Function at 0x14000ba10
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x14006c868]
xor rax, rbp
mov qword [rbp + 0x140], rax
xor r13d, r13d
mov r12d, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [rbp], r13
test rdx, rdx
je 0x14000babe
mov eax, dword [0x140057dd0]
cmp dword [rcx], eax
jne 0x14000bae9
mov eax, dword [0x140057dd4]
cmp dword [rcx + 4], eax
jne 0x14000bae9
mov eax, dword [0x140057dd8]
cmp dword [rcx + 8], eax
jne 0x14000bae9
mov eax, dword [0x140057ddc]
cmp dword [rcx + 0xc], eax
jne 0x14000bae9
lea rax, str.0___Use_OBJECT_ENTRY_NON_CREATEABLE_EX_macro_if_you_want_to_register_class_categories_for_non_creatable_objects._
lea rdx, [0x140053e90]
lea ecx, [r13 + 2]
xor r9d, r9d
mov r8d, 0x19a2
mov qword [rsp + 0x20], rax
call fcn.14001e440
cmp eax, 1
jne 0x14000baaf
int3
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000babe
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.14001f7f0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x150]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
lea rax, [rbp]
lea r9, [0x140055d08]
lea r8d, [rdx + 1]
lea rcx, [0x140057df0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000baaf
cmp dword [rdi], r13d
je 0x14000bcf4
lea r14, str.p_0
lea r15, str.pEntry__iType__2
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x30]
mov eax, dword [rcx]
mov dword [rdx], eax
mov eax, dword [rcx + 4]
mov dword [rdx + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
mov eax, dword [rcx + 0xc]
mov dword [rdx + 0xc], eax
mov eax, dword [rdi]
test r12d, r12d
je 0x14000bc30
cmp eax, 1
jne 0x14000bba3
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000bb8e
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
lea ecx, [rax + 1]
xor r9d, r9d
mov r8d, 0xac
mov qword [rsp + 0x20], r14
call fcn.14001e440
cmp eax, 1
jne 0x14000bb8a
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, 1
mov rdx, rsi
call qword [rax + 0x28]
jmp 0x14000bc10
cmp eax, 2
je 0x14000bbcc
xor r9d, r9d
lea rdx, [0x140053e90]
mov r8d, 0x19c1
lea ecx, [r9 + 2]
mov qword [rsp + 0x20], r15
call fcn.14001e440
cmp eax, 1
jne 0x14000bbcc
int3
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000bbfd
xor r9d, r9d
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
mov r8d, 0xac
lea ecx, [r9 + 2]
mov qword [rsp + 0x20], r14
call fcn.14001e440
cmp eax, 1
jne 0x14000bbf9
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, 1
mov rdx, rsi
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
jns 0x14000bce7
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000bc29
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
jmp 0x14000bac0
cmp eax, 1
jne 0x14000bc7a
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000bc65
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
lea ecx, [rax + 1]
xor r9d, r9d
mov r8d, 0xac
mov qword [rsp + 0x20], r14
call fcn.14001e440
cmp eax, 1
jne 0x14000bc61
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, 1
mov rdx, rsi
call qword [rax + 0x30]
jmp 0x14000bce7
cmp eax, 2
je 0x14000bca3
xor r9d, r9d
lea rdx, [0x140053e90]
mov r8d, 0x19d2
lea ecx, [r9 + 2]
mov qword [rsp + 0x20], r15
call fcn.14001e440
cmp eax, 1
jne 0x14000bca3
int3
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000bcd4
xor r9d, r9d
lea rdx, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlcomcli.h
mov r8d, 0xac
lea ecx, [r9 + 2]
mov qword [rsp + 0x20], r14
call fcn.14001e440
cmp eax, 1
jne 0x14000bcd0
int3
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
mov r8d, 1
mov rdx, rsi
call qword [rax + 0x40]
add rdi, 0x10
cmp dword [rdi], r13d
jne 0x14000bb30
test r12d, r12d
jne 0x14000baaf
lea r8d, [r12 + 0x40]
lea rdx, [rbp + 0xc0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xc0]
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
inc eax
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x14000baaf
cmp edi, 0x400
jg 0x14000bd7d
movsxd rsi, edi
mov rcx, rsi
call fcn.140009a80
test al, al
je 0x14000bd7d
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x14000bd6a
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004f000
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x14000bdae
or rax, 0xffffffffffffffff
movsxd rcx, edi
sub rax, rcx
cmp rax, 0x10
jb 0x14000c107
add rcx, 0x10
call fcn.1400233a0
test rax, rax
jne 0x14000bda4
mov rcx, r13
jmp 0x14000bdae
mov qword [rax], r13
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xc0]
mov r9d, 3
mov r8d, edi
call fcn.140008720
mov rsi, rax
test rax, rax
je 0x14000c0e9
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov edx, 0x80
call fcn.140023400
test eax, eax
je 0x14000be1d
cmp eax, 0xc
je 0x14000be12
cmp eax, 0x16
je 0x14000be07
cmp eax, 0x22
je 0x14000be07
cmp eax, 0x50
je 0x14000be1d
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea rcx, [rbp + 0x40]
mov r8, rsi
mov edx, 0x80
call fcn.140022380
test eax, eax
je 0x14000be67
cmp eax, 0xc
je 0x14000be5c
cmp eax, 0x16
je 0x14000be51
cmp eax, 0x22
je 0x14000be51
cmp eax, 0x50
je 0x14000be67
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x40]
mov edx, 0x80
call fcn.140022380
test eax, eax
je 0x14000beb5
cmp eax, 0xc
je 0x14000beaa
cmp eax, 0x16
je 0x14000be9f
cmp eax, 0x22
je 0x14000be9f
cmp eax, 0x50
je 0x14000beb5
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x20], 0xffffffff80000000
mov dword [rbp + 0x28], r13d
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
mov dword [rbp + 8], r13d
call fcn.140008c00
test eax, eax
jne 0x14000bf5d
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r13
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r12, eax
test rdi, rdi
je 0x14000bf41
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
test r12, r12
jne 0x14000bf5d
cmp dword [rbp + 8], r13d
jne 0x14000bf5d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140008b30
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov edx, 0x80
call fcn.140023400
test eax, eax
je 0x14000bfab
cmp eax, 0xc
je 0x14000bfa0
cmp eax, 0x16
je 0x14000bf95
cmp eax, 0x22
je 0x14000bf95
cmp eax, 0x50
je 0x14000bfab
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea rcx, [rbp + 0x40]
mov r8, rsi
mov edx, 0x80
call fcn.140022380
test eax, eax
je 0x14000bff5
cmp eax, 0xc
je 0x14000bfea
cmp eax, 0x16
je 0x14000bfdf
cmp eax, 0x22
je 0x14000bfdf
cmp eax, 0x50
je 0x14000bff5
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x40]
mov edx, 0x80
call fcn.140022380
test eax, eax
je 0x14000c043
cmp eax, 0xc
je 0x14000c038
cmp eax, 0x16
je 0x14000c02d
cmp eax, 0x22
je 0x14000c02d
cmp eax, 0x50
je 0x14000c043
mov ecx, 0x80004005
call fcn.140008870
int3
mov ecx, 0x80070057
call fcn.140008870
int3
mov ecx, 0x8007000e
call fcn.140008870
int3
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.140008c00
mov rdi, qword [rbp + 0x10]
test eax, eax
jne 0x14000c0ce
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
test rdi, rdi
je 0x14000c0b6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
test rsi, rsi
jne 0x14000c0ce
cmp dword [rbp + 8], r13d
jne 0x14000c0ce
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140008b30
test rdi, rdi
je 0x14000c0dc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000baaf
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400233e0
test rbx, rbx
jne 0x14000c0f2
jmp 0x14000baaf
mov ecx, 0x80070057
call fcn.140008870
int3