Function at 0x140004240
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb80]
sub rsp, 0xc80
mov rax, qword [0x140012aa8]
xor rax, rsp
mov qword [rbp + 0xb70], rax
xor eax, eax
mov dword [rbp - 0x80], edx
mov esi, edx
mov dword [rbp - 0x10], r9d
mov rbx, rcx
mov dword [rbp - 0x64], eax
lea rdx, str.print
mov dword [rsp + 0x50], eax
mov rcx, r8
mov dword [rbp - 0x40], eax
lea edi, [rax + 1]
mov dword [rsp + 0x78], eax
mov r14, r8
mov dword [rbp - 0x44], eax
mov r12d, eax
mov dword [rbp - 0x68], eax
mov r13d, eax
mov qword [rsp + 0x70], rax
mov r15d, eax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], rax
mov qword [rbp], rax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x7c], 0x28
mov dword [rbp + 8], 0x208
mov qword [rbp - 8], rax
mov qword [rbp - 0x38], rax
mov word [rbp + 0x38], ax
call fcn.14000b708
xor ecx, ecx
test eax, eax
je 0x14000430c
mov r15d, edi
mov dword [rsp + 0x50], edi
mov edi, ecx
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [0x140010828]
lea rax, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.14000c590
xor ebx, ebx
test eax, eax
jne 0x140004df1
mov rcx, qword [rbp - 0x20]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rdx, r14
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
call fcn.14000c590
test eax, eax
jne 0x140004df1
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdx, [0x140010860]
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
call fcn.14000c590
test eax, eax
jne 0x140004df1
mov rcx, qword [rbp - 0x50]
lea r9, [rsp + 0x54]
lea r8, [rbp - 0x38]
xor edx, edx
call fcn.140003780
test eax, eax
je 0x140004dde
mov rbx, qword [rbp - 0x38]
lea rdx, str.msohtmed.exe
mov rcx, rbx
call fcn.14000bd60
test rax, rax
je 0x1400045f3
mov rcx, rbx
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x18], r12
call fcn.1400089f0
mov edx, 0x104
lea rcx, [rbp + 0x340]
mov r8d, 2
mov rsi, rax
call fcn.1400031b8
test eax, eax
je 0x1400045a0
lea rdx, [rbp + 0x340]
mov rcx, rsi
call fcn.14000b708
test eax, eax
jne 0x14000462d
lea rax, [rbp - 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140010770]
mov rcx, 0xffffffff80000000
call fcn.14000c684
test eax, eax
jne 0x1400045a0
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x60]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.42042206_2D85_11D3_8CFF_005004838597
call fcn.14000c684
test eax, eax
jne 0x1400045a0
mov rcx, qword [rbp - 0x60]
lea rax, [rsp + 0x60]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Version
call fcn.14000c684
test eax, eax
jne 0x1400045a0
mov ebx, r12d
xor edx, edx
jmp 0x140004580
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400044f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x18], r12
lea rdx, [rbp + 0x20]
call fcn.14000c684
test eax, eax
jne 0x14000457c
mov rcx, qword [rbp - 0x18]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x48]
lea rax, [rbp + 0x550]
mov dword [rsp + 0x54], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14000c6f0
test eax, eax
jne 0x14000457c
lea rdx, [rbp + 0x550]
mov rcx, rsi
call fcn.14000b708
test eax, eax
je 0x14000457c
mov edx, 0xa
lea rcx, [rbp + 0x20]
call fcn.14000b60c
cmp eax, 0x10
jae 0x140004629
inc ebx
mov edx, ebx
mov rcx, qword [rsp + 0x60]
lea r8, [rbp + 0x20]
mov r9d, 0xa
call fcn.14000c618
test eax, eax
je 0x1400044e7
mov rbx, qword [rbp - 0x38]
mov r13d, 1
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400045b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
mov qword [rbp - 0x18], r12
test rcx, rcx
je 0x1400045c9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
mov qword [rsp + 0x60], r12
test rcx, rcx
je 0x1400045dd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x70]
mov qword [rbp - 0x60], r12
test rcx, rcx
je 0x1400045f0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rbp - 0x80]
cmp word [rbx], r12w
je 0x140004635
lea rdx, str.fpxpress.exe
mov rcx, rbx
call fcn.14000bd60
test rax, rax
jne 0x140004635
lea rdx, str.winword.exe
mov rcx, rbx
call fcn.14000bd60
test rax, rax
je 0x14000463b
mov r13d, 1
jmp 0x140004654
mov rbx, qword [rbp - 0x38]
mov edi, r12d
jmp 0x1400045a6
mov r13d, 1
cmp dword [rbp + 0xbe0], r12d
je 0x140004654
test r15d, r15d
jne 0x140004654
lea rbx, str.SharePointDesigner.Editor.Document
test esi, esi
je 0x14000465b
lea rbx, str.Word.Document
mov esi, r12d
movsxd r12, r15d
movsxd r15, dword [rbp - 0x80]
mov r8d, 0x104
lea rcx, [rbp + 0x130]
mov rdx, rbx
call fcn.14000b9c0
mov r8d, 0x104
lea rdx, [0x140010578]
lea rcx, [rbp + 0x130]
call fcn.14000b97c
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000000
call fcn.14000c684
test eax, eax
jne 0x140004775
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x48]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x54], 0xc8
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14000c6f0
test eax, eax
jne 0x140004775
lea r8d, [rax + 0x64]
lea rcx, [rbp + 0x60]
test r12, r12
je 0x140004721
lea rdx, str._shell_
call fcn.14000b97c
mov r8d, 0x64
lea rcx, [rbp + 0x60]
mov rdx, r14
jmp 0x140004728
lea rdx, str._shellopen
call fcn.14000b97c
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000473c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x58], 0
lea rax, [rbp - 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, 0xffffffff80000000
call fcn.14000c684
mov ecx, dword [rbp - 0x68]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [rbp - 0x68], ecx
jmp 0x140004778
mov ecx, dword [rbp - 0x68]
xor eax, eax
test ecx, ecx
jne 0x1400047a3
test esi, esi
jne 0x1400047a3
lea rcx, str.SharePointDesigner.Editor.Document
cmp rbx, rcx
jne 0x140004797
lea rbx, str.Word.Document
jmp 0x1400047a3
test r15, r15
jne 0x140004c3e
mov rbx, rcx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400047b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc esi
mov qword [rsp + 0x60], rax
cmp esi, 2
jb 0x140004665
xor r15d, r15d
mov ebx, dword [rbp - 0x80]
lea rdx, [rbp - 0x30]
mov r8d, ebx
lea rcx, [rbp - 0x28]
call fcn.1400077f0
test edi, edi
je 0x1400048a9
test r13d, r13d
je 0x140004899
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x60]
mov esi, 0x20019
mov qword [rbp - 0x60], r15
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r14
call fcn.14000c684
test eax, eax
jne 0x14000488a
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x70]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x70], r15
lea rdx, str.command
call fcn.14000c684
test eax, eax
jne 0x14000487b
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x48]
lea rax, [rbp + 0x550]
mov dword [rsp + 0x54], 0x410
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14000c6f0
test eax, eax
jne 0x14000487b
cmp word [rbp + 0x550], r15w
cmovne edi, r15d
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000488a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140004899
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1400048a9
mov rcx, qword [rbp - 0x28]
mov rdx, r14
call fcn.140002424
mov rcx, qword [rbp - 0x28]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rdx, r14
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call fcn.14000c590
test eax, eax
jne 0x140004dd8
mov rcx, qword [rbp - 0x30]
lea rax, [rsp + 0x68]
mov esi, 0x20019
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r14
call fcn.14000c684
test eax, eax
jne 0x140004ca1
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x18]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140010860]
call fcn.14000c684
test eax, eax
jne 0x140004ca1
test edi, edi
jne 0x140004c5a
mov rcx, qword [rbp - 0x78]
lea rax, [rbp]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.command
call fcn.14000c684
test eax, eax
jne 0x140004c82
mov rcx, qword [rbp]
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x48]
lea rax, [rbp + 0x960]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14000c6f0
test eax, eax
jne 0x140004c82
cmp word [rbp + 0x960], r15w
je 0x140004c82
mov r15d, dword [rsp + 0x78]
mov r13d, r15d
mov esi, dword [rsp + 0x50]
test esi, esi
jne 0x140004a3e
mov r12d, dword [rbp - 0x40]
test r12d, r12d
jne 0x1400049c7
test r15d, r15d
je 0x140004a3e
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x7c]
mov dword [rsp + 0x28], ebx
lea r9, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.140007ac8
test r12d, r12d
mov r12d, 1
je 0x140004a16
mov eax, dword [rsp + 0x7c]
mov r9d, r12d
mov rcx, qword [rbp - 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_RegSetValueExW
test r15d, r15d
je 0x140004a3e
mov eax, dword [rsp + 0x7c]
mov r9d, r12d
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_RegSetValueExW
xor r15d, r15d
test r13d, r13d
je 0x140004aac
lea rax, str.SOFTWAREMicrosoftSharedMHTML
mov qword [rbp - 0x70], r15
test ebx, ebx
lea rdx, str.SOFTWAREMicrosoftSharedHTML
mov r12, 0xffffffff80000001
mov r9d, 0x2001f
cmovne rdx, rax
mov rcx, r12
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.14000c684
test eax, eax
jne 0x140004a93
mov rcx, qword [rbp - 0x70]
lea rdx, str.Default_Editor
call fcn.140002424
mov edx, ebx
mov rcx, r12
call fcn.1400084a4
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140004aac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140004abb
mov eax, dword [rbp - 0x10]
test eax, eax
je 0x140004db3
mov edx, esi
lea rcx, [rbp - 8]
call fcn.14000796c
cmp word [rbp + 0x38], r15w
jne 0x140004aef
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x7c]
mov dword [rsp + 0x28], ebx
lea r9, [rbp + 0x38]
mov r8d, esi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.140007ac8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004aff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x50]
