Function at 0x14000b4e4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov esi, ecx
xor r12d, r12d
cmp ecx, 0xa
jae 0x14000b546
lea rcx, [rsi + rsi*4]
add rcx, rcx
lea rax, str.Word.Document
xor edx, edx
mov rcx, qword [rax + rcx*8]
call fcn.14000dccc
mov rdi, rax
jmp 0x14000b549
mov rdi, r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x78], r12
mov rcx, r12
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], 0xc8
mov r15d, r12d
test rdi, rdi
je 0x14000b90a
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
mov rdx, rdi
mov r14, 0xffffffff80000000
mov rcx, r14
call fcn.14000e39c
test eax, eax
jne 0x14000b8ee
nop
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.CurVer
mov rcx, qword [rbp - 0x58]
call fcn.14000e39c
test eax, eax
jne 0x14000b8ee
movzx eax, byte [rbp - 0x40]
cmp dword [rbp - 0x5c], 1
cmove eax, r12d
mov byte [rbp - 0x40], al
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x5c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b8ee
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.14000e39c
test eax, eax
jne 0x14000b8ee
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.shellopen
mov rcx, qword [rbp - 0x78]
call fcn.14000e39c
test eax, eax
jne 0x14000b8ee
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.shell_new
mov rcx, qword [rbp - 0x78]
call fcn.14000e39c
test eax, eax
setne r14b
mov ebx, r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
test ebx, ebx
je 0x14000b68f
cmp esi, 4
je 0x14000b872
mov r9d, 1
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000001
call fcn.140007c08
test eax, eax
je 0x14000b885
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, str.Default_Editor
mov rcx, qword [rsp + 0x70]
call fcn.14000e42c
test eax, eax
jne 0x14000b885
mov rax, rdi
mov ecx, r12d
cmp word [rdi], r12w
je 0x14000b6f6
lea rax, [rax + 2]
inc ecx
cmp word [rax], r12w
jne 0x14000b6ea
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400475d0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [0x140047898]
mov rcx, qword [rsp + 0x60]
call fcn.14000e42c
test eax, eax
jne 0x14000b885
lea rdx, [0x140047140]
mov rcx, qword [rsp + 0x50]
call fcn.14000b1f4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [0x140047140]
mov rcx, qword [rsp + 0x50]
call fcn.14000e42c
test eax, eax
jne 0x14000b885
test r14b, r14b
je 0x14000b7c9
mov rdx, qword [0x140047c48]
mov rcx, qword [rsp + 0x50]
call fcn.14000b1f4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rdx, qword [0x140047c48]
mov rcx, qword [rsp + 0x50]
call fcn.14000e42c
test eax, eax
sete r14b
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x80]
call fcn.14000adac
test r14b, r14b
je 0x14000b7f1
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp - 0x70]
call fcn.14000adac
nop
mov r8d, ebx
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000001
call fcn.140009338
mov rcx, qword [rsp + 0x68]
test eax, eax
je 0x14000b88a
test rcx, rcx
je 0x14000b81a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x68], r12
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000b830
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x58], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000b846
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x50], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000b85c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x60], r12
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000b872
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
inc ebx
cmp ebx, 1
jle 0x14000b669
mov r15d, 1
jmp 0x14000b8ee
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000b896
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], r12
test rcx, rcx
je 0x14000b8ac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
test rcx, rcx
je 0x14000b8c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
test rcx, rcx
je 0x14000b8d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], r12
test rcx, rcx
je 0x14000b8ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rdi
call fcn.1400027dc
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000b906
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x70], r12
test rcx, rcx
je 0x14000b91a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp - 0x80], r12
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000b92e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp - 0x78], r12
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000b942
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000b956
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, r15d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14003ee60
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret