Function at 0x14000afd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140017060]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov r14, rcx
mov qword [rsp + 0x68], rcx
xor ebp, ebp
mov dword [rsp + 0x50], ebp
lea r15d, [rbp + 1]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rdx, str.1033
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x14000b069
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140005fc0
test rax, rax
je 0x14000b084
mov r8d, edi
mov rdx, rax
mov rcx, r14
call fcn.1400060f0
jmp 0x14000b084
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, r14
call fcn.140006280
nop
mov dword [rsp + 0x50], 1
lea rcx, str.mapistub.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
jne 0x14000b0be
lea rcx, str.mapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
jne 0x14000b0be
mov rax, r14
jmp 0x14000b478
lea rdx, str.FGetComponentPath
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000b46c
mov qword [rsp + 0x48], rbp
mov r12, rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClientsMailMicrosoft_Outlook
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b263
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14000b263
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], ebp
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MSIApplicationLCID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b1a9
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14000b1a9
cmp dword [rsp + 0x40], 7
jne 0x14000b1a9
mov rcx, rax
call fcn.14000f034
mov r12, rax
test rax, rax
je 0x14000b1a9
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.MSIApplicationLCID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000b1a9
mov rcx, r12
call fcn.14000f02e
mov r12, rbp
mov rdi, qword [rsp + 0x48]
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.MSIOfficeLCID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b235
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000b235
cmp dword [rsp + 0x3c], 7
jne 0x14000b235
mov rcx, rax
call fcn.14000f034
mov rbp, rax
test rax, rax
je 0x14000b235
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.MSIOfficeLCID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000b235
mov rcx, rbp
call fcn.14000f02e
xor ebp, ebp
test r12, r12
je 0x14000b263
mov dword [rsp + 0x20], 1
mov r9d, 0x208
lea r8, [rsp + 0x180]
mov rdx, r12
lea rcx, str.FF1D0740_D227_11D1_A4B0_006008AF820E
call rsi
mov r15d, eax
test eax, eax
je 0x14000b26d
cmp byte [rsp + 0x180], 0
jne 0x14000b297
test rbp, rbp
je 0x14000b297
mov dword [rsp + 0x20], 1
mov r9d, 0x208
lea r8, [rsp + 0x180]
mov rdx, rbp
lea rcx, str.FF1D0740_D227_11D1_A4B0_006008AF820E
call rsi
mov r15d, eax
test r15d, r15d
je 0x14000b2a6
cmp byte [rsp + 0x180], 0
jne 0x14000b2c7
mov dword [rsp + 0x20], 1
mov r9d, 0x208
lea r8, [rsp + 0x180]
xor edx, edx
lea rcx, str.FF1D0740_D227_11D1_A4B0_006008AF820E
call rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
call qword [0x140017030]
mov r8d, eax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x70]
call fcn.14000b750
nop
mov rsi, qword [rsp + 0x70]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
test rsi, rsi
je 0x14000b356
test rsi, 0xffffffffffff0000
jne 0x14000b342
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.140005fc0
test rax, rax
je 0x14000b36d
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400060f0
mov rdi, qword [rsp + 0x30]
jmp 0x14000b36d
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14000b358
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006280
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000b382
call qword [0x140012208]