Function at 0x14003a930
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x390
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140119ad0]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rsi, rdx
mov qword [rsp + 0x38], rdx
mov r15, rcx
mov qword [rsp + 0x58], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov rdi, qword [rcx + 8]
mov dword [rbp - 0x14], r14d
mov bl, r14b
lea r12d, [r14 + 4]
mov dword [rbp + 0x68], r12d
mov dword [rbp - 0x18], r14d
mov dword [rbp - 0x20], r12d
mov qword [rbp + 0x50], r14
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftHvsiOffice
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ecx, ax
mov r13d, 0x80070000
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003aa1b
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, str.OfficeWDAGEnabledOnHost
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003aa1b
cmp dword [rbp - 0x18], 1
sete bl
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14003aa2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14003aa66
lea r8, [rbp - 0x14]
lea rdx, str.AppMan_UEV_Subscription_Active
mov rcx, qword [rdi]
call fcn.140029a00
test eax, eax
jns 0x14003aa5b
test byte [0x14011b240], r12b
je 0x14003aa56
mov r8d, eax
call fcn.140039990
mov eax, r14d
jmp 0x14003aa5e
mov eax, dword [rbp - 0x14]
test eax, eax
je 0x14003b254
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.14003b4c0
mov eax, 7
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x40], r14
mov word [rbp + 0x30], r14w
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x90], r14
mov word [rbp + 0x80], r14w
xor r8d, r8d
lea rdx, [0x1400cfda0]
lea rcx, [rbp + 0x80]
call fcn.140006180
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r14
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
lea rcx, [rbp + 0x140]
call fcn.14003a09c
nop
xor r9d, r9d
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x140]
call fcn.140051abc
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x140]
call fcn.140051e30
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x30]
call fcn.14003a89c
test al, al
jne 0x14003b21f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea rbx, [r15 + 0x18]
cmp byte [r15 + 0x48], r14b
je 0x14003ab5b
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003ab84
mov byte [rsp + 0x20], r14b
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x80]
mov rcx, r15
call fcn.14003bad0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14003e604
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
call fcn.14003ffb4
mov qword [rbp + 0x70], rax
mov rbx, qword [rsp + 0x40]
or r12, 0xffffffffffffffff
cmp rbx, qword [rsp + 0x48]
je 0x14003ac75
mov al, byte [0x14011b232]
mov byte [rsp + 0x20], al
mov r9, rbx
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140040314
mov rdi, qword [rbx + 0x20]
jmp 0x14003ac56
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.14003a7d8
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003abf4
mov rax, qword [rax]
mov r8, qword [rbp + 0x40]
mov rcx, r8
cmp r11, r8
cmovb rcx, r11
test rcx, rcx
jmp 0x14003ac21
movzx r9d, word [rax]
movzx r10d, word [rdx]
cmp r9w, r10w
jne 0x14003ac6c
add rax, 2
add rdx, 2
sub rcx, 1
jne 0x14003ac07
mov eax, r14d
mov esi, r14d
cmp r11, r8
setne sil
cmovb esi, r12d
test eax, eax
cmovne esi, eax
cmp qword [rbp + 8], 8
jb 0x14003ac4a
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test esi, esi
je 0x14003b289
add rdi, 0x20
cmp rdi, qword [rbx + 0x28]
jne 0x14003abcc
add rbx, 0xe8
jmp 0x14003ab9e
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14003ac26
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r14
mov r12, qword [rbp + 0xc0]
mov rbx, r12
mov r13, qword [rbp + 0xc8]
cmp r12, r13
je 0x14003ae8e
or r15, 0xffffffffffffffff
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.14003b2cc
nop
mov rdi, qword [rbp + 0x1b0]
mov rsi, qword [rbp + 0x1b8]
mov qword [rbp + 0x50], rsi
cmp rdi, rsi
je 0x14003ae66
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r9, r15
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.140003a6c
nop
mov r12, qword [rbp + 0x70]
mov rdx, qword [r12 + 8]
cmp byte [rdx + 0x19], r14b
jne 0x14003ae28
mov r13, r12
mov r12, qword [rbp + 8]
mov r15, qword [rbp - 0x10]
or rsi, 0xffffffffffffffff
lea rax, [rdx + 0x20]
lea r8, [rbp - 0x10]
cmp r12, 8
cmovae r8, r15
mov r11, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003ad34
mov rax, qword [rax]
mov rcx, qword [rbp]
cmp r11, rcx
cmovb rcx, r11
test rcx, rcx
jmp 0x14003ad5e
movzx r9d, word [rax]
movzx r10d, word [r8]
cmp r9w, r10w
jne 0x14003ad82
add rax, 2
add r8, 2
sub rcx, 1
jne 0x14003ad44
mov ecx, r14d
mov eax, r14d
cmp r11, qword [rbp]
setne al
cmovb eax, esi
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
je 0x14003ad8b
mov rdx, qword [rdx + 0x10]
jmp 0x14003ad91
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003ad63
mov r13, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], r14b
je 0x14003ad16
mov r12, qword [rbp + 0x70]
cmp r13, r12
mov rsi, qword [rbp + 0x50]
je 0x14003ae24
lea rax, [r13 + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003adba
mov rax, qword [rax]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov rcx, r10
cmp qword [rbp], r10
cmovb rcx, qword [rbp]
test rcx, rcx
jmp 0x14003adf3
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x14003ae1b
add rdx, 2
add rax, 2
sub rcx, 1
jne 0x14003add9
mov ecx, r14d
mov eax, r14d
cmp qword [rbp], r10
setne al
mov r15, 0xffffffffffffffff
cmovb eax, r15d
test ecx, ecx
cmovne eax, ecx
shr eax, 0x1f
test al, al
jne 0x14003ae28
jmp 0x14003ae2b
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14003adf8
or r15, 0xffffffffffffffff
mov r13, r12
cmp r13, r12
je 0x14003ae41
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.14003ed28
nop
cmp qword [rbp + 8], 8
jb 0x14003ae52
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rdi, 0x20
cmp rdi, rsi
jne 0x14003acd0
mov r13, qword [rbp + 0xc8]
lea rcx, [rbp + 0x190]
call fcn.1400337a8
add rbx, 0xe8
cmp rbx, r13
jne 0x14003aca5
mov r15, qword [rsp + 0x58]
mov r12, qword [rbp + 0xc0]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xa0]
call fcn.14003a720
nop
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.1400274cc
mov r8d, 1
mov rdx, qword [rsp + 0x38]
call fcn.14003db70
lea rcx, [rbp + 0xf0]
call fcn.140034cac
nop
lea rcx, [rbp + 0xf0]
call fcn.1400480c0
mov rdi, qword [rsp + 0x60]
mov rbx, rdi
mov rsi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x14003af0a
lea r8, [rbp + 0x30]
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140048bbc
add rbx, 0x98
cmp rbx, rsi
jne 0x14003aeeb
lea rcx, [rbp + 0xf0]
call fcn.140048614
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_time]
mov qword [rbp + 0x68], rax
call fcn.14001f6bc
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x30]
lea rcx, [rax + 0x4d60]
call fcn.14003e3fc
test al, al
je 0x14003b1c5
mov rbx, qword [rbp + 0xd8]
cmp rbx, qword [rbp + 0xe0]
je 0x14003afb4
or rsi, 0xffffffffffffffff
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140003a6c
nop
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.14003d240
nop
cmp qword [rbp + 8], 8
jb 0x14003afa2
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add rbx, 0x20
cmp rbx, qword [rbp + 0xe0]
jne 0x14003af60
mov rsi, qword [rsp + 0x68]
cmp byte [r15 + 0x48], r14b
je 0x14003b016
lea rcx, [r15 + 0x18]
mov r9, r13
mov r8, r12
mov rdx, qword [r15 + 0x20]
call fcn.140040540
lea rdx, [rbp + 0x30]
lea rcx, [r15 + 0x30]
call fcn.14003ed28
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.140051ce0
mov r9, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rdx, qword [r15 + 0x38]
lea rcx, [r15 + 0x30]
call fcn.140040794
nop
lea rcx, [rbp + 0x50]
call fcn.14003330c
nop
lea rax, vtable.Uev::TemplateIndex.0
mov qword [rbp + 0xf0], rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x14003b048
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x108], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0xf8]
call fcn.140036380
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0xb8], 8
jb 0x14003b079
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], r14
mov word [rbp + 0xa0], r14w
lea rcx, [rbp + 0xd8]
call fcn.14003330c
nop
lea rcx, [rbp + 0x70]
call fcn.14003e1d4
nop
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x14003b0de
mov rbx, r15
cmp r15, qword [rsp + 0x48]
je 0x14003b0d4
mov rcx, rbx
call fcn.1400337a8
add rbx, 0xe8
cmp rbx, qword [rsp + 0x48]
jne 0x14003b0be
mov rcx, r15
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
lea rcx, [rbp + 0x140]
call fcn.14003a030
nop
test r12, r12
je 0x14003b116
mov rbx, r12
cmp r12, r13
je 0x14003b10c
mov rcx, rbx
call fcn.1400337a8
add rbx, 0xe8
cmp rbx, r13
jne 0x14003b0f8
mov rcx, r12
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
test rdi, rdi
je 0x14003b141
mov rbx, rdi
cmp rdi, rsi
je 0x14003b137
mov rcx, rbx
call fcn.140041644
add rbx, 0x98
cmp rbx, rsi
jne 0x14003b123
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 0x98], 8
jb 0x14003b158
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov ebx, 7
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0x90], r14
mov word [rbp + 0x80], r14w
cmp qword [rbp + 0x48], 8
jb 0x14003b184
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x40], r14
mov word [rbp + 0x30], r14w
lea rcx, [rsp + 0x78]
call fcn.14003330c
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400b6b90
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x68
call fcn.140099dec
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14003b208
lea rdx, str.Unable_to_set_template_registration_timestamp
lea rcx, [rbp - 0x10]
call fcn.140005f88
nop
mov dword [rsp + 0x30], 1
mov r8d, dword [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140005668
mov r14, rax
mov qword [rsp + 0x38], r14
lea rdx, [0x140110820]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.Template_ID_already_exists
lea rcx, [rbp + 0xa0]
call fcn.140005f88
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.140039a80
lea rdx, [0x140110740]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.SLAPI_check_failed._The_template_cannot_be_added.
lea rcx, [rbp + 0xa0]
call fcn.140005f88
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x10]
call fcn.1400399f8
lea rdx, [0x140110608]
lea rcx, [rbp - 0x10]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str.The_template_has_been_previously_replaced
lea rcx, [rbp - 0x10]
call fcn.140005f88
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140039c00
lea rdx, [0x1401107b0]
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll__CxxThrowException
int3