Function at 0x14002b530
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2f8]
sub rsp, 0x3d0
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov rdi, r9
mov rsi, qword [rbp + 0x320]
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea r8, str.CPhoneIF::GetWin32AppInstalledPath
mov qword [rbp + 0x70], r8
lea r15, str.HotkeyPhoneIFPhoneIF.cpp
mov qword [rbp + 0x78], r15
mov dword [rbp + 0x80], 0x9b
lea r12, str.__CPhoneIF::GetWin32AppInstalledPath_
mov qword [rbp + 0x88], r12
lea r13, [0x14004b4ac]
mov qword [rbp + 0x90], r13
mov dword [rbp + 0x98], 3
lea rdx, str.ENTER__s
lea rcx, [rbp + 0x78]
call fcn.1400028a0
nop
xor r14d, r14d
mov qword [rbp + 0x60], r14
mov word [rbp + 0xb0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xb2]
call fcn.140032580
mov dword [rbp + 0x68], 0x208
call fcn.140006120
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14002b640
mov ecx, 0x80004005
call fcn.140006240
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xa0], rbx
lea rax, str.Teams
test rax, rax
jne 0x14002b694
mov edi, 0x80004003
mov qword [rbp - 0x20], r15
mov dword [rbp - 0x18], 0xa2
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r13
mov dword [rbp], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x20]
call fcn.1400028a0
jmp 0x14002b864
lea rax, str.CurrentTeams.exe
test rax, rax
jne 0x14002b6d8
mov edi, 0x80004003
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0xa3
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r13
mov dword [rbp - 0x78], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_X
lea rcx, [rsp + 0x68]
call fcn.1400028a0
jmp 0x14002b864
mov rcx, rsi
call fcn.140005cf0
mov rcx, rdi
call fcn.140005cf0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete al
test al, al
jne 0x14002b751
mov edi, 0x80004005
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0xa8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_X
lea rcx, [rsp + 0x40]
call fcn.1400028a0
jmp 0x14002b864
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.InstallLocation
lea rdx, str.Teams
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
test al, al
jne 0x14002b7c6
mov edi, 0x80004005
mov qword [rbp + 0x30], r15
mov dword [rbp + 0x38], 0xaf
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r13
mov dword [rbp + 0x50], r14d
mov r8d, edi
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp + 0x30]
call fcn.1400028a0
jmp 0x14002b864
lea r8, [rbp + 0xb0]
lea rdx, [0x14005dac8]
mov rcx, rdi
call fcn.140023e40
lea r9, str.CurrentTeams.exe
lea r8, [rbp + 0xb0]
lea rdx, str._s_s
mov rcx, rsi
call fcn.140023e40
mov qword [rbp + 8], r15
mov dword [rbp + 0x10], 0xb3
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov dword [rbp + 0x28], 3
mov r9, qword [rdi]
lea r8, str.strPath
lea rdx, str._s___s
lea rcx, [rbp + 8]
call fcn.1400028a0
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], 0xb4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x28], 3
mov r9, qword [rsi]
lea r8, str.strFullName
lea rdx, str._s___s
lea rcx, [rbp - 0x48]
call fcn.1400028a0
mov edi, r14d
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x14002b877
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x60], r14
mov qword [rbp - 0x70], r15
mov dword [rbp - 0x68], 0xb9
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r13
mov dword [rbp - 0x50], 3
lea rax, str.successfully
lea r8, str.failed
test edi, edi
cmove r8, rax
lea rdx, str.Get_Win32_App_installed_path__s
lea rcx, [rbp - 0x70]
call fcn.1400028a0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002b8cc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov r8, qword [rbp + 0x70]
lea rdx, str.LEAVE__s
lea rcx, [rbp + 0x78]
call fcn.1400028a0
mov eax, edi
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret