Function at 0x14008e020
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rsi, qword [rcx + 0xc0]
xor ebp, ebp
mov r14, rdx
mov r15, rcx
test rsi, rsi
jne 0x14008e053
mov rsi, qword [rcx + 0x118]
mov rbx, qword [0x140189c38]
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x14008e121
nop word [rax + rax]
cmp qword [r15 + 0xc0], rbp
je 0x14008e091
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x14008e091
mov rdx, rsi
call fcn.1400e89f4
test eax, eax
je 0x14008e0a9
mov rcx, qword [rbx + 0x118]
test rcx, rcx
je 0x14008e111
mov rdx, rsi
call fcn.1400e89f4
test eax, eax
jne 0x14008e111
mov rcx, qword [rbx + 0x388]
call fcn.1400e825c
cmp word [r14], bp
je 0x14008e0c5
mov rcx, r14
call fcn.1400e81d8
jmp 0x14008e0c7
xor eax, eax
mov qword [rbx + 0x388], rax
lea r9, [rsp + 0x30]
mov rcx, qword [0x14018ec80]
mov r8, rdi
mov edx, 0x1053
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, edi
je 0x14008e111
mov rcx, qword [0x14018ec78]
mov r9, rdi
movsxd r8, eax
mov edx, 0x7eb
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rbx + 0x6b0]
test rbx, rbx
jne 0x14008e070
mov rcx, qword [0x14018e780]
test rcx, rcx
je 0x14008e197
cmp qword [rcx], rbp
je 0x14008e197
xor ebx, ebx
xor eax, eax
nop word [rax + rax]
mov rcx, qword [rax + rcx]
mov rdx, rsi
call fcn.1400e89f4
mov rcx, qword [0x14018e780]
test eax, eax
je 0x14008e16c
inc rbx
inc ebp
mov rax, rbx
shl rax, 4
cmp qword [rax + rcx], 0
jne 0x14008e140
jmp 0x14008e197
movsxd rbx, ebp
add rbx, rbx
mov rcx, qword [rcx + rbx*8 + 8]
call fcn.1400e825c
mov rcx, r14
call fcn.1400e81d8
mov rcx, qword [0x14018e780]
mov qword [rcx + rbx*8 + 8], rax
mov rcx, qword [0x14018e780]
movsxd r15, ebp
test rcx, rcx
je 0x14008e1ad
mov rbx, r15
shl rbx, 4
cmp qword [rbx + rcx], 0
jne 0x14008e207
lea eax, [rbp + 2]
movsxd rdx, eax
shl rdx, 4
call fcn.1400e8278
mov rcx, rsi
mov qword [0x14018e780], rax
call fcn.1400e81d8
mov rcx, qword [0x14018e780]
mov rbx, r15
shl rbx, 4
mov qword [rbx + rcx], rax
mov rcx, r14
call fcn.1400e81d8
mov rcx, qword [0x14018e780]
mov qword [rbx + rcx + 8], rax
lea rcx, [r15 + 1]
mov rax, qword [0x14018e780]
add rcx, rcx
mov qword [rax + rcx*8], 0
lea r8, [rsp + 0x80]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSysinternalsProcess_ExplorerProcessComments
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14008e295
mov rdx, qword [0x14018e780]
mov rcx, qword [rdx + rbx + 8]
cmp word [rcx], ax
jne 0x14008e250
mov rdx, qword [rdx + rbx]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14008e287
cmp word [rcx + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x14008e250
mov rdx, qword [rdx + rbx]
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret