Function at 0x1400d55c8
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rbx, r8
mov r13, rdx
mov r15, rcx
xor r12d, r12d
test rcx, rcx
je 0x1400d55fb
cmp word [rcx], r12w
jne 0x1400d5602
lea r15, [0x140178678]
test r9, r9
je 0x1400d560d
cmp word [r9], r12w
jne 0x1400d5614
lea r9, str.cmd__cur_console:n
mov rcx, r9
call fcn.140118f08
mov r14, rax
mov qword [rbp - 0x21], rax
mov ecx, 0x10
call fcn.140116c84
mov byte [rbp + 0x67], al
lea rcx, [rbp - 0x19]
call fcn.140114c40
nop
mov r8, rbx
lea rdx, [rbp - 0x19]
mov rcx, qword [0x14022a9e0]
call fcn.140015b38
mov rsi, rax
mov qword [rbp - 0x29], rax
or rbx, 0xffffffffffffffff
test r13, r13
je 0x1400d5671
mov rcx, rbx
inc rcx
cmp word [r13 + rcx*2], r12w
jne 0x1400d5660
add rcx, 0x23
jmp 0x1400d5676
mov ecx, 0x20
test rax, rax
je 0x1400d568d
mov rdx, rbx
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x1400d567e
inc rdx
jmp 0x1400d5690
mov rdx, r12
mov r8, qword [0x14022a9e0]
mov rax, rbx
inc rax
cmp word [r8 + rax*2 + 0xae0], r12w
jne 0x1400d569a
inc rbx
cmp word [r14 + rbx*2], r12w
jne 0x1400d56a8
add rax, rcx
add rbx, rax
add rbx, rdx
lea rcx, [rbx + rbx]
call fcn.140113e8c
mov rdi, rax
test rax, rax
je 0x1400d5a7e
movzx ecx, word [r14]
sub cx, 0x2d
mov eax, 0xfffd
test ax, cx
je 0x1400d56ea
mov r12b, 1
xor r14d, r14d
jmp 0x1400d5723
lea rcx, [rbp - 9]
call fcn.1401170c0
nop
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.1401188b8
xor r14d, r14d
test rax, rax
je 0x1400d571a
lea rcx, [rbp - 9]
call fcn.1401185a4
test al, al
sete r12b
lea rcx, [rbp - 9]
call fcn.1401170e4
cmp dword [0x14022aa24], 6
ja 0x1400d573d
jne 0x1400d5737
cmp dword [0x14022aa28], r14d
ja 0x1400d573d
mov byte [rbp + 0x5f], r14b
jmp 0x1400d5741
mov byte [rbp + 0x5f], 1
mov r14d, 1
lea r8, [0x140179218]
mov rdx, rbx
mov rcx, rdi
call fcn.14000a8a0
mov r8, qword [0x14022a9e0]
add r8, 0xae0
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
lea r8, [0x140179210]
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
xor eax, eax
test r13, r13
je 0x1400d57e7
cmp word [r13], ax
je 0x1400d57e7
mov rcx, r13
call fcn.140118614
mov sil, al
test al, al
je 0x1400d57b3
lea r8, [0x140179218]
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
mov r8, r13
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
lea r8, [0x14017669c]
test sil, sil
lea rax, [0x140179210]
cmovne r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
mov rsi, qword [rbp - 0x29]
xor eax, eax
test rsi, rsi
je 0x1400d5813
cmp word [rsi], ax
je 0x1400d5813
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
lea r8, [0x14017669c]
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
xor eax, eax
mov rsi, rax
mov ecx, r14d
sub ecx, 1
je 0x1400d587e
sub ecx, 1
je 0x1400d5875
sub ecx, 1
je 0x1400d5861
sub ecx, 1
je 0x1400d5846
sub ecx, 1
je 0x1400d583d
cmp ecx, 1
je 0x1400d5a75
jmp 0x1400d5885
lea rsi, str.SoftwareClassesDrive_shell
jmp 0x1400d584d
lea rsi, str.SoftwareClassesDirectory_shell
lea r8, str._dir___1_
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
jmp 0x1400d5885
xor eax, eax
cmp byte [rbp + 0x5f], al
je 0x1400d5a64
lea rsi, str.SoftwareClassesLibraryFolderBackground_shell
jmp 0x1400d5885
lea rsi, str.SoftwareClassesDirectoryBackground_shell
jmp 0x1400d5885
lea rsi, str.SoftwareClasses_shell
test r12b, r12b
je 0x1400d589c
lea r8, [0x14017a630]
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
mov r8, qword [rbp - 0x21]
mov rdx, rbx
mov rcx, rdi
call fcn.140001e48
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x31]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
test eax, eax
jne 0x1400d5a64
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x41]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400d5a5a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rsi, qword [rbp + 0x7f]
test rsi, rsi
je 0x1400d5990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.Icon
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400d59a1
lea rdx, str.Icon
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x39]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401b6870]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400d5a13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rbp + 0x77], si
lea rdx, str.Extended
mov rcx, qword [rbp - 0x41]
cmp byte [rbp + 0x67], sil
je 0x1400d5a4a
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400d5a50
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
cmp r14d, 6
mov rsi, qword [rbp - 0x29]
jle 0x1400d5747
mov rcx, rdi
call fcn.140113e18
nop
lea rcx, [rbp - 0x19]
call fcn.140114ca4
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret