Function at 0x140112814
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, qword [rax + 0x168]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14006b68f.0]
lea r14, str.shellliblogontaskslogontasks.cpp
test eax, eax
jns 0x14011285c
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xde6
call fcn.14009cb2c
mov rax, qword [rdi]
mov r15, 0xffffffff80000001
cmp byte [rax + 0xdd], 0
je 0x1401128bd
call fcn.14027f7c8
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0x30]
cmp eax, 1
lea edx, [rcx - 0xd]
cmove ecx, edx
lea r9d, [rdx + 1]
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rbp + 0x30], ecx
mov rcx, qword [0x140314a88]
call qword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
nop dword [rax + rax]
or eax, 0x10000000
jge 0x140112a96
mov edx, 0xdf1
jmp 0x14011294e
cmp byte [rax + 0xde], 0
jne 0x140112962
cmp byte [rax + 0xe0], 0
jne 0x1401129ea
cmp byte [rax + 0xe1], 0
jne 0x1401129ea
cmp byte [rax + 0xdf], 0
je 0x140112a96
call fcn.14027f7c8
test eax, eax
je 0x140112a96
call fcn.140121ae0
and dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
lea r8, str.EnableExpeditedUpdateNthAsync
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupOOBENDUP
mov rcx, 0xffffffff80000002
call fcn.14007b130
test eax, eax
js 0x140112a96
cmp dword [rbp + 0x30], 0
je 0x140112a96
call fcn.140121c04
test eax, eax
jns 0x140112a96
mov edx, 0xe2d
mov rcx, qword [rbp + 0x28]
mov r8, r14
mov r9d, eax
call fcn.14009cb2c
jmp 0x140112a96
mov rcx, qword [rax + 0x150]
test rcx, rcx
je 0x14011298b
call fcn.1402ccc8c
test eax, eax
jns 0x14011298b
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdfe
call fcn.14009cb2c
call fcn.140070dec
xor ebx, ebx
mov dword [rbp + 0x38], eax
and dword [rbp + 0x30], ebx
lea r9, [rbp + 0x30]
lea r8, str.PrivacyConsentPresentationVersion
mov rcx, r15
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPrivacy
call fcn.14002c200
test eax, eax
js 0x1401129c2
mov ecx, dword [rbp + 0x30]
lea eax, [rcx - 1]
cmp eax, 2
cmovbe ebx, ecx
mov dword [rbp + 0x30], ebx
call fcn.14027f7c8
mov dword [rbp + 0x40], eax
call fcn.14027f438
lea r9, [rbp + 0x38]
mov dword [rbp + 0x48], eax
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.140276ee8
lea rcx, [0x14038ba18]
call fcn.14012200c
test al, al
je 0x140112a40
mov rax, qword [rdi]
cmp byte [rax + 0xe0], 0
je 0x140112a40
mov rcx, qword [rax + 0x158]
test rcx, rcx
je 0x140112a2f
call fcn.1402ccc8c
test eax, eax
jns 0x140112a2f
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe0e
call fcn.14009cb2c
call fcn.14027f7c8
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], eax
call fcn.140110ae8
lea rcx, [0x14038b9f8]
call fcn.14012208c
test al, al
je 0x140112a96
mov rax, qword [rdi]
cmp byte [rax + 0xe1], 0
je 0x140112a96
mov rcx, qword [rax + 0x160]
test rcx, rcx
je 0x140112a85
call fcn.1402ccc8c
test eax, eax
jns 0x140112a85
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe1e
call fcn.14009cb2c
call fcn.14027f7c8
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], eax
call fcn.1401110b4
lea r8, str.ExplorerStartCount
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUserOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140112acb
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe32
call fcn.140195f4c
lea r8, str.IsExistingUser
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140112b00
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe33
call fcn.140195f4c
lea r8, str.ExitReason
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140112b35
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe34
call fcn.140195f4c
lea r8, str.SubResult
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140112b6a
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xe35
call fcn.140195f4c
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret