Function at 0x140074d40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rbx, rcx
test dword [0x14017cb40], 0x200
je 0x140074d84
mov r8, rcx
lea rdx, [0x1400fe3c8]
mov rcx, qword [0x14017cb48]
call fcn.140065ee8
mov r14d, 1
mov byte [0x14017cc78], r14b
xor r15d, r15d
mov edi, r15d
cmp qword [rbx + 0xa8], r15
je 0x140074daa
mov ecx, 0x1c084d
call fcn.14002cdf4
cmp byte [rbx + 0x193], r15b
je 0x140074dbd
mov ecx, 0x1c084e
call fcn.14002cdf4
mov byte [rbx + 0x193], r15b
cmp dword [rbx + 0x60], r15d
je 0x140074dd4
mov ecx, 0x1c084f
call fcn.14002cdf4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov esi, 0x50
mov r8d, esi
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.MSVCR100.dll_memset
mov dword [rsp + 0x80], esi
lea rax, [0x140075884]
mov qword [rsp + 0x88], rax
lea rax, str.OfficePowerManagerWindow
mov qword [rbp - 0x50], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140074e32
mov edi, 0x80004005
jmp 0x140075453
mov byte [rbx + 0x190], r14b
xor ecx, ecx
call fcn.14007763c
lea r11, [rbp + 0x28]
mov qword [rsp + 0x20], r11
mov r12d, 0x20019
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0CommonDebug_
mov r13, 0xffffffff80000001
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 4
test eax, eax
jne 0x140074ec1
mov dword [rbp + 0x18], esi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.DiscardableCacheTimerIntervalMilliseconds
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
mov edx, 0x3a98
test eax, eax
cmovne ecx, edx
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rbp + 0x10]
jmp 0x140074ec6
mov edx, 0x3a98
mov eax, 0x2710
cmp edx, eax
cmovb edx, eax
mov dword [rbx + 0x2e0], edx
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0CommonDebug_
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140074f46
mov dword [rbp + 0x18], esi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.DiscardableCacheDefaultTimeoutMilliseconds
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
mov esi, 0x7530
test eax, eax
cmovne ecx, esi
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rbp + 0x10]
jmp 0x140074f4e
mov esi, 0x7530
mov r11d, esi
mov dword [rbx + 0x2dc], r11d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0CommonDebug_
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140074fc5
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.DiscardableCacheDisableCallbacks
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
test eax, eax
cmovne ecx, r15d
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rbp + 0x10]
jmp 0x140074fc8
mov r11d, r15d
mov dword [rbx + 0x2e4], r11d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0CommonDebug_
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007503f
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.DiscardableCacheDontQueueCallbacks
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
test eax, eax
cmovne ecx, r15d
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rbp + 0x10]
jmp 0x140075042
mov r11d, r15d
mov dword [rbx + 0x2e8], r11d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x8000000
lea r8, str.OfficePowerManagerWindow
lea rdx, str.OfficePowerManagerWindow
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x140074e28
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0Common_
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140075109
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.AppUserIdleTimerInterval
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
test eax, eax
cmovne ecx, esi
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rbp + 0x10]
mov eax, esi
mov qword [rbx + 0x1e8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice15.0Common_
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140075185
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.AppUserIdleResetInterval
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x10]
mov edx, 0x1f4
test eax, eax
cmovne ecx, edx
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rbp + 0x10]
jmp 0x14007518a
mov edx, 0x1f4
mov eax, edx
mov qword [rbx + 0x1e0], rax
mov r12d, 0xffffffff
mov r13d, 5
cmp byte [0x140163078], r15b
je 0x14007521f
xor edx, edx
mov rcx, qword [rbx + 0xa8]
call fcn.14007547c
test al, al
je 0x140074e28
mov rax, qword [rbx + 0x1e8]
cmp rax, r12
ja 0x14007520a
mov dword [rbp + 0x18], eax
mov dword [rbp + 0x1c], 0xfff
mov edx, r13d
mov ecx, 0x105
cmp byte [rbx + 0x194], r15b
cmovne edx, ecx
xor r9d, r9d
lea r8, [rbp + 0x18]
mov rcx, qword [rbx + 0xa8]
call fcn.140094d5c
test rax, rax
jne 0x14007521f
mov ecx, 0x1c0852
call fcn.14002cdf4
jmp 0x14007521f
mov dword [rbp + 0x10], r14d
lea rdx, [0x14010c5f0]
lea rcx, [rbp + 0x10]
call sub.MSVCR100.dll__CxxThrowException
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, rbx
mov edx, 0xffffffeb
mov rcx, qword [rbx + 0xa8]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
test rax, rax
jne 0x14007524f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140074e28
mov dword [rbp + 0x10], 0x1388
mov dword [rbp + 0x14], 0x2710
mov edx, 7
mov ecx, 0x107
cmp byte [rbx + 0x194], r15b
cmovne edx, ecx
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rcx, qword [rbx + 0xa8]
call fcn.140094d5c
test rax, rax
jne 0x14007529b
mov ecx, 0x1c0853
call fcn.14002cdf4
mov rcx, rbx
call fcn.140076870
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140077498
nop
cmp qword [rbx + 0xb0], r15
je 0x1400752ec
cmp qword [rbx + 0xb8], r15
je 0x1400752ec
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x18]
mov rcx, rbx
call fcn.140074840
mov ecx, dword [rax]
shr ecx, 0xb
and cl, r14b
je 0x1400752df
mov rcx, qword [rbx + 0xb0]
jmp 0x1400752e6
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov word [rbx + 0x191], 0x101
lea rcx, [rsp + 0x68]
call fcn.140077504
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov qword [rbx + 0x1f0], rax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov qword [rbx + 0x1f8], rax
cmp qword [rbx + 0x1f0], r15
je 0x14007532c
test rax, rax
jne 0x140075336
mov ecx, 0x1c0854
call fcn.14002cdf4
mov rcx, qword [rbx + 0x1f0]
test rcx, rcx
je 0x140075400
cmp qword [rbx + 0x1f8], r15
je 0x1400753ee
mov ecx, 0x20
call fcn.14005e974
test rax, rax
je 0x140075372
mov rdx, rbx
mov rcx, rax
call fcn.140077258
mov rsi, rax
jmp 0x140075375
mov rsi, r15
test rsi, rsi
jne 0x140075386
mov ecx, 0x1c0855
call fcn.14002cdf4
jmp 0x1400753c2
lea r8, [rsi + 0x10]
mov rcx, qword [rbx + 0xa0]
lea r14, [rbx + 0x200]
mov rax, qword [rcx]
mov r9, r14
mov edx, 0x2101
call qword [rax + 0x28]
test eax, eax
js 0x1400753c2
mov rcx, qword [r14]
mov rax, qword [rcx]
mov r8d, r12d
mov rdx, qword [rbx + 0x1f0]
call qword [rax + 0xd8]
jmp 0x1400753dd
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
jne 0x1400753dd
mov ecx, 0x1c0856
call fcn.14002cdf4
test rsi, rsi
je 0x140075419
lea rcx, [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140075419
test rcx, rcx
je 0x140075400
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x1f0], r15
mov rcx, qword [rbx + 0x1f8]
test rcx, rcx
je 0x140075419
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x1f8], r15
mov r9d, dword [0x14017caf8]
xor r8d, r8d
lea rdx, [0x140077738]
mov ecx, r13d
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x2f0], rax
test rax, rax
jne 0x140075453
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140075453
mov ecx, 0x24a759
call fcn.14002cdf4
cmp byte [rbx + 0x192], r15b
jne 0x140075464
mov rcx, rbx
call fcn.140074a28
mov eax, edi
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret