Function at 0x140002db4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x318]
sub rsp, 0x3e0
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov edi, r8d
mov rsi, rdx
mov r14d, ecx
mov dword [rsp + 0x48], r14d
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, rcx, 0x3b9aca00
add rdx, rax
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rdx
lea r13d, [rax + 1]
mov byte [rbp - 0x60], r13b
lea r9, [rbp - 0x78]
mov edx, dword [0x140048628]
lea rcx, [rbp - 0x48]
call fcn.1400102b0
mov edx, edi
and edx, r13d
mov dword [rsp + 0x50], edx
mov ecx, edi
and ecx, 2
mov dword [rsp + 0x38], ecx
mov r12d, edi
and r12d, 4
mov eax, edi
and eax, 8
mov dword [rbp - 0x54], eax
mov ebx, edi
and ebx, 0x10
mov dword [rbp - 0x50], ebx
mov r8d, edi
and r8d, 0x20
mov dword [rsp + 0x30], r8d
mov eax, edi
and eax, 0x40
mov dword [rbp - 0x58], eax
mov eax, edi
and eax, 0x200
mov dword [rsp + 0x58], eax
xor r10d, r10d
mov r15d, r10d
mov eax, edi
shr eax, 0xb
not al
and al, r13b
mov dword [rbp - 0x80], eax
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x68], r10
mov dword [rbp - 0x7c], 0x208
mov eax, edi
bt edi, 8
lea r9, str.Show
lea r13, str.open
cmovb r13, r9
lea r9, [0x140048290]
test edx, edx
cmovne r13, r9
lea rdx, str.ViewProtected
and al, 0x80
cmovne r13, rdx
lea rax, str.OpenAsReadOnly
test r8d, r8d
cmovne r13, rax
lea rax, [0x140048368]
test ecx, ecx
cmovne r13, rax
lea rax, str.edit
test ebx, ebx
cmovne r13, rax
mov rcx, rsi
call fcn.14000be74
lea rcx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
lea rdx, str.Param
xor edi, edi
test eax, eax
je 0x140002f80
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rdx
lea rax, str.Original_File_Name
mov qword [rbp - 0x68], rax
mov word [rbp - 0x60], di
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8c9
mov r8d, 0xc8
call fcn.14000262c
nop
nop dword [rax]
lea r8, str.WinWord
test r12d, r12d
je 0x140002fc8
mov rcx, qword [rsi + 0x18]
xor r12d, r12d
test rcx, rcx
je 0x140002fa4
call fcn.1400027dc
lea r8, str.WinWord
cmp r14d, 0xa
jae 0x140002fbf
lea rcx, [r14 + r14*4]
add rcx, rcx
xor edx, edx
mov rcx, qword [r8 + rcx*8 + 0x18]
call fcn.14000dccc
jmp 0x140002fc2
mov rax, r12
mov qword [rsi + 0x18], rax
jmp 0x140002fcb
xor r12d, r12d
cmp r14d, 0xffffffff
je 0x140002fde
mov edi, r14d
cmp r14d, 9
jne 0x14000310f
mov rcx, qword [rsi + 0x18]
mov edi, r14d
test rcx, rcx
je 0x140003007
mov edx, r12d
cmp dword [rbp - 0x58], r12d
setne dl
call fcn.14000d768
cmp eax, 0xffffffff
je 0x140003007
mov r14d, eax
mov dword [rsp + 0x48], eax
mov edi, eax
cmp edi, 9
jne 0x14000310f
mov rcx, rsi
call fcn.140005178
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003029
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000303a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000304b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003060
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop dword [rax]
cmp byte [rbp - 0x48], r12b
je 0x140003108
mov ebx, dword [rbp - 0x28]
mov word [rsp + 0x30], bx
mov edx, 0x18
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rdi, qword [rdx + rcx]
test rdi, rdi
je 0x140003108
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rsp + 0x58]
cmp rax, qword [rdi + 8]
je 0x140003108
lea rsi, [rax + 0x18]
test rsi, rsi
je 0x140003108
cmp byte [rbp - 0x38], r12b
je 0x1400030f2
mov word [rsp + 0x30], bx
test rdi, rdi
je 0x1400030f2
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rsp + 0x58]
cmp rax, qword [rdi + 8]
je 0x1400030f2
lea rdx, [rax + 0x18]
test rdx, rdx
je 0x1400030f2
mov rcx, qword [rbp - 0x30]
call fcn.140010188
nop
xor edx, edx
mov ecx, ebx
call fcn.140012d88
mov rdx, rsi
mov rcx, qword [rbp - 0x40]
call fcn.140010188
nop
xor eax, eax
jmp 0x14000389b
cmp dword [rbp - 0x54], r12d
je 0x1400032c2
mov rcx, rsi
call fcn.140006c14
mov r12, rax
mov rcx, rax
call fcn.14000bc00
nop dword [rax]
test eax, eax
jne 0x1400032bf
mov rcx, r12
call fcn.14000bb98
test eax, eax
je 0x14000328d
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14000328a
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140002c98
test eax, eax
je 0x1400032b4
lea rdx, [rbp - 0x10]
cmp word [rbp - 0x10], r15w
cmove rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x1400032b4
nop dword [rax]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.shell
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
test eax, eax
jne 0x1400032b4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rdx, r13
mov rcx, qword [rsp + 0x78]
call fcn.14000e39c
test eax, eax
jne 0x1400032b4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.command
mov rcx, qword [rsp + 0x70]
call fcn.14000e39c
test eax, eax
jne 0x1400032b4
movzx eax, byte [rbp + 0xc0]
cmp dword [rsp + 0x60], 1
cmove eax, r15d
mov byte [rbp + 0xc0], al
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400032b4
mov rax, r12
mov r8d, r15d
test r12, r12
je 0x140003271
cmp word [r12], r15w
je 0x140003271
lea rax, [rax + 2]
inc r8d
cmp word [rax], r15w
jne 0x140003264
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, r12
lea rcx, [rbp + 0xc0]
call fcn.140004a90
jmp 0x1400032b4
mov ebx, dword [rbp - 0x50]
call fcn.14000f440
neg ebx
sbb rdx, rdx
lea r13, str.edit
and rdx, r13
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, r12
xor ecx, ecx
call fcn.14000f34c
nop
mov r15d, 1
jmp 0x140003793
xor r12d, r12d
cmp edi, 1
jne 0x140003324
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1400032dc
mov rcx, rbx
call fcn.14000d850
cmp eax, edi
je 0x140003324
mov rcx, qword [rsi + 0x10]
call fcn.14000bc00
test eax, eax
jne 0x1400032f5
mov rcx, qword [rsi]
call fcn.14000bc00
test eax, eax
je 0x140003324
test rbx, rbx
je 0x140003303
mov rcx, rbx
call fcn.1400027dc
nop
xor edx, edx
lea rcx, str.Excel.WebQuery
call fcn.14000dccc
mov qword [rsi + 0x18], rax
lea r13, str.edit
mov rbx, rax
jmp 0x1400033ad
mov r12, qword [rsi + 0x18]
mov rbx, r12
test r12, r12
je 0x14000337a
cmp edi, 0xffffffff
je 0x140003375
mov rcx, r12
call fcn.14000d850
cmp edi, eax
je 0x140003375
mov rcx, r12
call fcn.1400027dc
cmp edi, 0xa
jae 0x14000336c
mov eax, edi
lea rcx, [rax + rax*4]
add rcx, rcx
xor edx, edx
lea rax, str.WinWord
mov rcx, qword [rax + rcx*8 + 0x18]
call fcn.14000dccc
jmp 0x14000336e
xor eax, eax
mov rbx, rax
mov qword [rsi + 0x18], rax
xor r12d, r12d
jmp 0x1400033ad
cmp edi, 0xa
jae 0x1400033a3
mov eax, edi
lea rcx, [rax + rax*4]
add rcx, rcx
xor edx, edx
lea rax, str.WinWord
mov rcx, qword [rax + rcx*8 + 0x18]
call fcn.14000dccc
mov rbx, rax
xor r12d, r12d
jmp 0x1400033a9
xor r12d, r12d
mov ebx, r12d
mov qword [rsi + 0x18], rbx
cmp edi, 0xffffffff
je 0x140003721
test rbx, rbx
je 0x140003721
cmp word [rbx], r12w
je 0x140003721
cmp edi, 4
mov edi, dword [rsp + 0x50]
jne 0x1400033da
test edi, edi
jne 0x140003721
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x78], rax
lea rax, str.Param
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x60], r12w
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, str.FHevActivateApp:
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8cb
mov r8d, 0x64
call fcn.14000262c
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140002c98
test eax, eax
je 0x140003721
lea rdx, [rbp - 0x10]
cmp word [rbp - 0x10], r12w
cmove rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x140003721
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.shell
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
test eax, eax
jne 0x140003721
test edi, edi
jne 0x140003574
mov r12d, dword [rsp + 0x38]
test r12d, r12d
je 0x1400034c2
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140002b30
mov r14d, dword [rsp + 0x48]
test eax, eax
je 0x14000350d
mov edx, r14d
mov rcx, rsi
call fcn.14000bd6c
test eax, eax
je 0x14000350d
cmp r14d, 2
jne 0x140003500
mov rcx, rsi
call fcn.14000bd6c
test eax, eax
je 0x140003500
mov dword [rsp + 0x20], r15d
mov r8d, edx
mov r9, rsi
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call fcn.1400039dc
jmp 0x140003713
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x20], eax
mov r8d, r14d
jmp 0x1400034eb
movzx ebx, byte [rbp - 0x80]
mov dword [rsp + 0x20], ebx
mov r9, rsi
mov r8d, r14d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call fcn.1400039dc
mov r15d, eax
test eax, eax
jne 0x140003793
mov r13d, dword [rsp + 0x30]
test r12d, r12d
jne 0x14000372b
test r13d, r13d
jne 0x140003793
cmp r14d, 4
je 0x140003734
mov dword [rsp + 0x20], ebx
mov r9, rsi
mov r8d, r14d
lea rdx, [0x140047140]
mov rcx, qword [rsp + 0x40]
call fcn.1400039dc
jmp 0x140003718
mov rcx, rsi
call fcn.140006c14
mov rdi, rax
mov r12d, dword [rsp + 0x38]
xor r10d, r10d
test r12d, r12d
je 0x1400036e0
test rax, rax
je 0x1400035b2
cmp word [rax], r10w
je 0x1400035b2
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x1400036e0
cmp word [rax], r10w
je 0x1400036e0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rdx, r13
mov rcx, qword [rsp + 0x78]
call fcn.14000e39c
xor r13d, r13d
test eax, eax
jne 0x140003726
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.command
mov rcx, qword [rsp + 0x70]
call fcn.14000e39c
test eax, eax
jne 0x140003726
movzx eax, byte [rbp + 0xc0]
lea ebx, [r13 + 1]
cmp dword [rsp + 0x60], ebx
cmove eax, r13d
mov byte [rbp + 0xc0], al
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003726
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp - 0x78], rax
lea rax, str.Param
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x68], rax
mov word [rbp - 0x60], r13w
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, str.FHevActivateApp:_Before_FSimpleSpawn_with
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170a8cc
lea r8d, [r13 + 0x64]
call fcn.14000262c
mov rcx, qword [rsi + 0x28]
mov rax, rdi
mov r8d, r13d
test rdi, rdi
je 0x1400036b8
cmp word [rdi], r13w
je 0x1400036b8
lea rax, [rax + 2]
add r8d, ebx
cmp word [rax], r13w
jne 0x1400036ab
mov qword [rsp + 0x20], rcx
mov r9, qword [rsi + 0x20]
mov rdx, rdi
lea rcx, [rbp + 0xc0]
call fcn.140004a90
jmp 0x140003713
cmp r14d, 2
jne 0x1400036f9
mov edx, r14d
mov rcx, rsi
call fcn.14000bd6c
test eax, eax
jne 0x1400032b4
mov r9d, dword [rsp + 0x50]
mov r8, rdi
lea rdx, str.print
mov rcx, qword [rsp + 0x40]
call fcn.1400049a0
nop
mov r13d, dword [rsp + 0x30]
mov r15d, eax
test eax, eax
jne 0x140003793
jmp 0x14000372b
mov r12d, dword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
test r13d, r13d
jne 0x140003793
mov edi, dword [rsp + 0x50]
xor r13d, r13d
cmp dword [rsp + 0x58], r13d
jne 0x140003793
test edi, edi
je 0x140003746
mov bl, 2
jmp 0x140003759
mov eax, 1
movzx ebx, al
mov eax, 3
test r12d, r12d
cmovne ebx, eax
mov r8b, bl
mov rdx, rsi
lea rcx, str.Default_Editor
call fcn.140005258
test eax, eax
jne 0x140003793
mov r8b, bl
mov rdx, rsi
lea rcx, str.Old_Default_Editor
call fcn.140005258
test eax, eax
jne 0x140003793
cmp bl, 2
je 0x140003793
mov rcx, rsi
call fcn.140005178
nop
mov rcx, qword [rsp + 0x68]
xor esi, esi
test rcx, rcx
je 0x1400037a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400037bc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x70], rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400037d2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x78], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400037e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x40], rsi
cmp byte [rbp - 0x48], sil
je 0x140003898
mov ebx, dword [rbp - 0x28]
mov word [rsp + 0x30], bx
mov edx, 0x18
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rdi, qword [rdx + rcx]
test rdi, rdi
je 0x140003898
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rsp + 0x58]
cmp rax, qword [rdi + 8]
je 0x140003898
lea rsi, [rax + 0x18]
xor r14d, r14d
test rsi, rsi
je 0x140003898
cmp byte [rbp - 0x38], r14b
je 0x140003882
mov word [rsp + 0x30], bx
test rdi, rdi
je 0x140003882
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14001042c
mov rax, qword [rsp + 0x58]
cmp rax, qword [rdi + 8]
je 0x140003882
lea rdx, [rax + 0x18]
test rdx, rdx
je 0x140003882
mov rcx, qword [rbp - 0x30]
call fcn.140010188
nop
xor edx, edx
mov ecx, ebx
call fcn.140012d88
mov rdx, rsi
mov rcx, qword [rbp - 0x40]
call fcn.140010188
nop
mov eax, r15d
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14003ee60
mov rbx, qword [rsp + 0x438]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret