Function at 0x1401eced8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov r14, r8
mov rbx, rdx
xor r15d, r15d
mov qword [rbp - 9], r15
xor edx, edx
lea rcx, [rbp - 9]
call fcn.14006ee3c
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 3]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401ed0d8
mov dword [rbp - 1], r15d
mov dword [rbp + 0x67], r15d
mov dword [rbp + 0x7f], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x1401ecfb3
mov r9d, eax
lea r8, str.pcshell_shellexplorer_appsaver.cpp
lea edx, [r15 + 0x2e]
call fcn.1401efa20
int3
cmp dword [rbp - 1], r15d
jbe 0x1401ed0d8
mov eax, dword [rbp + 0x67]
inc eax
mov dword [rbp + 0x67], eax
mov edx, eax
lea rcx, [rbp + 0x17]
call fcn.1401ec2bc
nop
mov eax, dword [rbp + 0x7f]
inc eax
mov dword [rbp + 0x7f], eax
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401ec2bc
nop
mov esi, r15d
mov rbx, qword [rbp + 0x17]
mov rdi, qword [rbp + 0x1f]
mov eax, dword [rbp + 0x67]
mov dword [rbp + 0xb], eax
mov dword [rbp + 3], r15d
mov eax, dword [rbp + 0x7f]
mov dword [rbp + 7], eax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xb]
mov r8, rbx
mov edx, esi
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401ed088
mov eax, dword [rbp + 3]
mov dword [rbp + 0xf], eax
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rbx
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1401ed09d
mov rax, qword [rcx]
lea r9, [rbp + 0x27]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x10]
call qword [case.0x14006c37f.0]
test al, al
je 0x1401ed096
mov rdx, rbx
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401ed096
dec esi
jmp 0x1401ed096
cmp eax, 0x103
je 0x1401ed0bc
cmp eax, 0xea
jne 0x1401ed0aa
inc esi
jmp 0x1401ecff0
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xbad_function_call_void_]
nop dword [rax + rax]
int3
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
mov edx, 0x46
call fcn.1401ef7d4
nop
test rdi, rdi
je 0x1401ed0ca
mov rcx, rdi
call fcn.14006e364
nop
test rbx, rbx
je 0x1401ed0d8
mov rcx, rbx
call fcn.14006e364
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1401ed0ee
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1401ed10e
mov rax, qword [rcx]
cmp rcx, r14
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14006c37f.0]
mov qword [r14 + 0x38], r15
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret