Function at 0x1401f97f8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov r14, r8
mov rbx, rdx
xor r15d, r15d
mov qword [rbp - 9], r15
xor edx, edx
lea rcx, [rbp - 9]
call fcn.14006e14c
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 3]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401f99f8
mov dword [rbp - 1], r15d
mov dword [rbp + 0x67], r15d
mov dword [rbp + 0x7f], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x1401f98d3
mov r9d, eax
lea r8, str.pcshell_shellexplorer_appsaver.cpp
lea edx, [r15 + 0x2e]
call fcn.1401fc340
int3
cmp dword [rbp - 1], r15d
jbe 0x1401f99f8
mov eax, dword [rbp + 0x67]
inc eax
mov dword [rbp + 0x67], eax
mov edx, eax
lea rcx, [rbp + 0x17]
call fcn.1401f8bdc
nop
mov eax, dword [rbp + 0x7f]
inc eax
mov dword [rbp + 0x7f], eax
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401f8bdc
nop
mov esi, r15d
mov rbx, qword [rbp + 0x17]
mov rdi, qword [rbp + 0x1f]
mov eax, dword [rbp + 0x67]
mov dword [rbp + 0xb], eax
mov dword [rbp + 3], r15d
mov eax, dword [rbp + 0x7f]
mov dword [rbp + 7], eax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp + 3]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xb]
mov r8, rbx
mov edx, esi
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401f99a8
mov eax, dword [rbp + 3]
mov dword [rbp + 0xf], eax
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rbx
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1401f99bd
mov rax, qword [rcx]
lea r9, [rbp + 0x27]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x10]
call qword [case.0x14006b68f.0]
test al, al
je 0x1401f99b6
mov rdx, rbx
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401f99b6
dec esi
jmp 0x1401f99b6
cmp eax, 0x103
je 0x1401f99dc
cmp eax, 0xea
jne 0x1401f99ca
inc esi
jmp 0x1401f9910
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xbad_function_call_void_]
nop dword [rax + rax]
int3
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
mov edx, 0x46
call fcn.1401fc0f4
nop
test rdi, rdi
je 0x1401f99ea
mov rcx, rdi
call fcn.14006d674
nop
test rbx, rbx
je 0x1401f99f8
mov rcx, rbx
call fcn.14006d674
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1401f9a0e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1401f9a2e
mov rax, qword [rcx]
cmp rcx, r14
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14006b68f.0]
mov qword [r14 + 0x38], r15
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret