Function at 0x1400dfec0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rbx, r8
mov r13, rdx
mov r14, rcx
xor r12d, r12d
test rcx, rcx
je 0x1400dfef3
cmp word [rcx], r12w
jne 0x1400dfefa
lea r14, [0x14016a968]
test r9, r9
je 0x1400dff05
cmp word [r9], r12w
jne 0x1400dff0c
lea r9, str.cmd__cur_console:n
mov rcx, r9
call fcn.140125c74
mov r15, rax
mov qword [rbp - 0x29], rax
mov ecx, 0x10
call fcn.1401239d4
mov byte [rbp + 0x67], al
lea rcx, [rbp - 0x19]
call fcn.140120d54
nop
mov r8, rbx
lea rdx, [rbp - 0x19]
mov rcx, qword [0x14021c5d8]
call fcn.140017028
mov rsi, rax
mov qword [rbp - 0x31], rax
or rbx, 0xffffffffffffffff
test r13, r13
je 0x1400dff69
mov rcx, rbx
inc rcx
cmp word [r13 + rcx*2], r12w
jne 0x1400dff58
add rcx, 0x23
jmp 0x1400dff6e
mov ecx, 0x20
test rax, rax
je 0x1400dff85
mov rdx, rbx
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x1400dff76
inc rdx
jmp 0x1400dff88
mov rdx, r12
mov r8, qword [0x14021c5d8]
mov rax, rbx
inc rax
cmp word [r8 + rax*2 + 0xaf0], r12w
jne 0x1400dff92
inc rbx
cmp word [r15 + rbx*2], r12w
jne 0x1400dffa0
add rax, rcx
add rbx, rax
add rbx, rdx
lea rcx, [rbx + rbx]
call fcn.140120104
mov rdi, rax
test rax, rax
je 0x1400e035b
movzx ecx, word [r15]
sub cx, 0x2d
mov eax, 0xfffd
test ax, cx
je 0x1400dffdf
mov r12b, 1
jmp 0x1400e0015
lea rcx, [rbp - 9]
call fcn.1401286a8
nop
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.14012571c
test rax, rax
je 0x1400e000c
lea rcx, [rbp - 9]
call fcn.1401287f0
test al, al
sete r12b
lea rcx, [rbp - 9]
call fcn.1401286cc
call fcn.140123174
mov byte [rbp + 0x5f], al
mov r15d, 1
lea r8, [0x14016b508]
mov rdx, rbx
mov rcx, rdi
call fcn.14000ab94
mov r8, qword [0x14021c5d8]
add r8, 0xaf0
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
lea r8, [0x14016b500]
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
xor eax, eax
test r13, r13
je 0x1400e00c3
cmp word [r13], ax
je 0x1400e00c3
mov rcx, r13
call fcn.140125450
mov sil, al
test al, al
je 0x1400e008f
lea r8, [0x14016b508]
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
mov r8, r13
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
lea r8, [0x140168a9c]
test sil, sil
lea rax, [0x14016b500]
cmovne r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
mov rsi, qword [rbp - 0x31]
xor eax, eax
test rsi, rsi
je 0x1400e00ef
cmp word [rsi], ax
je 0x1400e00ef
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
lea r8, [0x140168a9c]
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
xor eax, eax
mov rsi, rax
mov ecx, r15d
sub ecx, 1
je 0x1400e015a
sub ecx, 1
je 0x1400e0151
sub ecx, 1
je 0x1400e013d
sub ecx, 1
je 0x1400e0122
sub ecx, 1
je 0x1400e0119
cmp ecx, 1
je 0x1400e0352
jmp 0x1400e0161
lea rsi, str.SoftwareClassesDrive_shell
jmp 0x1400e0129
lea rsi, str.SoftwareClassesDirectory_shell
lea r8, str._dir___1_
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
jmp 0x1400e0161
xor eax, eax
cmp byte [rbp + 0x5f], al
je 0x1400e0341
lea rsi, str.SoftwareClassesLibraryFolderBackground_shell
jmp 0x1400e0161
lea rsi, str.SoftwareClassesDirectoryBackground_shell
jmp 0x1400e0161
lea rsi, str.SoftwareClasses_shell
test r12b, r12b
je 0x1400e0178
lea r8, [0x14016c980]
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
mov r8, qword [rbp - 0x29]
mov rdx, rbx
mov rcx, rdi
call fcn.140001f38
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
test eax, eax
jne 0x1400e0341
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e0337
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rsi, qword [rbp + 0x7f]
test rsi, rsi
je 0x1400e026c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.Icon
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400e027d
lea rdx, str.Icon
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x41]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401a8fa0]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e02ef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [rbp - 0x21], eax
lea rdx, str.Extended
mov rcx, qword [rbp + 0x77]
cmp byte [rbp + 0x67], sil
je 0x1400e0327
mov dword [rsp + 0x28], 2
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400e032d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
cmp r15d, 6
mov rsi, qword [rbp - 0x31]
jle 0x1400e0023
mov rcx, rdi
call fcn.14012008c
nop
lea rcx, [rbp - 0x19]
call fcn.140120ddc
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret