Function at 0x140004880
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov r13, r8
mov r15, rdx
mov r14, rcx
xor eax, eax
mov dword [rbp + 0x67], eax
mov qword [rbp + 0x7f], rax
lea edx, [rax + 0x2f]
mov rcx, r15
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
lea r8d, [rax + 1]
lea rdx, [rbp - 1]
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
mov rdi, rax
mov dword [rbp + 0x67], 1
mov edx, 0x2f
lea r8d, [rdx + 0x2d]
lea rcx, [rbp - 1]
call qword [sym.imp.mfc140u.dll_CMFCColorBar::Rebuild]
nop
lea rcx, [r14 + 8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 9]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp + 0x67], 3
mov r9, qword [rdi]
mov ecx, dword [r9 - 0x10]
mov rdx, qword [r14 + 8]
mov dword [rsp + 0x20], ecx
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 9]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea rcx, [rbp - 0x11]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov eax, 0xf013f
mov r12d, 0xf023f
cmp dword [r14 + 0x10], 1
cmove r12d, eax
mov rdx, rsi
lea rcx, [rbp + 7]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdi, rax
mov qword [rbp + 0x1f], rax
mov edx, 0x5c
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CPaneFrameWnd::EnterDragMode]
mov ebx, eax
lea r8d, [rax + 1]
lea rdx, [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCToolBar::LoadState]
nop
mov rdx, rax
lea rcx, [rbp - 0x11]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp + 0xf]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r8d, ebx
lea rdx, [rbp - 0x19]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rdx, str.HKEY_CURRENT_USER
lea rcx, [rbp - 0x19]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
jne 0x1400049d4
mov rbx, 0xffffffff80000001
xor esi, esi
jmp 0x1400049f6
lea rdx, str.HKEY_LOCAL_MACHINE
lea rcx, [rbp - 0x19]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
xor esi, esi
mov ebx, esi
mov rcx, 0xffffffff80000002
test eax, eax
cmove rbx, rcx
lea rcx, [rbp - 0x19]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp - 0x11]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140004a48
cmp qword [rbp + 0x7f], 0
je 0x140004a48
xor bl, bl
jmp 0x140004a4a
mov bl, 1
lea rcx, [rbp - 0x11]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 9]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 1]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x140004a72
xor al, al
jmp 0x140004aee
mov rbx, qword [r13]
mov eax, dword [rbx - 0x10]
lea edi, [rax*2 + 2]
mov edx, 0x2f
mov rcx, r15
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
test eax, eax
js 0x140004aa5
lea r8d, [rax + 1]
lea rdx, [rbp + 0x67]
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCToolBar::LoadState]
jmp 0x140004ab2
mov rdx, r15
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret