Function at 0x140011578
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor esi, esi
mov edi, ecx
cmp dword [0x140051668], esi
mov qword [rsp + 0x50], rsi
je 0x140011634
call fcn.14001090c
call fcn.140010ed0
cmp dword [0x14005166c], esi
je 0x14001167a
cmp qword [0x140051660], rsi
je 0x14001167a
call fcn.140013f3c
test rax, rax
je 0x14001167a
call fcn.140013f3c
mov rcx, rax
xor edx, edx
call fcn.14002a174
test rax, rax
je 0x140011612
call fcn.140013f3c
mov rcx, rax
xor edx, edx
call fcn.14002a174
jmp 0x14001161f
call fcn.140013f3c
mov rcx, rax
call fcn.14002a0c0
mov rbx, rax
call fcn.140013f3c
mov rdx, rbx
mov rcx, rax
call fcn.140027c2c
jmp 0x140011653
test edi, edi
je 0x14001167a
cmp dword [0x14005166c], esi
je 0x14001167a
cmp qword [0x140051660], rsi
je 0x14001167a
call fcn.140013f3c
test rax, rax
je 0x14001167a
call fcn.140013f3c
mov rcx, rax
cmp dword [rax + 0x70], esi
je 0x14001167a
mov rax, qword [rax]
test rax, rax
jne 0x140011672
call fcn.14002a0c0
test rax, rax
je 0x14001167a
mov rcx, rax
call fcn.14002726c
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 4
lea r14, str.AcceptedPrivacyStatement
test eax, eax
jne 0x140011715
cmp dword [0x140050c44], esi
mov dword [rsp + 0x58], 1
jne 0x1400116fc
test edi, edi
je 0x14001170a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001170a
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.14003a4e4
or word [rsp + 0x6c], bx
lea rcx, [rsp + 0x60]
call fcn.140010978
test eax, eax
js 0x1400117f0
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400117f0
cmp dword [0x140050c44], esi
mov dword [rsp + 0x58], 1
jne 0x14001179b
test edi, edi
je 0x1400117d7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400117a9
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea r14, [0x14005167c]
test edi, edi
je 0x1400117de
mov rcx, qword [rsp + 0x50]
lea rdx, str.UsageTracking
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400117de
lea r14, [0x14005167c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
jmp 0x1400117f7
lea r14, [0x14005167c]
test edi, edi
je 0x140011991
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001198c
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516a8]
mov dword [rsp + 0x28], ebx
lea rdx, str.MetadataRetrieval
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516c8]
mov dword [rsp + 0x28], 1
lea rdx, str.SendUserGUID
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516b0]
mov dword [rsp + 0x28], ebx
lea rdx, str.SilentAcquisition
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.UsageTracking
mov r9d, ebx
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051674]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUMusic
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x1400516c4]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUPictures
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051690]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUVideo
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140051694]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisableMRUPlaylists
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14001857c
mov rcx, qword [0x140051698]
movzx eax, si
mov word [rsp + 0x70], ax
mov r14d, 0x104
test rcx, rcx
je 0x140011a45
mov word [rsp + 0x70], si
mov eax, esi
mov rdx, qword [rcx + 0x50]
test rdx, rdx
je 0x1400119c5
cmp word [rdx], si
setne al
test al, al
je 0x1400119e1
mov r8d, r14d
lea rdx, [rsp + 0x70]
add rcx, 0x50
call fcn.14003ad3c
mov rcx, qword [0x140051698]
mov rbx, rcx
cmp dword [rcx + 0x28], esi
je 0x1400119fc
mov ecx, dword [rcx + 0x28]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x28], esi
mov rcx, qword [0x140051698]
cmp dword [rbx + 0x2c], esi
je 0x140011a14
mov ecx, dword [rbx + 0x2c]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x2c], esi
mov rcx, qword [0x140051698]
cmp dword [rbx + 0x30], esi
je 0x140011a2c
mov ecx, dword [rbx + 0x30]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rbx + 0x30], esi
mov rcx, qword [0x140051698]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003f118]
movzx eax, word [rsp + 0x70]
mov qword [0x140051698], rsi
test edi, edi
je 0x140011b02
test ax, ax
je 0x140011ae7
mov edx, reloc.ATL.DLL_AtlInternalQueryInterface
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140011ae7
mov eax, 0x22
cmp ax, word [rsp + 0x70]
je 0x140011ae7
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x70]
mov rbx, rcx
inc rbx
cmp word [rdx + rbx*2], si
jne 0x140011a83
add rbx, 5
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x140011ad5
lea r9, [rsp + 0x70]
mov rdx, rbx
lea r8, str.__s_
mov rcx, rax
call fcn.140001734
mov r8, rdi
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.140001470
jmp 0x140011ada
mov word [rsp + 0x70], si
test rdi, rdi
je 0x140011ae7
mov rcx, rdi
call fcn.14003c408
cmp dword [0x1400502f0], esi
je 0x140011afd
lea rcx, [rsp + 0x70]
call fcn.140010fa8
test eax, eax
jne 0x140011b02
call fcn.14001aec0
test byte [0x140050c40], 1
je 0x140011b1d
mov r8d, 1
lea rdx, [0x140041198]
call fcn.140001be0
lea rcx, [rsp + 0x60]
call fcn.14003aa74
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret