Function at 0x140017df4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14010a078]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rcx
xor ebx, ebx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x1428], eax
lea rcx, [rsi + 0x13a0]
call qword [sym.imp.USER32.dll_SetRectEmpty]
lea rcx, [rsi + 0x1390]
call qword [sym.imp.USER32.dll_SetRectEmpty]
lea r12d, [rbx + 1]
mov dword [rbp - 0x19], r12d
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
lea rcx, [rsi + 0x1e0]
xor r8d, r8d
lea rdx, [rbp - 0x19]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x1a8], eax
mov rcx, rsi
call fcn.140027304
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
lea rcx, [rsi + 0x8c]
call qword [sym.imp.USER32.dll_SetRectEmpty]
lea r9, [rsi + 0x40]
lea r8, [0x1401093c0]
call fcn.140020998
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000088
mov dword [rsp + 0x20], 0x86000000
xor r9d, r9d
lea r8, [rbp + 7]
xor edx, edx
mov rcx, rsi
call fcn.140020834
mov rcx, qword [rsi + 8]
mov rax, rcx
neg rax
sbb edi, edi
not edi
mov r13d, 0x80004005
and edi, r13d
test rcx, rcx
je 0x140017f57
lea edi, [rbx - 0x14]
mov edx, edi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
btr rax, 0x16
mov r8, rax
mov edx, edi
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edi, r13d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
test rax, rax
je 0x140017f65
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsi + 0x178], rax
test rax, rax
cmovne edi, ebx
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
test edi, edi
js 0x140017f65
mov rcx, rsi
call fcn.14002a388
mov edi, eax
mov eax, ebx
cmp qword [rsi + 0xd8], rbx
sete al
mov dword [rsi + 0x158], eax
test edi, edi
js 0x140018079
mov qword [rbp + 7], rbx
mov edx, 0x6f
lea rcx, [rbp + 7]
call fcn.140021a70
mov rcx, qword [rbp + 7]
test rcx, rcx
cmove edi, r13d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x140018079
lea rdi, [rsi + 0x1410]
mov rcx, rdi
call fcn.14001f560
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017ff2
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov r14, qword [rsi + 8]
mov rdi, qword [rdi]
test r14, r14
je 0x140017ff2
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ole32.dll_RegisterDragDrop]
test eax, eax
js 0x140017ff2
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], r14
lea r14, [rsi + 0x208]
mov rcx, r14
call fcn.14001f280
mov edi, eax
test eax, eax
js 0x140018079
mov rcx, qword [r14]
test rcx, rcx
cmove edi, r13d
test edi, edi
js 0x140018079
add rcx, 0xa0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rax, qword [r14]
mov dword [rax + 0x74], reloc.OLEAUT32.dll_SafeArrayGetDim
test byte [0x140111380], r12b
je 0x140018048
lea rdx, [0x1400ee200]
call fcn.140014ac0
lea r14, [rsi + 0x200]
mov rcx, r14
call fcn.14001f12c
mov edi, eax
test byte [0x140111380], r12b
je 0x14001806e
lea rdx, [0x1400ede00]
call fcn.140014ac0
test edi, edi
js 0x140018079
cmp qword [r14], rbx
cmove edi, r13d
mov qword [rbp - 0x31], rbx
mov r15d, 0x80070057
test edi, edi
js 0x14001828c
mov rcx, qword [rsi + 0x200]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rcx, qword [rsi + 0x200]
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
lea rdx, [0x1400eea98]
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov edi, eax
test eax, eax
js 0x14001828c
cmp qword [rbp - 0x31], rbx
cmove edi, r13d
test edi, edi
js 0x14001828c
mov rcx, qword [rsi + 0x208]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 8]
mov rax, qword [rax + 0xb0]
call qword [case.0x1400739fa.0]
test eax, eax
cmove edi, r13d
test edi, edi
js 0x14001828c
mov rdx, qword [rbp - 0x31]
mov rcx, qword [rsi + 0x208]
call fcn.140034000
mov edi, eax
test eax, eax
js 0x14001828c
lea r14, [rsi + 0x210]
mov rcx, r14
call fcn.14001f488
mov edi, eax
test eax, eax
js 0x14001828c
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rcx, qword [rbp - 0x31]
mov rax, qword [r14]
test rcx, rcx
je 0x140018289
cmp qword [rax + 0x40], rbx
jne 0x140018284
cmp dword [rax + 0x48], ebx
jne 0x140018284
cmp qword [rax + 0x38], rbx
jne 0x140018284
mov qword [rax + 0x40], rsi
mov qword [rax + 0x38], rcx
mov dword [rax + 0x48], ebx
mov r14, qword [r14]
mov rdx, qword [r14 + 0x38]
test rdx, rdx
je 0x140018284
cmp dword [r14 + 0x48], ebx
jne 0x140018284
lea r8, [0x1400eeb78]
mov rcx, r14
call fcn.140020be8
mov edi, eax
test eax, eax
js 0x14001828c
add dword [r14 + 0x48], r12d
test eax, eax
js 0x14001828c
lea r14, [rsi + 0x1f0]
mov rcx, r14
call fcn.14001f280
mov edi, eax
test eax, eax
js 0x14001828c
mov rcx, qword [r14]
test rcx, rcx
cmove edi, r13d
test edi, edi
js 0x14001828c
add rcx, 0xa0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rax, qword [r14]
mov dword [rax + 0x74], SafeArrayGetDim
mov rcx, qword [r14]
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
mov rcx, qword [r14]
mov rax, qword [rcx]
mov r8d, r12d
mov rdx, qword [rsi + 8]
mov rax, qword [rax + 0xb0]
call qword [case.0x1400739fa.0]
test eax, eax
cmove edi, r13d
test edi, edi
js 0x14001828c
test byte [0x140111380], r12b
je 0x140018251
lea rdx, [0x1400ee240]
call fcn.140014ac0
lea r14, [rsi + 0x1e8]
mov rcx, r14
call fcn.14001eb14
mov edi, eax
test byte [0x140111380], r12b
je 0x140018277
lea rdx, [0x1400ee130]
call fcn.140014ac0
test edi, edi
js 0x14001828c
cmp qword [r14], rbx
cmove edi, r13d
jmp 0x14001828c
mov edi, r13d
jmp 0x14001828c
mov edi, r15d
mov qword [rbp - 0x29], rbx
test edi, edi
js 0x140018476
mov rcx, qword [rsi + 0x1e8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rcx, qword [rsi + 0x1e8]
mov rax, qword [rcx]
lea r8, [rbp - 0x29]
lea rdx, [0x1400eea98]
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov edi, eax
test eax, eax
js 0x140018476
mov rcx, qword [rbp - 0x29]
test rcx, rcx
cmove edi, r13d
test edi, edi
js 0x140018476
mov rdx, rcx
mov rcx, qword [rsi + 0x1f0]
call fcn.140034000
mov edi, eax
test eax, eax
js 0x140018476
lea r14, [rsi + 0x1f8]
mov rcx, r14
call fcn.14001f3b0
mov edi, eax
test eax, eax
js 0x140018476
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rcx, qword [rbp - 0x29]
mov rax, qword [r14]
test rcx, rcx
je 0x140018473
cmp qword [rax + 0x40], rbx
jne 0x14001846e
cmp dword [rax + 0x48], ebx
jne 0x14001846e
cmp qword [rax + 0x38], rbx
jne 0x14001846e
mov qword [rax + 0x40], rsi
mov qword [rax + 0x38], rcx
mov dword [rax + 0x48], ebx
mov r14, qword [r14]
mov rdx, qword [r14 + 0x38]
test rdx, rdx
je 0x14001846e
cmp dword [r14 + 0x48], ebx
jne 0x14001846e
lea r8, [0x1400eeb88]
mov rcx, r14
call fcn.140020be8
mov edi, eax
test eax, eax
js 0x140018394
add dword [r14 + 0x48], r12d
test edi, edi
js 0x140018476
lea r15, [rsi + 0x218]
mov rax, rsi
lea rdx, [rsi + 0x1c8]
neg rax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x17]
mov rdx, qword [rsi + 8]
mov rcx, r15
call fcn.140023910
test eax, eax
cmove edi, r13d
test edi, edi
js 0x140018476
mov dword [rsi + 0x28c], SafeArrayGetDim
mov dword [rsi + 0x290], r12d
mov rax, qword [r15]
mov edx, r12d
mov rcx, r15
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
mov qword [rbp + 7], rbx
mov edx, 0xc9
lea rcx, [rbp + 7]
call fcn.140021a70
mov edx, 0x12d
mov rcx, qword [0x140111ae8]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [r15 + 0xd0], rax
lea rcx, [r15 + 0x2c]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x140018449
mov dword [r15 + 0x26c], r12d
lea rdx, [r15 + 0x2c]
mov rcx, r15
call fcn.140023250
mov edx, 0x453
mov r8d, 0x51c
mov rcx, r15
call fcn.140023e8c
test eax, eax
cmove edi, r13d
mov rcx, qword [rbp + 7]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14001847d
mov edi, r13d
jmp 0x140018476
mov edi, r15d
lea r15, [rsi + 0x218]
test edi, edi
js 0x14001860f
mov edx, 0x454
mov r8d, 0x51b
mov rcx, r15
call fcn.140023e8c
test eax, eax
cmove edi, r13d
test edi, edi
js 0x14001860f
mov edx, 0x458
mov r8d, 0x521
mov rcx, r15
call fcn.140023e8c
test eax, eax
cmove edi, r13d
test edi, edi
js 0x14001860f
mov rax, rsi
lea rcx, [rsi + 0x1c8]
neg rax
sbb r12, r12
and r12, rcx
lea r14, [rsi + 0xf48]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x17]
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.14002f4f0
test eax, eax
cmove edi, r13d
test edi, edi
js 0x140018609
mov edi, 1
cmp byte [r14 + 0x3b0], dil
je 0x140018559
mov byte [r14 + 0x3b0], dil
lea rcx, [r14 + 0x240]
mov rax, qword [rcx]
mov edx, ebx
cmp dword [r14 + 0x28], ebx
setne dl
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
mov rcx, qword [r14 + 0x60]
test rcx, rcx
je 0x140018559
mov rax, qword [rcx]
lea rdx, [r14 + 0x2c]
mov r9, r14
xor r8d, r8d
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov dword [r14 + 0x3b4], edi
lea rcx, [r14 + 0x240]
call fcn.140035fe0
lea rcx, [r14 + 0xd0]
call fcn.140035fe0
mov byte [r14 + 0x3b1], dil
cmp dword [r14 + 0x3b4], ebx
je 0x1400185a0
mov ecx, 3
call fcn.140039b5c
mov dword [r14 + 0x3a0], eax
mov dword [r14 + 0x358], edi
cmp byte [0x140111f19], bl
je 0x1400185c0
mov al, dil
neg al
sbb ecx, ecx
neg ecx
add ecx, 2
call fcn.140039b5c
mov ecx, eax
call fcn.1400382a8
mov dword [rsi + 0xfbc], 0xe
mov dword [rsi + 0xfc0], edi
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
lea r14, [rsi + 0x598]
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x17]
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.14002ca2c
test eax, eax
jne 0x14001879d
mov edi, r13d
mov r12d, 1
lea r14, [rsi + 0x598]
test edi, edi
js 0x1400187f8
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400739fa.0]
lea rdi, [rsi + 0x48]
mov rax, qword [rdi]
mov rdx, r15
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x1400739fa.0]
mov rax, qword [rdi]
lea rdx, [rsi + 0xf48]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x1400739fa.0]
mov rax, qword [rdi]
mov rdx, r14
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x1400739fa.0]
mov rax, qword [rdi]
mov rdx, qword [rsi + 0x1f0]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x1400739fa.0]
mov rax, qword [rdi]
mov rdx, qword [rsi + 0x208]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x1400739fa.0]
mov dword [rsi + 0x1ac], ebx
mov edx, ebx
cmp dword [rsi + 0x58], ebx
jle 0x1400186dc
mov rcx, rbx
test rcx, rcx
js 0x140018854
cmp edx, dword [rsi + 0x58]
jge 0x140018854
mov rax, qword [rsi + 0x50]
mov r8, qword [rcx + rax]
test r8, r8
je 0x1400186d0
mov dword [r8 + 0x7c], ebx
add edx, r12d
add rcx, 8
cmp edx, dword [rsi + 0x58]
jl 0x1400186ad
mov rcx, rsi
call fcn.14001a800
mov edi, eax
test eax, eax
js 0x1400187f8
mov rcx, rsi
call fcn.14001a744
mov edi, eax
test eax, eax
js 0x1400187f8
lea rcx, str.TaskbarCreated
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x13b0], eax
test eax, eax
cmove edi, r13d
test edi, edi
js 0x1400187f8
mov rax, qword [rsi + 8]
mov qword [rsi + 0x1388], rax
lea rcx, [rsi + 0x1348]
call fcn.1400509cc
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14001aa4c
mov rcx, rsi
call fcn.14001b468
call fcn.14003758c
mov r14d, r12d
mov dword [rbp - 0x39], ebx
mov dword [rbp - 0x21], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, str.EnableBalloon
mov rcx, qword [rsi + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400187d9
cmp dword [rbp + 7], 4
je 0x1400187c7
mov eax, SafeArrayGetDim
jmp 0x1400187d7
mov dword [rsi + 0x60c], 0xd
mov r12d, edi
mov dword [rsi + 0x610], edi
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
jmp 0x14001861e
mov eax, ebx
test eax, eax
jne 0x1400187d9
mov r14d, ebx
cmp dword [rbp - 0x39], ebx
setne r14b
test eax, eax
sete cl
test eax, eax
je 0x1400187e6
mov r14d, r12d
mov cl, r12b
test cl, cl
je 0x1400187f8
mov eax, ebx
test r14d, r14d
sete al
mov dword [rsi + 0x1424], eax
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14001880f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400739fa.0]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140018825
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400739fa.0]
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400e27e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0xc000008c
call fcn.14001575c
int3