Function at 0x14010c5b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r15, rcx
lea r9, [rsp + 0x58]
lea r8, str.OnboardSearchboxOnTaskbar
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov rdi, 0xffffffff80000001
mov rcx, rdi
call fcn.14002c200
add eax, 0x7ff8fffe
cmp eax, 1
ja 0x14010ca7d
lea r9, str.SearchboxOnboardCompletedEvent
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x50], rax
inc rax
test rax, 0xfffffffffffffffe
je 0x14010ca73
lea r9, [rsp + 0x40]
lea r8, str.SearchboxTaskbarMode
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov rcx, rdi
call fcn.14002c200
mov edi, eax
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x44]
call fcn.14010915c
xor r12d, r12d
test edi, edi
js 0x14010ca57
mov rcx, qword [r15 + 0x2c0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x14006b68f.0]
mov edi, eax
cmp dword [rsp + 0x40], 2
jne 0x14010c6d4
mov r9d, eax
lea r8, str.Enabled_SP:_d
lea edx, [r12 + 0x14]
lea rcx, [rsp + 0x60]
call fcn.14002d868
lea rcx, [rsp + 0x60]
lea rdx, str.Enabled
test eax, eax
cmovs rcx, rdx
jmp 0x14010ca5e
mov ecx, reloc.SHELL32.dll_Shell_MergeMenus
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
je 0x14010c6f5
lea rcx, str.DisabledInSafeMode
jmp 0x14010ca5e
call fcn.140099b64
test al, al
je 0x14010c70a
lea rcx, str.DisabledForTabletMode
jmp 0x14010ca5e
mov ecx, 1
call fcn.140024c74
test al, al
je 0x14010c724
lea rcx, str.DisabledForTabletPostureMode
jmp 0x14010ca5e
test dil, 1
jne 0x14010c736
lea rcx, str.DisabledForVerticalTaskbar
jmp 0x14010ca5e
mov ecx, 0x2000000
call qword [sym.imp.SHELL32.dll_SHRestricted]
nop dword [rax + rax]
test eax, eax
je 0x14010c757
lea rcx, str.DisabledByPolicy
jmp 0x14010ca5e
lea rcx, [rsp + 0x44]
call qword [sym.imp.USERENV.dll_GetProfileType]
nop dword [rax + rax]
test eax, eax
je 0x14010c771
mov eax, r12d
jmp 0x14010c776
call fcn.140020b4c
mov rcx, qword [rbp + 0xc8]
test eax, eax
jns 0x14010c7aa
mov r9d, eax
lea r8, str.pcshell_shellexplorer_taskband2_taskband2.cpp
mov edx, 0x109e
call fcn.14009cb2c
call fcn.14006ec30
test al, al
je 0x14010c7bd
lea rcx, str.DisabledForPPIPro
jmp 0x14010ca5e
test byte [rsp + 0x44], 2
je 0x14010c795
lea rcx, str.DisabledForRoamingProfiles
jmp 0x14010ca5e
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x20010010
lea r8, [0x14030efa0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rsp + 0x4c], r12d
je 0x14010c818
lea rcx, str.DisabledForRetailDemoMode
jmp 0x14010ca5e
call fcn.14020dbe0
test al, al
je 0x14010c82d
lea rcx, str.DisabledForSharedPCMode
jmp 0x14010ca5e
call fcn.1401fc980
test eax, eax
jne 0x14010ca4e
call fcn.1401fc920
test eax, eax
jne 0x14010ca4e
call fcn.1400ed020
test eax, eax
jne 0x14010ca4e
call fcn.140070b30
test al, al
je 0x14010c869
lea rcx, str.DisabledForUnattendedAutoLogon
jmp 0x14010ca5e
call fcn.14006ee8c
test al, al
je 0x14010c87e
lea rcx, str.DisabledInAuditMode
jmp 0x14010ca5e
mov ecx, 0x1d
call qword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
nop dword [rax + rax]
test eax, eax
je 0x14010c89f
lea rcx, str.NotAllowedOnSKU
jmp 0x14010ca5e
call fcn.14010c478
test al, al
je 0x14010c8b4
lea rcx, str.DisabledForStagingInProgress
jmp 0x14010ca5e
mov dil, 1
mov edx, 2
mov rcx, qword [r15 + 8]
call qword [0x1403ad688]
nop dword [rax + rax]
mov rcx, rax
lea rdx, str.TaskbarMonitor
call qword [0x1403ad630]
nop dword [rax + rax]
mov dword [rsp + 0x60], PathIsExe
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov dword [rbp - 0x7c], ecx
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetMonitorInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14010c929
mov eax, dword [rsp + 0x6c]
sub eax, dword [rsp + 0x64]
movzx edi, dil
cmp eax, 0x4ac
cmovl edi, r12d
mov rcx, qword [r15 + 8]
call fcn.14002c93c
mov r14d, eax
mov cl, dil
call fcn.1400beb90
xor r8d, r8d
mov edx, r14d
mov ecx, eax
call fcn.14002cb90
mov esi, eax
mov rcx, qword [r15 + 0x2c0]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x248]
call qword [case.0x14006b68f.0]
mov edi, eax
mov rcx, qword [r15 + 0x2c0]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x240]
call qword [case.0x14006b68f.0]
mov r15d, eax
cmp eax, 3
jge 0x14010c99c
imul edx, r15d, 0x31
mov ecx, DllRegisterServer
sub ecx, edx
xor r8d, r8d
mov edx, r14d
call fcn.14002cb90
sub edi, eax
cmp edi, esi
jl 0x14010ca18
lea rdx, str.Onboarded
mov ecx, 1
call fcn.1400abbbc
test eax, eax
js 0x14010ca63
mov r9d, dword [rsp + 0x40]
lea r8, str.SearchboxTaskbarModePrevious
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov rdi, 0xffffffff80000001
mov rcx, rdi
call fcn.14019c118
mov r9d, 2
lea r8, str.SearchboxTaskbarMode
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov rcx, rdi
call fcn.14019c118
lea r9, str.TraySettings
xor r8d, r8d
lea edx, [r8 + 0x1a]
mov ecx, 0xffff
call qword [0x1403ad6b0]
nop dword [rax + rax]
jmp 0x14010ca63
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
mov r9d, edi
lea r8, str.Overflow_AvailableSpace:_d_TrayWidth:_d_PinnedApp:_d_Dpi:_u
mov edx, DAD_DragLeave
lea rcx, [rbp - 0x70]
call fcn.14002d868
lea rcx, [rbp - 0x70]
lea rdx, str.Overflow
jmp 0x14010c6c9
lea rcx, str.DisabledForKioskModes
jmp 0x14010ca5e
lea rcx, str.SearchboxTaskbarModeRegKeyMissing
call fcn.14010c20c
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x50]
call fcn.1401a41e0
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret