Function at 0x1800054b0
Capabilities:
Delete registry key
Open recentdocs registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1800e6040]
xor rax, rsp
mov qword [rbp - 8], rax
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsShell
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005507
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePid
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005547
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005587
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800055c7
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionAppCompatFlagsPenService
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005607
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionAppCompatFlagsCaretTracking
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005647
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCustom
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005687
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800056c7
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005707
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftCurrentVersionExplorerFeatureUsageAppSwitched
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005747
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x10]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftCurrentVersionExplorerComD1g32LastVisitedPidlMRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180005787
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Chaves_do_Registro_exclu
call fcn.18000d410
lea rdx, [0x18000d5f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800adcc0
add rsp, 0x40
pop rbp
ret