mov qword [rsp + 0x70], r15
test rcx, rcx
je 0x140004b13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
mov rdx, r14
mov qword [rbp - 0x50], r15
call fcn.140002424
mov rcx, qword [rbp - 0x20]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov ebx, 0x2001f
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rdx, r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
call fcn.14000c590
test eax, eax
jne 0x140004dc2
mov eax, dword [rsp + 0x7c]
mov r14d, 1
mov rcx, qword [rsp + 0x70]
mov r9d, r14d
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x38]
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_RegSetValueExW
test eax, eax
jne 0x140004dc2
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdx, [0x140010860]
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
call fcn.14000c590
test eax, eax
jne 0x140004dc2
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp - 0x50]
mov rcx, rdi
call fcn.14000b568
add eax, eax
mov r9d, r14d
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call sub.ADVAPI32.dll_RegSetValueExW
test eax, eax
jne 0x140004dc6
mov ebx, dword [rbp - 0x80]
mov eax, dword [rbp - 0x10]
test r13d, r13d
jne 0x140004c17
test eax, eax
je 0x140004c36
test esi, esi
jne 0x140004c36
mov rdx, qword [rbp - 0x78]
mov r8d, ebx
mov rcx, 0xffffffff80000002
call fcn.1400056a4
test eax, eax
je 0x140004dc6
mov r12d, r14d
jmp 0x140004dc9
mov rcx, qword [rsp + 0x60]
xor r15d, r15d
test rcx, rcx
je 0x1400047c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400047c8
test r13d, r13d
jne 0x140004c82
mov rdx, qword [rbp - 0x78]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call fcn.140002168
mov eax, 1
mov r15d, dword [rsp + 0x78]
mov r13d, eax
jmp 0x1400049ad
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140004c70
mov rdx, qword [rbp - 0x78]
xor r8d, r8d
call fcn.140002168
mov eax, 1
mov dword [rbp - 0x40], eax
jmp 0x140004c75
cmp qword [rsp + 0x68], r15
je 0x140004cc4
mov rcx, qword [rbp - 0x30]
mov rdx, r14
call fcn.140002424
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004cc4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rdx, r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call fcn.14000c590
test eax, eax
jne 0x140004dd8
mov rcx, qword [rbp - 0x78]
lea rax, [rbp + 0x10]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140010860]
call fcn.14000c684
test eax, eax
jne 0x140004d57
test edi, edi
jne 0x140004d5b
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400049a5
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
call fcn.140002168
mov r13d, dword [rbp - 0x44]
lea r15d, [rdi + 1]
jmp 0x1400049ad
test edi, edi
je 0x140004d60
test r13d, r13d
je 0x140004d8a
mov esi, dword [rsp + 0x50]
test esi, esi
jne 0x140004d8e
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140004da1
mov r8, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x78]
call fcn.140002168
lea eax, [rsi + 1]
mov r15d, eax
mov dword [rbp - 0x40], eax
jmp 0x140004dab
mov esi, dword [rsp + 0x50]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140002168
mov r15d, dword [rsp + 0x78]
mov eax, 1
mov r13d, eax
jmp 0x1400049b1
mov rdi, qword [rbp - 8]
mov r14d, 1
jmp 0x140004c0e
mov rdi, qword [rbp - 8]
mov r12d, r15d
test rdi, rdi
je 0x140004de1
mov rcx, rdi
call fcn.140001aa8
jmp 0x140004de1
mov r12d, dword [rbp - 0x64]
jmp 0x140004de1
xor r15d, r15d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140004df4
call fcn.140001aa8
jmp 0x140004df4
xor r15d, r15d
mov rcx, qword [rbp]
test rcx, rcx
je 0x140004e03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
mov qword [rbp], r15
test rcx, rcx
je 0x140004e16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x30], r15
test rcx, rcx
je 0x140004e29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x28], r15
test rcx, rcx
je 0x140004e3c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x20], r15
test rcx, rcx
je 0x140004e4f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x58], r15
test rcx, rcx
je 0x140004e62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
mov qword [rbp - 0x50], r15
test rcx, rcx
je 0x140004e76
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x68], r15
test rcx, rcx
je 0x140004e8a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x78], r15
test rcx, rcx
je 0x140004e9d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x18]
mov qword [rbp + 0x10], r15
test rcx, rcx
je 0x140004eb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
mov qword [rbp + 0x18], r15
test rcx, rcx
je 0x140004ec4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r12d
mov rcx, qword [rbp + 0xb70]
xor rcx, rsp
call fcn.14000db20
mov rbx, qword [rsp + 0xcd8]
add rsp, 0xc80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret