Function at 0x140008114
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xbc8]
sub rsp, 0xc90
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0xb80], rax
mov r15, r8
mov r12d, edx
mov rbx, rcx
xor edi, edi
mov r13d, edi
mov dword [rbp - 0x3c], edi
mov sil, dil
mov dword [rbp - 0x40], edi
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], dil
mov byte [rbp - 0x60], dil
mov qword [rsp + 0x68], rdi
mov qword [rbp], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x78], edi
mov dword [rbp - 0x7c], 0x28
mov dword [rbp - 0x10], 0x208
mov qword [rbp + 8], rdi
mov qword [rsp + 0x58], rdi
mov word [rbp + 0x40], di
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rbp + 0x20], rax
lea rax, str.Param
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], r8
mov word [rbp + 0x38], di
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Start_Verb_Registration:
mov qword [rsp + 0x20], rax
mov edx, 0x851
mov ecx, 0x170b011
lea r8d, [rdi + 0x64]
call fcn.14000262c
lea rdx, str.print
mov rcx, r15
call fcn.14000db08
mov r14d, eax
mov dword [rbp - 0x80], eax
test eax, eax
sete dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.shell
mov rcx, rbx
call fcn.14000e42c
xor ebx, ebx
test eax, eax
jne 0x140008ca5
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rdx, r15
mov rcx, qword [rbp - 0x28]
call fcn.14000e42c
test eax, eax
jne 0x140008ca5
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.command
mov rcx, qword [rsp + 0x68]
call fcn.14000e42c
test eax, eax
jne 0x140008ca5
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call fcn.14000b3f0
mov r13, qword [rsp + 0x58]
test eax, eax
je 0x140008c8f
lea rdx, str.msohtmed.exe
mov rcx, r13
call fcn.14000de00
test rax, rax
je 0x1400084fd
xor esi, esi
mov qword [rsp + 0x58], rsi
mov qword [rbp - 0x48], rsi
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x20], rsi
mov rcx, r13
call fcn.140007384
mov r14, rax
lea r8d, [rbx + 2]
lea rcx, [rbp + 0x770]
call fcn.14000bdb8
test eax, eax
je 0x140008493
lea rdx, [rbp + 0x770]
mov rcx, r14
call fcn.14000db08
test eax, eax
jne 0x140008491
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [0x140048430]
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x140008493
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.42042206_2D85_11D3_8CFF_005004838597
mov rcx, qword [rsp + 0x58]
call fcn.14000e39c
test eax, eax
jne 0x140008493
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.Version
mov rcx, qword [rbp - 0x48]
call fcn.14000e39c
test eax, eax
jne 0x140008493
xor edx, edx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x78], 0xa
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor edx, edx
test eax, eax
jne 0x140008493
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400083f2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov qword [rbp - 0x20], rdx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.14000e39c
xor ecx, ecx
test eax, eax
jne 0x140008488
mov dword [rbp - 0x70], 0x208
movzx eax, byte [rbp + 0x140]
cmp dword [rsp + 0x54], 1
cmove eax, ecx
mov byte [rbp + 0x140], al
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008488
lea rdx, [rbp + 0x140]
mov rcx, r14
call fcn.14000db08
test eax, eax
je 0x140008488
mov edx, 0xa
lea rcx, [rbp + 0x20]
call fcn.14000e040
cmp eax, 0x10
jae 0x140008491
inc esi
mov edx, esi
jmp 0x1400083a3
mov bl, 1
mov sil, bl
xor sil, 1
xor r14d, r14d
mov ecx, r14d
movzx eax, dil
test bl, bl
cmove ecx, eax
mov dil, cl
mov rcx, qword [rbp - 0x20]
xor ebx, ebx
test rcx, rcx
je 0x1400084bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], rbx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400084d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400084e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x48], rbx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400084f9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, dword [rbp - 0x80]
cmp word [r13], bx
je 0x140008533
lea rdx, str.fpxpress.exe
mov rcx, r13
call fcn.14000de00
test rax, rax
jne 0x140008533
lea rdx, str.winword.exe
mov rcx, r13
call fcn.14000de00
test rax, rax
je 0x140008538
mov esi, 1
jmp 0x140008551
mov esi, 1
cmp dword [rbp + 0xbf0], ebx
je 0x140008551
test r14d, r14d
jne 0x140008551
test r12d, r12d
lea rbx, str.SharePointDesigner.Editor.Document
je 0x140008558
lea rbx, str.Word.Document
xor eax, eax
mov r14d, eax
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rbp + 0x560]
call fcn.14000dc08
mov r8d, 0x104
lea rdx, [0x140046540]
lea rcx, [rbp + 0x560]
call fcn.14000dc84
xor eax, eax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000000
call fcn.14000e39c
xor edx, edx
test eax, eax
jne 0x14000867f
mov dword [rbp - 0x70], 0xc8
movzx eax, byte [rbp + 0x70]
cmp dword [rsp + 0x54], 1
cmove eax, edx
mov byte [rbp + 0x70], al
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x14000867f
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0x70]
cmp dword [rbp - 0x80], edx
je 0x140008628
lea rdx, str._shell_
call fcn.14000dc84
mov r8d, 0x64
mov rdx, r15
lea rcx, [rbp + 0x70]
jmp 0x14000862f
lea rdx, str._shellopen
call fcn.14000dc84
mov rcx, qword [rbp - 0x58]
xor eax, eax
test rcx, rcx
je 0x140008647
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x70]
mov rcx, 0xffffffff80000000
call fcn.14000e39c
mov ecx, dword [rbp - 0x60]
movzx ecx, cl
xor edx, edx
test eax, eax
lea eax, [rdx + 1]
cmove ecx, eax
mov dword [rbp - 0x60], ecx
jmp 0x140008682
mov ecx, dword [rbp - 0x60]
test cl, cl
jne 0x1400086ac
test r14d, r14d
jne 0x1400086ac
lea rax, str.SharePointDesigner.Editor.Document
cmp rbx, rax
jne 0x1400086a0
lea rbx, str.Word.Document
jmp 0x1400086ac
test r12d, r12d
jne 0x1400089d7
mov rbx, rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400086be
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov qword [rsp + 0x70], rdx
inc r14d
cmp r14d, 2
jb 0x14000855d
xor r14d, r14d
mov r8d, r12d
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.140007af0
test dil, dil
je 0x1400087d3
test sil, sil
je 0x1400087c2
mov qword [rbp - 0x48], r14
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
mov rdx, r15
mov rcx, qword [rbp - 0x30]
call fcn.14000e39c
test eax, eax
jne 0x1400087b3
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, [0x140047830]
mov rcx, qword [rbp - 0x48]
call fcn.14000e39c
test eax, eax
jne 0x1400087a3
mov dword [rbp - 0x70], 0x410
movzx eax, byte [rbp + 0x770]
mov ecx, 1
cmp dword [rsp + 0x54], ecx
cmove eax, r14d
mov byte [rbp + 0x770], al
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x770]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400087a3
movzx edi, dil
cmp word [rbp + 0x770], r14w
cmovne edi, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400087b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400087c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x1400087d3
mov rdx, r15
mov rcx, qword [rbp - 0x30]
call fcn.14000b1f4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov rdx, r15
mov rcx, qword [rbp - 0x30]
call fcn.14000e42c
test eax, eax
jne 0x140008c92
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov ebx, 0x20019
mov r9d, ebx
mov rdx, r15
mov rcx, qword [rbp - 0x38]
call fcn.14000e39c
test eax, eax
jne 0x140008a37
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.command
mov rcx, qword [rsp + 0x78]
call fcn.14000e39c
test eax, eax
jne 0x140008a37
test dil, dil
jne 0x1400089f3
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, [0x140047830]
mov rcx, qword [rbp - 0x68]
call fcn.14000e39c
mov ebx, 1
test eax, eax
jne 0x140008a10
movzx eax, byte [rbp + 0x350]
cmp dword [rsp + 0x54], ebx
cmove eax, r14d
mov byte [rbp + 0x350], al
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008a10
cmp word [rbp + 0x350], r14w
je 0x140008a10
mov bl, byte [rsp + 0x50]
mov r14b, bl
mov edi, dword [rbp - 0x80]
test edi, edi
jne 0x140008958
mov esi, dword [rbp - 0x40]
test esi, esi
jne 0x1400088e4
test bl, bl
je 0x140008958
mov dword [rsp + 0x28], r12d
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call fcn.140007d44
test esi, esi
mov esi, 1
je 0x140008931
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test bl, bl
je 0x140008958
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r14b, r14b
je 0x140008b2c
xor r14d, r14d
mov qword [rsp + 0x58], r14
lea rax, str.SOFTWAREMicrosoftSharedMHTML
lea rdx, str.SOFTWAREMicrosoftSharedHTML
test r12d, r12d
cmovne rdx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffff80000001
mov r9d, 0x2001f
mov rcx, rbx
call fcn.14000e39c
test eax, eax
jne 0x1400089b2
lea rdx, str.Default_Editor
mov rcx, qword [rsp + 0x58]
call fcn.14000b1f4
mov edx, r12d
mov rcx, rbx
call fcn.140009a9c
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140008b2f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008b2f
mov rcx, qword [rsp + 0x70]
xor r14d, r14d
test rcx, rcx
je 0x1400086d3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400086d3
test sil, sil
jne 0x140008a0b
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call fcn.14000adac
jmp 0x140008a28
mov ebx, 1
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140008a28
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
call fcn.14000adac
mov dword [rbp - 0x40], ebx
mov r14d, 1
mov bl, byte [rsp + 0x50]
jmp 0x1400088d2
cmp qword [rsp + 0x78], r14
je 0x140008a5a
mov rdx, r15
mov rcx, qword [rbp - 0x38]
call fcn.14000b1f4
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008a5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rdx, r15
mov rcx, qword [rbp - 0x38]
call fcn.14000e42c
test eax, eax
jne 0x140008c92
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.command
mov rcx, qword [rbp - 0x68]
call fcn.14000e39c
test eax, eax
jne 0x140008ad5
test dil, dil
jne 0x140008ada
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400088cb
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
call fcn.14000adac
mov ebx, 1
mov r14b, byte [rsp + 0x51]
jmp 0x1400088d2
test dil, dil
je 0x140008adf
test sil, sil
je 0x140008b08
cmp dword [rbp - 0x80], r14d
jne 0x140008b08
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140008b1b
mov r8, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x68]
call fcn.14000adac
mov eax, 1
mov bl, al
mov dword [rbp - 0x40], eax
jmp 0x140008b24
mov r8, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call fcn.14000adac
mov eax, 1
mov bl, byte [rsp + 0x50]
mov r14b, al
jmp 0x1400088d2
xor r14d, r14d
mov ebx, r14d
test edi, edi
setne bl
mov edx, ebx
lea rcx, [rbp + 8]
call fcn.140007fc4
cmp word [rbp + 0x40], r14w
jne 0x140008b6b
mov dword [rsp + 0x28], r12d
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
mov r8d, ebx
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call fcn.140007d44
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008b7b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140008b8f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], r14
mov rdx, r15
mov rcx, qword [rbp - 0x28]
call fcn.14000b1f4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rdx, r15
mov rcx, qword [rbp - 0x28]
call fcn.14000e42c
mov rbx, qword [rbp + 8]
test eax, eax
jne 0x140008c80
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov esi, 1
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140008c80
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.command
mov rcx, qword [rsp + 0x68]
call fcn.14000e42c
test eax, eax
jne 0x140008c80
mov rax, rbx
mov ecx, r14d
test rbx, rbx
je 0x140008c40
cmp word [rbx], r14w
je 0x140008c40
lea rax, [rax + 2]
add ecx, esi
cmp word [rax], r14w
jne 0x140008c34
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140008c80
test edi, edi
jne 0x140008c7d
mov r8d, r12d
mov rdx, qword [rbp - 0x68]
mov rcx, 0xffffffff80000002
call fcn.140009338
test eax, eax
je 0x140008c80
mov dword [rbp - 0x3c], esi
test rbx, rbx
je 0x140008c92
mov rcx, rbx
call fcn.1400027dc
jmp 0x140008c92
xor r14d, r14d
test r13, r13
je 0x140008c9f
mov rcx, r13
call fcn.1400027dc
mov r13d, dword [rbp - 0x3c]
jmp 0x140008ca8
xor r14d, r14d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140008cb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], r14
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140008cca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x38], r14
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140008cdd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x30], r14
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140008cf0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r14
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140008d03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140008d16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], r14
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008d2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], r14
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140008d3e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x68], r14
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140008d51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 8], r14
mov rcx, qword [rbp]
test rcx, rcx
je 0x140008d64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008d78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
mov rcx, qword [rbp + 0xb80]
xor rcx, rsp
call fcn.14003ee60
mov rbx, qword [rsp + 0xce8]
add rsp, 0xc90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret