Function at 0x140012480
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x140066550]
xor rax, rbp
mov qword [rbp + 0x140], rax
xor r15d, r15d
mov r14d, r8d
mov r12, rdx
mov rbx, rcx
mov qword [rbp], r15
cmp rdx, r15
je 0x140012531
mov eax, dword [0x140057738]
cmp dword [rcx], eax
jne 0x14001255c
mov eax, dword [0x14005773c]
cmp dword [rcx + 4], eax
jne 0x14001255c
mov eax, dword [0x140057740]
cmp dword [rcx + 8], eax
jne 0x14001255c
mov eax, dword [0x140057744]
cmp dword [rcx + 0xc], eax
jne 0x14001255c
lea rax, str.0___Use_OBJECT_ENTRY_NON_CREATEABLE_EX_macro_if_you_want_to_register_class_categories_for_non_creatable_objects._
lea rdx, [0x140053e10]
lea ecx, [r15 + 2]
xor r9d, r9d
mov r8d, 0x19a2
mov qword [rsp + 0x20], rax
call fcn.140021c80
lea edi, [r15 + 1]
cmp eax, edi
jne 0x140012522
int3
mov rcx, qword [rbp]
cmp rcx, r15
je 0x140012531
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.1400206b0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x150]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp]
mov edi, 1
lea r9, [0x140055b18]
lea rcx, [0x140057758]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r15d
jl 0x140012522
cmp dword [r12], r15d
je 0x140012754
lea r13d, [rdi + 1]
mov rax, qword [r12 + 8]
lea rcx, str.pEntry__iType__2
lea rdx, str.p_0
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x30], xmm0
cmp r14d, r15d
je 0x140012691
cmp dword [r12], edi
jne 0x140012602
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x1400125f0
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x1400125ec
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x28]
jmp 0x140012670
cmp dword [r12], r13d
je 0x140012631
mov qword [rsp + 0x20], rcx
lea rdx, [0x140053e10]
xor r9d, r9d
mov r8d, 0x19c1
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x14001262a
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x140012660
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x14001265c
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x38]
cmp eax, r15d
mov esi, eax
jge 0x140012746
mov rcx, qword [rbp]
cmp rcx, r15
je 0x14001268a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x140012533
cmp dword [r12], edi
jne 0x1400126d8
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x1400126c6
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x1400126c2
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x30]
jmp 0x140012746
cmp dword [r12], r13d
je 0x140012707
mov qword [rsp + 0x20], rcx
lea rdx, [0x140053e10]
xor r9d, r9d
mov r8d, 0x19d2
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x140012700
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x140012736
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.140021c80
cmp eax, edi
jne 0x140012732
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x40]
add r12, 0x10
cmp dword [r12], r15d
jne 0x140012596
cmp r14d, r15d
jne 0x140012522
lea rdx, [rbp + 0xc0]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xc0]
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
add eax, edi
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x140012522
cmp edi, 0x400
jg 0x1400127df
movsxd rsi, edi
mov rcx, rsi
call fcn.14000e990
cmp al, r15b
je 0x1400127df
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x1400127cc
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004e4b0
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x140012810
or rax, 0xffffffffffffffff
movsxd rcx, edi
sub rax, rcx
cmp rax, 0x10
jb 0x140012b70
add rcx, 0x10
call fcn.140021c40
cmp rax, r15
jne 0x140012806
mov rcx, r15
jmp 0x140012810
mov qword [rax], r15
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xc0]
mov r9d, 3
mov r8d, edi
call fcn.14000b098
mov r12, rax
cmp rax, r15
je 0x140012b66
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140022400
lea r13d, [rdi - 0x74]
lea r14d, [rdi - 0x30]
cmp eax, r15d
je 0x14001288b
cmp eax, r13d
je 0x140012880
cmp eax, 0x16
je 0x140012875
cmp eax, 0x22
je 0x140012875
cmp eax, r14d
je 0x14001288b
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.140023500
cmp eax, r15d
je 0x1400128d4
cmp eax, r13d
je 0x1400128c9
cmp eax, 0x16
je 0x1400128be
cmp eax, 0x22
je 0x1400128be
cmp eax, r14d
je 0x1400128d4
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140023500
cmp eax, r15d
je 0x140012921
cmp eax, r13d
je 0x140012916
cmp eax, 0x16
je 0x14001290b
cmp eax, 0x22
je 0x14001290b
cmp eax, r14d
je 0x140012921
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x20], 0xffffffff80000000
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
mov dword [rbp + 8], r15d
call fcn.14000b550
cmp eax, r15d
jne 0x1400129cf
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x1400129ae
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
cmp rsi, r15
jne 0x1400129ca
cmp dword [rbp + 8], r15d
jne 0x1400129ca
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000b3a0
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140022400
cmp eax, r15d
je 0x140012a1c
cmp eax, r13d
je 0x140012a11
cmp eax, 0x16
je 0x140012a06
cmp eax, 0x22
je 0x140012a06
cmp eax, r14d
je 0x140012a1c
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.140023500
cmp eax, r15d
je 0x140012a65
cmp eax, r13d
je 0x140012a5a
cmp eax, 0x16
je 0x140012a4f
cmp eax, 0x22
je 0x140012a4f
cmp eax, r14d
je 0x140012a65
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140023500
cmp eax, r15d
je 0x140012ab2
cmp eax, r13d
je 0x140012aa7
cmp eax, 0x16
je 0x140012a9c
cmp eax, 0x22
je 0x140012a9c
cmp eax, r14d
je 0x140012ab2
mov ecx, 0x80004005
call fcn.14000b1c4
int3
mov ecx, 0x80070057
call fcn.14000b1c4
int3
mov ecx, 0x8007000e
call fcn.14000b1c4
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.14000b550
mov rdi, qword [rbp + 0x10]
cmp eax, r15d
jne 0x140012b3e
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x140012b26
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
cmp rsi, r15
jne 0x140012b3e
cmp dword [rbp + 8], r15d
jne 0x140012b3e
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000b3a0
cmp rdi, r15
je 0x140012b4c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012b66
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.140020cb0
cmp rbx, r15
jne 0x140012b5b
jmp 0x140012522
mov ecx, 0x80070057
call fcn.14000b1c4
int3