Function at 0x14007fd70
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbp
push rbx
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x140403f00]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, qword [rcx + 0x10]
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x10
jb 0x1400800b1
cmp qword [rbx + 0x18], 0xf
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
mov r12, rbx
mov qword [r11 - 0x28], r15
jbe 0x14007fdce
mov r12, qword [rbx]
lea r15, [r14 + 0x10]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 7]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 7], xmm0
movdqu xmmword [rbp + 0x17], xmm1
cmp r15, rdi
jbe 0x14007fe68
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x14007fe2b
movabs rax, 0x8000000000000000
mov rdi, rcx
add rax, 0x27
mov rcx, rax
call fcn.14029a880
test rax, rax
je 0x14008006d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14007fe64
mov eax, reloc.WS2_32.dll_shutdown
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14007fe53
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400800b7
jmp 0x14007fe0c
test rcx, rcx
je 0x14007fe62
call fcn.14029a880
mov rsi, rax
jmp 0x14007fe64
xor esi, esi
mov qword [rbp + 7], rsi
mov r8, r14
mov qword [rbp + 0x17], r15
mov rdx, r12
mov qword [rbp + 0x1f], rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str..FriendlyAppName]
lea rax, [rbp - 0x29]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
movups xmmword [rsi + r14], xmm0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
mov byte [rsi + r15], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 0x21]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 0x19]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 0x11]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 9]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppLaunch
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 1]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14007ff80
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14007ff97
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp qword [rbp + 0x1f], 0xf
lea rdx, [rbp + 7]
mov rcx, qword [rbp - 0x19]
cmova rdx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp qword [rbp + 0x1f], 0xf
lea rdx, [rbp + 7]
mov rcx, qword [rbp - 0x11]
cmova rdx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14007ffde
mov rdx, qword [rbx]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp qword [rbx + 0x18], 0xf
jbe 0x14007fff2
mov rbx, qword [rbx]
mov rcx, qword [rbp - 1]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140080079
mov rcx, qword [rbp + 7]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140080074
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140080074
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14029abd4
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14029a860
add rsp, 0xa0
pop r14
pop rbx
pop rbp
ret
call fcn.14007f300
int3
call fcn.14007f260
int3