Function at 0x140011554
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor esi, esi
mov edi, ecx
cmp dword [0x140051668], esi
mov qword [rsp + 0x50], rsi
je 0x140011610
call fcn.1400108ec
call fcn.140010eac
cmp dword [0x14005166c], esi
je 0x140011656
cmp qword [0x140051660], rsi
je 0x140011656
call fcn.140013f08
test rax, rax
je 0x140011656
call fcn.140013f08
mov rcx, rax
xor edx, edx
call fcn.14002a084
test rax, rax
je 0x1400115ee
call fcn.140013f08
mov rcx, rax
xor edx, edx
call fcn.14002a084
jmp 0x1400115fb
call fcn.140013f08
mov rcx, rax
call fcn.140029fd0
mov rbx, rax
call fcn.140013f08
mov rdx, rbx
mov rcx, rax
call fcn.140027bc8
jmp 0x14001162f
test edi, edi
je 0x140011656
cmp dword [0x14005166c], esi
je 0x140011656
cmp qword [0x140051660], rsi
je 0x140011656
call fcn.140013f08
test rax, rax
je 0x140011656
call fcn.140013f08
mov rcx, rax
cmp dword [rax + 0x70], esi
je 0x140011656
mov rax, qword [rax]
test rax, rax
jne 0x14001164e
call fcn.140029fd0
test rax, rax
je 0x140011656
mov rcx, rax
call fcn.14002720c
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 4
lea r14, str.AcceptedPrivacyStatement
test eax, eax
jne 0x1400116f1
cmp dword [0x140050c44], esi
mov dword [rsp + 0x58], 1
jne 0x1400116d8
test edi, edi
je 0x1400116e6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400116e6
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.14003a3c4
or word [rsp + 0x6c], bx
lea rcx, [rsp + 0x60]
call fcn.140010958
test eax, eax
js 0x1400117cc
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400117cc
cmp dword [0x140050c44], esi
mov dword [rsp + 0x58], 1
jne 0x140011777
test edi, edi
je 0x1400117b3
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140011785
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea r14, [0x14005167c]
test edi, edi
je 0x1400117ba
mov rcx, qword [rsp + 0x50]
lea rdx, str.UsageTracking
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400117ba
lea r14, [0x14005167c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
jmp 0x1400117d3
lea r14, [0x14005167c]
test edi, edi
je 0x14001196d
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140011968
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516a8]
mov dword [rsp + 0x28], ebx
lea rdx, str.MetadataRetrieval
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516c8]
mov dword [rsp + 0x28], 1
lea rdx, str.SendUserGUID
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516b0]
mov dword [rsp + 0x28], ebx
lea rdx, str.SilentAcquisition
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.UsageTracking
mov r9d, ebx
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051674]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUMusic
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516c4]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUPictures
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051690]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUVideo
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051694]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUPlaylists
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140018534
mov rcx, qword [0x140051698]
movzx eax, si
mov word [rsp + 0x70], ax
mov r14d, 0x104
test rcx, rcx
je 0x140011a1c
mov rdx, qword [rcx + 0x50]
mov eax, esi
test rdx, rdx
je 0x14001199c
cmp word [rdx], si
setne al
test al, al
je 0x1400119b8
mov r8d, r14d
lea rdx, [rsp + 0x70]
add rcx, 0x50
call fcn.14003ac1c
mov rcx, qword [0x140051698]
mov rbx, rcx
cmp dword [rcx + 0x28], esi
je 0x1400119d3
mov ecx, dword [rcx + 0x28]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x28], esi
mov rcx, qword [0x140051698]
cmp dword [rbx + 0x2c], esi
je 0x1400119eb
mov ecx, dword [rbx + 0x2c]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x2c], esi
mov rcx, qword [0x140051698]
cmp dword [rbx + 0x30], esi
je 0x140011a03
mov ecx, dword [rbx + 0x30]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x30], esi
mov rcx, qword [0x140051698]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003f118]
movzx eax, word [rsp + 0x70]
mov qword [0x140051698], rsi
test edi, edi
je 0x140011ad9
test ax, ax
je 0x140011abe
mov edx, reloc.ATL.DLL_AtlInternalQueryInterface
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140011abe
mov eax, 0x22
cmp ax, word [rsp + 0x70]
je 0x140011abe
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x70]
mov rbx, rcx
inc rbx
cmp word [rdx + rbx*2], si
jne 0x140011a5a
add rbx, 5
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x140011aac
lea r9, [rsp + 0x70]
mov rdx, rbx
lea r8, str.__s_
mov rcx, rax
call fcn.140001734
mov r8, rdi
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.140001470
jmp 0x140011ab1
mov word [rsp + 0x70], si
test rdi, rdi
je 0x140011abe
mov rcx, rdi
call fcn.14003c2b8
cmp dword [0x1400502f0], esi
je 0x140011ad4
lea rcx, [rsp + 0x70]
call fcn.140010f84
test eax, eax
jne 0x140011ad9
call fcn.14001ae6c
test byte [0x140050c40], 1
je 0x140011af4
mov r8d, 1
lea rdx, [0x140041198]
call fcn.140001be0
lea rcx, [rsp + 0x60]
call fcn.14003a954
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret