Function at 0x1400114f0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x140061550]
xor rax, rbp
mov qword [rbp + 0x140], rax
xor r15d, r15d
mov r14d, r8d
mov r12, rdx
mov rbx, rcx
mov qword [rbp], r15
cmp rdx, r15
je 0x1400115a1
mov eax, dword [0x140052a90]
cmp dword [rcx], eax
jne 0x1400115cc
mov eax, dword [0x140052a94]
cmp dword [rcx + 4], eax
jne 0x1400115cc
mov eax, dword [0x140052a98]
cmp dword [rcx + 8], eax
jne 0x1400115cc
mov eax, dword [0x140052a9c]
cmp dword [rcx + 0xc], eax
jne 0x1400115cc
lea rax, str.0___Use_OBJECT_ENTRY_NON_CREATEABLE_EX_macro_if_you_want_to_register_class_categories_for_non_creatable_objects._
lea rdx, [0x14004f770]
lea ecx, [r15 + 2]
xor r9d, r9d
mov r8d, 0x19a2
mov qword [rsp + 0x20], rax
call fcn.14001f620
lea edi, [r15 + 1]
cmp eax, edi
jne 0x140011592
int3
mov rcx, qword [rbp]
cmp rcx, r15
je 0x1400115a1
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.14001e4a0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x150]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp]
mov edi, 1
lea r9, [0x1400512a8]
lea rcx, [0x140052ab0]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r15d
jl 0x140011592
cmp dword [r12], r15d
je 0x1400117c4
lea r13d, [rdi + 1]
mov rax, qword [r12 + 8]
lea rcx, str.pEntry__iType__2
lea rdx, str.p_0
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x30], xmm0
cmp r14d, r15d
je 0x140011701
cmp dword [r12], edi
jne 0x140011672
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x140011660
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x14001165c
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x28]
jmp 0x1400116e0
cmp dword [r12], r13d
je 0x1400116a1
mov qword [rsp + 0x20], rcx
lea rdx, [0x14004f770]
xor r9d, r9d
mov r8d, 0x19c1
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x14001169a
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x1400116d0
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x1400116cc
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x38]
cmp eax, r15d
mov esi, eax
jge 0x1400117b6
mov rcx, qword [rbp]
cmp rcx, r15
je 0x1400116fa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x1400115a3
cmp dword [r12], edi
jne 0x140011748
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x140011736
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x140011732
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x30]
jmp 0x1400117b6
cmp dword [r12], r13d
je 0x140011777
mov qword [rsp + 0x20], rcx
lea rdx, [0x14004f770]
xor r9d, r9d
mov r8d, 0x19d2
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x140011770
int3
lea rdx, str.p_0
mov rcx, qword [rbp]
cmp rcx, r15
jne 0x1400117a6
mov qword [rsp + 0x20], rdx
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
xor r9d, r9d
mov r8d, 0xac
mov ecx, r13d
call fcn.14001f620
cmp eax, edi
jne 0x1400117a2
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x40]
add r12, 0x10
cmp dword [r12], r15d
jne 0x140011606
cmp r14d, r15d
jne 0x140011592
lea rdx, [rbp + 0xc0]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xc0]
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
add eax, edi
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x140011592
cmp edi, 0x400
jg 0x14001184f
movsxd rsi, edi
mov rcx, rsi
call fcn.14000df04
cmp al, r15b
je 0x14001184f
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x14001183c
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004a0d0
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x140011880
or rax, 0xffffffffffffffff
movsxd rcx, edi
sub rax, rcx
cmp rax, 0x10
jb 0x140011be0
add rcx, 0x10
call fcn.14001f5e0
cmp rax, r15
jne 0x140011876
mov rcx, r15
jmp 0x140011880
mov qword [rax], r15
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xc0]
mov r9d, 3
mov r8d, edi
call fcn.14000a60c
mov r12, rax
cmp rax, r15
je 0x140011bd6
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001fda0
lea r13d, [rdi - 0x74]
lea r14d, [rdi - 0x30]
cmp eax, r15d
je 0x1400118fb
cmp eax, r13d
je 0x1400118f0
cmp eax, 0x16
je 0x1400118e5
cmp eax, 0x22
je 0x1400118e5
cmp eax, r14d
je 0x1400118fb
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.140020ea0
cmp eax, r15d
je 0x140011944
cmp eax, r13d
je 0x140011939
cmp eax, 0x16
je 0x14001192e
cmp eax, 0x22
je 0x14001192e
cmp eax, r14d
je 0x140011944
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140020ea0
cmp eax, r15d
je 0x140011991
cmp eax, r13d
je 0x140011986
cmp eax, 0x16
je 0x14001197b
cmp eax, 0x22
je 0x14001197b
cmp eax, r14d
je 0x140011991
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x20], 0xffffffff80000000
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
mov dword [rbp + 8], r15d
call fcn.14000aab4
cmp eax, r15d
jne 0x140011a3f
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x140011a1e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
cmp rsi, r15
jne 0x140011a3a
cmp dword [rbp + 8], r15d
jne 0x140011a3a
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000a904
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.14001fda0
cmp eax, r15d
je 0x140011a8c
cmp eax, r13d
je 0x140011a81
cmp eax, 0x16
je 0x140011a76
cmp eax, 0x22
je 0x140011a76
cmp eax, r14d
je 0x140011a8c
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea rcx, [rbp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.140020ea0
cmp eax, r15d
je 0x140011ad5
cmp eax, r13d
je 0x140011aca
cmp eax, 0x16
je 0x140011abf
cmp eax, 0x22
je 0x140011abf
cmp eax, r14d
je 0x140011ad5
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140020ea0
cmp eax, r15d
je 0x140011b22
cmp eax, r13d
je 0x140011b17
cmp eax, 0x16
je 0x140011b0c
cmp eax, 0x22
je 0x140011b0c
cmp eax, r14d
je 0x140011b22
mov ecx, 0x80004005
call fcn.14000a738
int3
mov ecx, 0x80070057
call fcn.14000a738
int3
mov ecx, 0x8007000e
call fcn.14000a738
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.14000aab4
mov rdi, qword [rbp + 0x10]
cmp eax, r15d
jne 0x140011bae
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r15
je 0x140011b96
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
cmp rsi, r15
jne 0x140011bae
cmp dword [rbp + 8], r15d
jne 0x140011bae
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000a904
cmp rdi, r15
je 0x140011bbc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011bd6
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14001e650
cmp rbx, r15
jne 0x140011bcb
jmp 0x140011592
mov ecx, 0x80070057
call fcn.14000a738
int3