Function at 0x14001530c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14010d0f8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rsi + 0x1428], eax
lea rcx, [rsi + 0x13a0]
call qword [sym.imp.USER32.dll_SetRectEmpty]
nop dword [rax + rax]
lea rcx, [rsi + 0x1390]
call qword [sym.imp.USER32.dll_SetRectEmpty]
nop dword [rax + rax]
mov r15d, 1
mov dword [rbp - 0x19], r15d
xor ebx, ebx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
lea rcx, [rsi + 0x1e0]
xor r8d, r8d
lea rdx, [rbp - 0x19]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rsi + 0x1a8], eax
mov rcx, rsi
call fcn.140025d8c
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
lea rcx, [rsi + 0x8c]
call qword [sym.imp.USER32.dll_SetRectEmpty]
nop dword [rax + rax]
lea r9, [rsi + 0x40]
lea r8, [0x14010c370]
call fcn.14001eb0c
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000088
mov dword [rsp + 0x20], 0x86000000
xor r9d, r9d
lea r8, [rbp + 0x17]
xor edx, edx
mov rcx, rsi
call fcn.14001e984
mov rcx, qword [rsi + 8]
test rcx, rcx
jne 0x14001543b
mov r14d, 0x80004005
mov edi, r14d
jmp 0x1400154c2
mov edi, 0xffffffec
mov edx, edi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
nop dword [rax + rax]
btr rax, 0x16
mov r8, rax
mov edx, edi
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
nop dword [rax + rax]
mov r14d, 0x80004005
mov edi, r14d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x1400154c2
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
nop dword [rax + rax]
mov qword [rsi + 0x178], rax
test rax, rax
cmovne edi, ebx
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop dword [rax + rax]
test edi, edi
js 0x1400154c2
mov rcx, rsi
call fcn.14002935c
mov edi, eax
mov eax, ebx
cmp qword [rsi + 0xd8], rbx
sete al
mov dword [rsi + 0x158], eax
test edi, edi
js 0x140015601
mov qword [rbp + 0x17], rbx
mov edx, 0x6f
lea rcx, [rbp + 0x17]
call fcn.14001fd54
mov rcx, qword [rbp + 0x17]
test rcx, rcx
cmove edi, r14d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
test edi, edi
js 0x140015601
lea rdi, [rsi + 0x1410]
mov rcx, rdi
call fcn.14001d4bc
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001555b
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov r12, qword [rsi + 8]
mov rdi, qword [rdi]
test r12, r12
je 0x14001555b
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ole32.dll_RegisterDragDrop]
nop dword [rax + rax]
test eax, eax
js 0x14001555b
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], r12
lea r12, [rsi + 0x208]
mov rcx, r12
call fcn.14001d1c4
mov edi, eax
test eax, eax
js 0x140015601
mov rcx, qword [r12]
test rcx, rcx
cmove edi, r14d
test edi, edi
js 0x140015601
add rcx, 0xa0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rax, qword [r12]
mov dword [rax + 0x74], reloc.OLEAUT32.dll_SafeArrayGetDim
test byte [0x140114440], r15b
je 0x1400155c3
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [0x1400f2150]
call fcn.140011cfc
lea r12, [rsi + 0x200]
mov rcx, r12
call fcn.14001d04c
mov edi, eax
test byte [0x140114440], r15b
je 0x1400155f5
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [0x1400f1d50]
call fcn.140011cfc
test edi, edi
js 0x140015601
cmp qword [r12], rbx
cmove edi, r14d
mov qword [rbp - 0x31], rbx
test edi, edi
js 0x140015830
mov rcx, qword [rsi + 0x200]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rcx, qword [rsi + 0x200]
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
lea rdx, [0x1400f2a20]
mov rax, qword [rax]
call qword [case.0x140066f27.0]
mov edi, eax
test eax, eax
js 0x140015830
cmp qword [rbp - 0x31], rbx
cmove edi, r14d
test edi, edi
js 0x140015830
mov rcx, qword [rsi + 0x208]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi + 8]
mov rax, qword [rax + 0xb0]
call qword [case.0x140066f27.0]
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015830
mov rdx, qword [rbp - 0x31]
mov rcx, qword [rsi + 0x208]
call fcn.140033858
mov edi, eax
test eax, eax
js 0x140015830
lea r13, [rsi + 0x210]
mov rcx, r13
call fcn.14001d3dc
mov edi, eax
test eax, eax
js 0x140015830
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rcx, qword [rbp - 0x31]
mov rax, qword [r13]
test rcx, rcx
je 0x14001582b
cmp qword [rax + 0x40], rbx
jne 0x140015826
cmp dword [rax + 0x48], ebx
jne 0x140015826
cmp qword [rax + 0x38], rbx
jne 0x140015826
mov qword [rax + 0x40], rsi
mov qword [rax + 0x38], rcx
mov dword [rax + 0x48], ebx
mov r13, qword [r13]
mov rdx, qword [r13 + 0x38]
test rdx, rdx
je 0x140015826
cmp dword [r13 + 0x48], ebx
jne 0x140015826
lea r8, [0x1400f2d70]
mov rcx, r13
call fcn.14001eda8
mov edi, eax
test eax, eax
js 0x140015830
add dword [r13 + 0x48], r15d
test eax, eax
js 0x140015830
lea r12, [rsi + 0x1f0]
mov rcx, r12
call fcn.14001d1c4
mov edi, eax
test eax, eax
js 0x140015830
mov rcx, qword [r12]
test rcx, rcx
cmove edi, r14d
test edi, edi
js 0x140015830
add rcx, 0xa0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rax, qword [r12]
mov dword [rax + 0x74], SafeArrayGetDim
mov rcx, qword [r12]
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x68]
call qword [case.0x140066f27.0]
mov rcx, qword [r12]
mov rax, qword [rcx]
mov r8d, r15d
mov rdx, qword [rsi + 8]
mov rax, qword [rax + 0xb0]
call qword [case.0x140066f27.0]
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015830
test byte [0x140114440], r15b
je 0x1400157e6
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [0x1400f2190]
call fcn.140011cfc
lea r12, [rsi + 0x1e8]
mov rcx, r12
call fcn.14001ca08
mov edi, eax
test byte [0x140114440], r15b
je 0x140015818
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [0x1400f2080]
call fcn.140011cfc
test edi, edi
js 0x140015830
cmp qword [r12], rbx
cmove edi, r14d
jmp 0x140015830
mov edi, r14d
jmp 0x140015830
mov edi, 0x80070057
mov qword [rbp - 0x29], rbx
test edi, edi
js 0x140015a36
mov rcx, qword [rsi + 0x1e8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rcx, qword [rsi + 0x1e8]
mov rax, qword [rcx]
lea r8, [rbp - 0x29]
lea rdx, [0x1400f2a20]
mov rax, qword [rax]
call qword [case.0x140066f27.0]
mov edi, eax
test eax, eax
js 0x140015a36
mov rcx, qword [rbp - 0x29]
test rcx, rcx
cmove edi, r14d
test edi, edi
js 0x140015a36
mov rdx, rcx
mov rcx, qword [rsi + 0x1f0]
call fcn.140033858
mov edi, eax
test eax, eax
js 0x140015a36
lea r13, [rsi + 0x1f8]
mov rcx, r13
call fcn.14001d2fc
mov edi, eax
test eax, eax
js 0x140015a36
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov rcx, qword [rbp - 0x29]
mov rax, qword [r13]
test rcx, rcx
je 0x140015a31
cmp qword [rax + 0x40], rbx
jne 0x140015a2c
cmp dword [rax + 0x48], ebx
jne 0x140015a2c
cmp qword [rax + 0x38], rbx
jne 0x140015a2c
mov qword [rax + 0x40], rsi
mov qword [rax + 0x38], rcx
mov dword [rax + 0x48], ebx
mov r13, qword [r13]
mov rdx, qword [r13 + 0x38]
test rdx, rdx
je 0x140015a2c
cmp dword [r13 + 0x48], ebx
jne 0x140015a2c
lea r8, [0x1400f2d80]
mov rcx, r13
call fcn.14001eda8
mov edi, eax
test eax, eax
js 0x14001593b
add dword [r13 + 0x48], r15d
test edi, edi
js 0x140015a36
lea r12, [rsi + 0x218]
mov rax, rsi
lea rdx, [rsi + 0x1c8]
neg rax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 7]
mov rdx, qword [rsi + 8]
mov rcx, r12
call fcn.140021da8
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015a36
mov dword [rsi + 0x28c], SafeArrayGetDim
mov dword [rsi + 0x290], r15d
mov rax, qword [r12]
mov edx, r15d
mov rcx, r12
mov rax, qword [rax + 0x68]
call qword [case.0x140066f27.0]
mov qword [rbp + 0x17], rbx
mov edx, 0xc9
lea rcx, [rbp + 0x17]
call fcn.14001fd54
mov edx, 0x12d
mov rcx, qword [0x14010ce58]
call qword [sym.imp.USER32.dll_LoadIconW]
nop dword [rax + rax]
mov qword [r12 + 0xd0], rax
lea rcx, [r12 + 0x2c]
call qword [sym.imp.USER32.dll_IsRectEmpty]
nop dword [rax + rax]
test eax, eax
jne 0x140015a01
mov dword [r12 + 0x26c], r15d
lea rdx, [r12 + 0x2c]
mov rcx, r12
call fcn.140021720
mov edx, 0x453
mov r8d, 0x51c
mov rcx, r12
call fcn.14002233c
test eax, eax
cmove edi, r14d
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
jmp 0x140015a3d
mov edi, r14d
jmp 0x140015a36
mov edi, 0x80070057
lea r12, [rsi + 0x218]
test edi, edi
js 0x140015bcc
mov edx, 0x454
mov r8d, 0x51b
mov rcx, r12
call fcn.14002233c
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015bcc
mov edx, 0x458
mov r8d, 0x521
mov rcx, r12
call fcn.14002233c
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015bcc
mov rax, rsi
lea rcx, [rsi + 0x1c8]
neg rax
sbb rax, rax
and rax, rcx
mov qword [rbp + 0x17], rax
lea r13, [rsi + 0xf48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 7]
mov rdx, qword [rsi + 8]
mov rcx, r13
call fcn.14002ebe0
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015bcc
cmp byte [r13 + 0x3b0], r15b
je 0x140015b18
mov byte [r13 + 0x3b0], r15b
lea rcx, [r13 + 0x240]
mov rax, qword [rcx]
mov edx, ebx
cmp dword [r13 + 0x28], ebx
setne dl
mov rax, qword [rax + 0x68]
call qword [case.0x140066f27.0]
mov rcx, qword [r13 + 0x60]
test rcx, rcx
je 0x140015b18
mov rax, qword [rcx]
lea rdx, [r13 + 0x2c]
mov r9, r13
xor r8d, r8d
mov rax, qword [rax + 8]
call qword [case.0x140066f27.0]
mov dword [rsi + 0x12fc], r15d
lea rcx, [rsi + 0x1188]
call fcn.140035aec
lea rcx, [rsi + 0x1018]
call fcn.140035aec
mov byte [rsi + 0x12f9], r15b
cmp dword [rsi + 0x12fc], ebx
je 0x140015b5d
mov ecx, 3
call fcn.1400399c8
mov dword [rsi + 0x12e8], eax
mov dword [rsi + 0x12a0], r15d
cmp byte [0x140114f11], bl
je 0x140015b7d
mov al, r15b
neg al
sbb ecx, ecx
neg ecx
add ecx, 2
call fcn.1400399c8
mov ecx, eax
call fcn.140037df8
mov dword [rsi + 0xfbc], 0xe
mov dword [rsi + 0xfc0], r15d
mov rax, qword [r13]
xor edx, edx
mov rcx, r13
mov rax, qword [rax + 0x68]
call qword [case.0x140066f27.0]
lea r13, [rsi + 0x598]
mov rax, qword [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 7]
mov rdx, qword [rsi + 8]
mov rcx, r13
call fcn.14002bdd0
test eax, eax
jne 0x140015dd7
mov edi, r14d
lea r13, [rsi + 0x598]
test edi, edi
js 0x140015d7a
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x140066f27.0]
lea rdi, [rsi + 0x48]
mov rax, qword [rdi]
mov rdx, r12
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x140066f27.0]
mov rax, qword [rdi]
lea rdx, [rsi + 0xf48]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x140066f27.0]
mov rax, qword [rdi]
mov rdx, r13
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x140066f27.0]
mov rax, qword [rdi]
mov rdx, qword [rsi + 0x1f0]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x140066f27.0]
mov rax, qword [rdi]
mov rdx, qword [rsi + 0x208]
mov rcx, rdi
mov rax, qword [rax + 0x48]
call qword [case.0x140066f27.0]
mov dword [rsi + 0x1ac], ebx
mov edx, ebx
cmp dword [rsi + 0x58], ebx
jle 0x140015c99
mov rcx, rbx
test rcx, rcx
js 0x140015e00
cmp edx, dword [rsi + 0x58]
jge 0x140015e00
mov rax, qword [rsi + 0x50]
mov r8, qword [rcx + rax]
test r8, r8
je 0x140015c8d
mov dword [r8 + 0x7c], ebx
add edx, r15d
add rcx, 8
cmp edx, dword [rsi + 0x58]
jl 0x140015c6a
mov rcx, rsi
call fcn.14001801c
mov edi, eax
test eax, eax
js 0x140015d7a
mov rcx, rsi
call fcn.140017f58
mov edi, eax
test eax, eax
js 0x140015d7a
lea rcx, str.TaskbarCreated
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
nop dword [rax + rax]
mov dword [rsi + 0x13b0], eax
test eax, eax
cmove edi, r14d
test edi, edi
js 0x140015d7a
mov rax, qword [rsi + 8]
mov qword [rsi + 0x1388], rax
lea rcx, [rsi + 0x1348]
call fcn.140052ac4
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.140018280
mov rcx, rsi
call fcn.140018d8c
call fcn.140037180
mov dword [rbp - 0x39], ebx
mov dword [rbp - 0x21], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x17]
xor r8d, r8d
lea rdx, str.EnableBalloon
mov rcx, qword [rsi + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140015d6c
cmp dword [rbp + 0x17], 4
jne 0x140015d6c
mov eax, ebx
test eax, eax
jne 0x140015d6c
mov r15d, ebx
cmp dword [rbp - 0x39], ebx
setne r15b
mov eax, ebx
test r15d, r15d
sete al
mov dword [rsi + 0x1424], eax
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140015d91
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140066f27.0]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140015da7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140066f27.0]
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400e6ab0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rsi + 0x60c], 0xd
mov dword [rsi + 0x610], r15d
mov rax, qword [r13]
xor edx, edx
mov rcx, r13
mov rax, qword [rax + 0x68]
call qword [case.0x140066f27.0]
jmp 0x140015bdb
mov ecx, 0xc000008c
call fcn.140012ac8
int3