Function at 0x14000bea8
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x14005c8c0]
xor rax, rbp
mov qword [rbp + 0x140], rax
xor r15d, r15d
mov r14d, r8d
mov r12, rdx
mov rbx, rcx
mov qword [rbp], r15
cmp rdx, r15
je 0x14000bf59
mov eax, dword [0x14004a350]
cmp dword [rcx], eax
jne 0x14000bf84
mov eax, dword [0x14004a354]
cmp dword [rcx + 4], eax
jne 0x14000bf84
mov eax, dword [0x14004a358]
cmp dword [rcx + 8], eax
jne 0x14000bf84
mov eax, dword [0x14004a35c]
cmp dword [rcx + 0xc], eax
jne 0x14000bf84
lea rax, str.0___Use_OBJECT_ENTRY_NON_CREATEABLE_EX_macro_if_you_want_to_register_class_categories_for_non_creatable_objects._
lea rdx, [0x1400484b0]
lea ecx, [r15 + 2]
xor r9d, r9d
mov r8d, 0x19a2
mov qword [rsp + 0x20], rax
call fcn.140019a40
lea edi, [r15 + 1]
cmp eax, edi
jne 0x14000bf4a
int3
mov rcx, qword [rbp]
cmp rcx, r15
je 0x14000bf59
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.1400193c0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x150]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp]
mov edi, 1
lea r9, [0x140049128]
lea rcx, [0x14004a370]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r15d
jl 0x14000bf4a
cmp dword [r12], r15d
je 0x14000c17c
lea r13d, [rdi + 1]
mov rax, qword [r12 + 8]
lea rcx, str.pEntry__iType__2
lea rdx, str.p_0
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x30], xmm0
cmp r14d, r15d
je 0x14000c0b9
cmp dword [r12], edi
jne 0x14000c02a
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x14000c018
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c014
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x28]
jmp 0x14000c098
cmp dword [r12], r13d
je 0x14000c059
mov qword [rsp + 0x20], rcx
lea rdx, [0x1400484b0]
xor r9d, r9d
mov r8d, 0x19c1
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c052
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x14000c088
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c084
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x38]
cmp eax, r15d
mov esi, eax
jge 0x14000c16e
mov rcx, qword [rbp]
cmp rcx, r15
je 0x14000c0b2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x14000bf5b
cmp dword [r12], edi
jne 0x14000c100
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x14000c0ee
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c0ea
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x30]
jmp 0x14000c16e
cmp dword [r12], r13d
je 0x14000c12f
mov qword [rsp + 0x20], rcx
lea rdx, [0x1400484b0]
xor r9d, r9d
mov r8d, 0x19d2
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c128
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x14000c15e
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140019a40
cmp eax, edi
jne 0x14000c15a
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x40]
add r12, 0x10
cmp dword [r12], r15d
jne 0x14000bfbe
cmp r14d, r15d
jne 0x14000bf4a
lea rdx, [rbp + 0xc0]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xc0]
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
add eax, edi
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x14000bf4a
cmp edi, 0x400
jg 0x14000c207
movsxd rsi, edi
mov rcx, rsi
call fcn.14000aa48
cmp al, r15b
je 0x14000c207
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x14000c1f4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140043350
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x14000c238
or rax, 0xffffffffffffffff
movsxd rcx, edi
sub rax, rcx
cmp rax, 0x10
jb 0x14000c598
add rcx, 0x10
call fcn.14001bcd0
cmp rax, r15
jne 0x14000c22e
mov rcx, r15
jmp 0x14000c238
mov qword [rax], r15
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xc0]
mov r9d, 3
mov r8d, edi
call fcn.140009724
mov r12, rax
cmp rax, r15
je 0x14000c58e
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001bd10
lea r13d, [rdi - 0x74]
lea r14d, [rdi - 0x30]
cmp eax, r15d
je 0x14000c2b3
cmp eax, r13d
je 0x14000c2a8
cmp eax, 0x16
je 0x14000c29d
cmp eax, 0x22
je 0x14000c29d
cmp eax, r14d
je 0x14000c2b3
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.14001ce10
cmp eax, r15d
je 0x14000c2fc
cmp eax, r13d
je 0x14000c2f1
cmp eax, 0x16
je 0x14000c2e6
cmp eax, 0x22
je 0x14000c2e6
cmp eax, r14d
je 0x14000c2fc
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001ce10
cmp eax, r15d
je 0x14000c349
cmp eax, r13d
je 0x14000c33e
cmp eax, 0x16
je 0x14000c333
cmp eax, 0x22
je 0x14000c333
cmp eax, r14d
je 0x14000c349
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x20], 0xffffffff80000000
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
mov dword [rbp + 8], r15d
call fcn.140009be0
cmp eax, r15d
jne 0x14000c3f7
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x14000c3d6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
cmp rsi, r15
jne 0x14000c3f2
cmp dword [rbp + 8], r15d
jne 0x14000c3f2
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140009a30
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001bd10
cmp eax, r15d
je 0x14000c444
cmp eax, r13d
je 0x14000c439
cmp eax, 0x16
je 0x14000c42e
cmp eax, 0x22
je 0x14000c42e
cmp eax, r14d
je 0x14000c444
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.14001ce10
cmp eax, r15d
je 0x14000c48d
cmp eax, r13d
je 0x14000c482
cmp eax, 0x16
je 0x14000c477
cmp eax, 0x22
je 0x14000c477
cmp eax, r14d
je 0x14000c48d
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001ce10
cmp eax, r15d
je 0x14000c4da
cmp eax, r13d
je 0x14000c4cf
cmp eax, 0x16
je 0x14000c4c4
cmp eax, 0x22
je 0x14000c4c4
cmp eax, r14d
je 0x14000c4da
mov ecx, 0x80004005
call fcn.140009850
int3
mov ecx, 0x80070057
call fcn.140009850
int3
mov ecx, 0x8007000e
call fcn.140009850
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.140009be0
mov rdi, qword [rbp + 0x10]
cmp eax, r15d
jne 0x14000c566
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x14000c54e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
cmp rsi, r15
jne 0x14000c566
cmp dword [rbp + 8], r15d
jne 0x14000c566
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140009a30
cmp rdi, r15
je 0x14000c574
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c58e
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400197c0
cmp rbx, r15
jne 0x14000c583
jmp 0x14000bf4a
mov ecx, 0x80070057
call fcn.140009850
int3