Function at 0x14000e220
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Check if process is running under wine
Delete file
Delete registry value
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rax, [section..bss]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov rbx, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.shell32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000e4d0
mov rsi, qword [sym.imp.ucrtbase.dll__wgetenv]
lea rcx, str.XDG_CONFIG_HOME
call rsi
mov rdx, rax
test rax, rax
je 0x14000e6e7
lea rcx, str.__unix_s_menus_applications_merged
call dbg.heap_wprintf
mov r8, rax
movzx ecx, word [r8]
mov qword [0x140020210], r8
mov rdx, r8
test cx, cx
je 0x14000e2bd
nop dword [rax + rax]
cmp cx, 0x2f
jne 0x14000e2b0
mov r10d, 0x5c
mov word [rdx], r10w
movzx ecx, word [rdx + 2]
add rdx, 2
test cx, cx
jne 0x14000e2a0
mov r11d, 0x5c
mov rcx, r8
mov word [r8 + 2], r11w
call dbg.create_directories
lea rcx, str.XDG_DATA_HOME
call rsi
mov rdx, rax
test rax, rax
je 0x14000e727
lea rcx, str.__unix_s
call dbg.heap_wprintf
mov r8, rax
movzx ecx, word [r8]
mov qword [0x140020208], r8
mov rdx, r8
test cx, cx
je 0x14000e32b
nop word [rax + rax]
cmp cx, 0x2f
jne 0x14000e31e
mov ecx, 0x5c
mov word [rdx], cx
movzx ecx, word [rdx + 2]
add rdx, 2
test cx, cx
jne 0x14000e310
mov r9d, 0x5c
mov rdx, r8
lea rcx, str._sdesktop_directories
mov word [r8 + 2], r9w
mov rdi, qword gs:[0x30]
call dbg.heap_wprintf
mov rcx, rax
mov rsi, rax
call dbg.create_directories
mov rax, qword [rdi + 0x60]
mov r8, rsi
xor edx, edx
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rax + 0x30]
call rsi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x14000e4c0
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
test rbx, rbx
jne 0x14000e3f0
jmp 0x14000e4b8
lea rdx, [0x140012878]
mov rcx, r12
call rbx
mov ebp, eax
test eax, eax
je 0x14000e4f0
lea rdx, [0x1400128bc]
mov rcx, r12
call rbx
test eax, eax
jne 0x14000e680
mov dword [rsp + 0x58], 1
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14000e4b8
cmp word [rbx], 0
je 0x14000e4b8
lea r13, [rsp + 0x68]
mov rcx, r13
call dbg.next_token
mov r12, rax
test rax, rax
je 0x14000e4b8
mov rbx, qword [sym.imp.ucrtbase.dll_wcscmp]
lea rdx, [0x14001286a]
mov rcx, rax
call rbx
test eax, eax
jne 0x14000e3b0
lea rbx, [rsp + 0x70]
lea rdx, str.SoftwareWineFileOpenAssociations
mov rcx, 0xffffffff80000001
mov r8, rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000e4a1
mov r12, qword [rsp + 0x70]
test r12, r12
je 0x14000e4a1
lea r13, [rsp + 0x64]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r13
lea rdx, str.Enable
mov rcx, r12
mov dword [rsp + 0x64], 0x20
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e498
movzx eax, byte [rsp + 0x70]
mov edx, eax
and edx, 0xffffffdf
cmp dl, 0x59
jne 0x14000e707
mov rcx, r12
call qword [sym.imp.advapi32.dll_RegCloseKey]
call sym.RefreshFileTypeAssociations
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jne 0x14000e3f0
nop dword [rax]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14000e4d8
test byte [0x140010000], 2
jne 0x14000e87c
nop dword [rax]
mov dword [rsp + 0x54], 1
mov eax, dword [rsp + 0x54]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0x70]
lea rdx, str.SoftwareWineMenuFiles
mov rcx, 0xffffffff80000001
mov r8, r14
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000e6d6
mov r12, qword [rsp + 0x70]
lea r13, [rsp + 0x64]
test r12, r12
je 0x14000e3e2
mov eax, 0x1000
mov dword [rsp + 0x64], 0x1000
mov dword [rsp + 0x70], 0x1000
mov ecx, eax
jmp 0x14000e56a
shl dword [rsp + 0x64], 1
mov r8, r15
xor edx, edx
shl dword [rsp + 0x70], 1
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x30]
call rsi
mov rax, qword [rdi + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x30]
call rsi
mov ecx, dword [rsp + 0x64]
add rcx, rcx
call dbg.xmalloc
mov ecx, dword [rsp + 0x70]
mov r15, rax
add rcx, rcx
call dbg.xmalloc
mov qword [rsp + 0x38], r14
mov r9, r13
mov r8, r15
mov qword [rsp + 0x30], rax
mov rbx, rax
mov edx, ebp
mov rcx, r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x14000e540
test eax, eax
je 0x14000e608
cmp eax, 0x103
je 0x14000e5d0
test byte [0x140010000], 2
jne 0x14000e658
mov rbp, qword gs:[0x30]
mov rax, qword [rbp + 0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rax + 0x30]
call rsi
mov rax, qword [rbp + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x30]
call rsi
mov rcx, r12
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x14000e3e2
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e6a8
add ebp, 1
mov r9, qword gs:[0x30]
mov rax, qword [r9 + 0x60]
mov qword [rsp + 0x48], r9
mov r8, r15
xor edx, edx
mov rcx, qword [rax + 0x30]
call rsi
mov r9, qword [rsp + 0x48]
mov r8, rbx
xor edx, edx
mov rax, qword [r9 + 0x60]
mov rcx, qword [rax + 0x30]
call rsi
jmp 0x14000e527
mov dword [rsp + 0x20], eax
lea r9, str.error__ld_reading_registry_n
lea r8, str.cleanup_menus
mov ecx, 1
lea rdx, [0x140010000]
call sym.wine_dbg_log.constprop.0
jmp 0x14000e5d0
lea rdx, [0x1400128c2]
mov rcx, r12
call rbx
test eax, eax
jne 0x14000e747
mov dword [rsp + 0x5c], 1
jmp 0x14000e3e2
lea r10, [0x140010000]
test byte [0x140010000], 8
jne 0x14000e808
mov rcx, r15
call qword [sym.imp.kernel32.dll_DeleteFileW]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
jmp 0x14000e61d
mov rdx, qword gs:[0x30]
mov dword [rdx + 0x68], eax
jmp 0x14000e3e2
lea rcx, str.WINEHOMEDIR
call rsi
lea rcx, str._s_.config_menus_applications_merged
mov rdx, rax
call dbg.heap_wprintf
mov r8, rax
jmp 0x14000e285
cmp al, 0x74
je 0x14000e498
cmp al, 0x54
je 0x14000e498
mov rcx, r12
cmp al, 0x31
jne 0x14000e5fa
jmp 0x14000e49b
lea rcx, str.WINEHOMEDIR
call rsi
lea rcx, str._s_.local_share
mov rdx, rax
call dbg.heap_wprintf
mov r8, rax
jmp 0x14000e2f4
lea rdx, [0x1400128c8]
mov rcx, r12
call rbx
test eax, eax
je 0x14000e8ae
cmp word [r12], 0x2d
je 0x14000e8fd
mov eax, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
mov rcx, r12
test eax, eax
jne 0x14000e8a4
call dbg.Process_Link
test eax, eax
jne 0x14000e3e2
mov dword [rsp + 0x54], 1
lea r13, [0x140010000]
test byte [0x140010000], 2
je 0x14000e3e2
mov rax, r12
shr rax, 0x10
je 0x14000e978
mov rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x14000e7d7
mov rcx, r12
call sym.wine_dbgstr_wn.part.0.constprop.0
mov qword [rsp + 0x20], rax
lea r9, str.failed_to_build_menu_item_for__s_n
mov rdx, r13
mov ecx, 1
lea r8, global___func__.3
call sym.wine_dbg_log.constprop.0
mov dword [rsp + 0x54], 1
jmp 0x14000e3e2
lea rax, str._null_
test r15, r15
je 0x14000e857
mov rax, r15
mov qword [rsp + 0x48], r10
shr rax, 0x10
je 0x14000e8e3
mov rdx, 0xffffffffffffffff
mov rcx, r15
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r10, qword [rsp + 0x48]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x14000e857
mov rcx, r15
call sym.wine_dbgstr_wn.part.0.constprop.0
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.removing_menu_related_file__s_n
mov rdx, r10
mov ecx, 3
lea r8, str.cleanup_menus
call sym.wine_dbg_log.constprop.0
jmp 0x14000e6bc
mov dword [rsp + 0x20], eax
lea r9, str.could_not_initialize_COM__error_0x_08lX_n
lea r8, global___func__.3
mov ecx, 1
lea rdx, [0x140010000]
call sym.wine_dbg_log.constprop.0
jmp 0x14000e4d0
call dbg.Process_URL
jmp 0x14000e77f
mov rcx, r13
call dbg.next_token
mov r12, rax
test rax, rax
je 0x14000e3e2
mov rcx, r13
call dbg.next_token
mov rdx, rax
test rax, rax
je 0x14000e3e2
mov rcx, r12
call dbg.thumbnail_lnk
jmp 0x14000e3e2
movzx edx, r15w
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
mov r10, qword [rsp + 0x48]
jmp 0x14000e857
lea r13, [0x140010000]
test byte [0x140010000], 2
je 0x14000e3e2
mov rax, r12
shr rax, 0x10
je 0x14000e966
mov rdx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x14000e941
mov rcx, r12
call sym.wine_dbgstr_wn.part.0.constprop.0
mov qword [rsp + 0x20], rax
lea r9, str.unknown_option__s_n
mov rdx, r13
mov ecx, 1
lea r8, global___func__.3
call sym.wine_dbg_log.constprop.0
jmp 0x14000e3e2
movzx edx, r12w
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
jmp 0x14000e941
movzx edx, r12w
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
jmp 0x14000e7d7