Function at 0x14000fee8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov rax, qword [0x14002f220]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x288], 0
jne 0x14000ff2e
xor eax, eax
jmp 0x14001040a
mov rax, qword [rsp + 0x280]
add rax, 0xc
mov rdx, rax
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x14000ff5d
xor eax, eax
jmp 0x14001040a
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 1
mov r8, qword [rsp + 0x288]
lea rdx, str.CLSID_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140010408
mov rcx, qword [rsp + 0x28]
call fcn.14000fe64
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000ffcb
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 8
jmp 0x14000ffda
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 1
mov dword [rsp + 0x20], 0x208
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x50]
lea rdx, str.InprocServer32
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1400100b7
mov r8d, 3
lea rdx, [0x140022338]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1400100b2
lea rax, [rsp + 0x56]
lea rdx, str.32.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400100a3
lea rax, [rsp + 0x56]
lea rdx, str.prx32.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400100a3
lea rax, [rsp + 0x56]
lea rdx, str.2pr32.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400100a3
lea rax, [rsp + 0x56]
lea rdx, str.cnv32.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400100a3
lea rax, [rsp + 0x56]
lea rdx, str.aut32.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400100b2
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 7
jmp 0x14001014d
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x50]
lea rdx, str.InprocServer
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14001014d
mov r8d, 3
lea rdx, [0x140022338]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14001014d
lea rax, [rsp + 0x56]
lea rdx, str.2prox.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001013e
lea rax, [rsp + 0x56]
lea rdx, str.2.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001013e
lea rax, [rsp + 0x56]
lea rdx, str.2disp.dll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14001014d
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 0
lea r8, [rsp + 0x30]
lea rdx, str.Ole1Class
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400101a4
cmp dword [rsp + 0x24], 0
je 0x140010180
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 0xc
jmp 0x14001018f
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 6
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140010373
lea r8, [rsp + 0x30]
lea rdx, str.Control
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400101fb
cmp dword [rsp + 0x24], 0
je 0x1400101d7
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 0xa
jmp 0x1400101e6
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140010373
lea r8, [rsp + 0x30]
lea rdx, str.Insertable
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140010252
cmp dword [rsp + 0x24], 0
je 0x14001022e
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 9
jmp 0x14001023d
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140010373
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x20], 0x28
mov rax, qword [rsp + 0x280]
add rax, 0x1c
lea r9, [rsp + 0x20]
mov r8, rax
lea rdx, str.ProgID
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140010373
mov rax, qword [rsp + 0x280]
add rax, 0x1c
mov r8, rax
lea rdx, str._sNotInsertable
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140010305
cmp dword [rsp + 0x24], 0
je 0x1400102e7
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 8
jmp 0x1400102f6
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140010373
mov rax, qword [rsp + 0x280]
add rax, 0x1c
mov r8, rax
lea rdx, str._sInsertable
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140010373
cmp dword [rsp + 0x24], 0
je 0x140010359
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 9
jmp 0x140010368
mov rax, qword [rsp + 0x280]
mov dword [rax + 0x74], 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x280]
mov ecx, dword [rcx + 0x74]
mov dword [rax + 0x70], ecx
mov dword [rsp + 0x20], 0x208
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x50]
lea rdx, str.ToolboxBitmap32
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x1400103d1
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x50]
lea rdx, str.ToolboxBitmap
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1400103ec
mov rax, qword [rsp + 0x280]
add rax, 0x90
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.MFC42u.dll_AfxDeleteObject
cmp qword [rsp + 0x28], 0
je 0x1400103ff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001040a
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140019330
add rsp, 0x278
ret