rcx, [rsp + 0x30]
call fcn.140005a40
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
mov rcx, qword [rsp + 0x30]
movsxd rdx, dword [rcx - 0xc]
call fcn.140177580
mov rcx, rax
test eax, eax
js 0x140004630
mov rax, qword [rsp + 0x30]
cmp ecx, dword [rax - 0xc]
jg 0x140004630
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax + rcx*2], si
lea r8, [0x1401fe8c8]
lea rdx, [0x1401fe5e0]
lea rcx, [rsp + 0x30]
call fcn.140004cc0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140004488
mov rdx, qword [rsp + 0x30]
lea rcx, str.File_path:__s
call fcn.140006740
mov r12d, esi
jmp 0x1400045c8
dec r14d
je 0x1400044b7
dec r14d
je 0x1400044ae
dec r14d
je 0x1400044a5
dec r14d
jne 0x1400044b7
lea rcx, [r15 + 0x1f8]
jmp 0x1400044ba
lea rcx, [r15 + 0x150]
jmp 0x1400044ba
lea rcx, [r15 + 0xa8]
jmp 0x1400044ba
mov rcx, r15
lea rdx, [rbp - 0x10]
call fcn.140003540
nop
cmp qword [rax + 0x18], 8
jb 0x1400044ce
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140005800
nop
cmp qword [rbp + 8], 8
jb 0x1400044eb
mov rcx, qword [rbp - 0x10]
call fcn.14000682c
mov qword [rbp + 8], 7
mov qword [rbp], rsi
mov word [rbp - 0x10], si
mov rdx, qword [rbp - 0x78]
test rdx, rdx
je 0x14000458d
cmp dword [rbx - 0x10], 0
jl 0x14000458d
mov rcx, rbx
call fcn.14017765c
test rax, rax
je 0x14000458d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000458d
mov rcx, qword [rbp - 0x78]
mov r8d, dword [rcx - 0x10]
add r8d, eax
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call fcn.140005000
nop
mov rdx, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.140005800
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.140005570
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140004575
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000458d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400045b0
mov rdx, qword [rsp + 0x30]
lea rcx, str.File_path:__s
call fcn.140006740
mov r12d, esi
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400045c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x38], esi
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
cmp dword [rsp + 0x38], 6
setne al
mov byte [r15 + 0x2a0], al
lea rcx, [0x1401fe608]
lea rdx, [0x1401fe610]
test al, al
cmovne rdx, rcx
lea rcx, str.Binary_Type:__s
call fcn.140006740
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140004626
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
jmp 0x14000479d
mov ecx, 0x80070057
call fcn.140005b90
nop
mov ecx, 0x80070057
call fcn.140005b90
nop
test rax, rax
setne cl
test ecx, ecx
jne 0x14000465b
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, str.LocalServer32
cmp qword [rbp - 0x58], 0
jne 0x14000469c
movzx ebx, dx
mov ecx, ebx
call fcn.140007d0c
test rax, rax
je 0x1400046ad
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400056c0
jmp 0x1400046ad
mov r8d, 0xe
lea rcx, [rsp + 0x68]
call fcn.140005aa0
nop
call fcn.140006cbc
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x1400046cb
mov ecx, 0x80004005
call fcn.140005b90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.CLSID_
test r13, r13
jne 0x140004707
movzx ebx, dx
mov ecx, ebx
call fcn.140007d0c
test rax, rax
je 0x140004718
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400056c0
jmp 0x140004718
mov r8d, 6
lea rcx, [rsp + 0x58]
call fcn.140005aa0
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x60]
call fcn.1400050a0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400050a0
mov rdx, qword [rax]
lea rcx, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
call fcn.140006740
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140004765
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000477e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140004798
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400047b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
jmp 0x1400047cf
lea rcx, str.Cannot_get_CLSID_value
call fcn.140006670
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000484d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000484d
mov ecx, 0x80070057
call fcn.140005b90
nop
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
mov word [rbp + 0x810], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x812]
call fcn.1401793b0
mov r9, rbx
lea r8, str.Cannot_open_registry_key_:_HKEY_CLASSES_ROOT_s
mov edx, 0x400
lea rcx, [rbp + 0x810]
call fcn.140178534
lea rcx, [rbp + 0x810]
call fcn.140006670
nop
cmp qword [rbp - 0x18], 8
jb 0x14000485d
mov rcx, qword [rbp - 0x30]
call fcn.14000682c
mov eax, r12d
mov rcx, qword [rbp + 0x1010]
xor rcx, rsp
call fcn.140176ca0
mov rbx, qword [rsp + 0x1168]
add rsp, 0x1120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret