Function at 0x140110b5c
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, qword [rax + 0x160]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14006c37f.0]
lea r14, str.shellliblogontaskslogontasks.cpp
test eax, eax
jns 0x140110ba4
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdb5
call fcn.14009d7ec
mov rax, qword [rdi]
mov r15, 0xffffffff80000001
cmp byte [rax + 0xdd], 0
je 0x140110c05
call fcn.140272e48
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0x30]
cmp eax, 1
lea edx, [rcx - 0xd]
cmove ecx, edx
lea r9d, [rdx + 1]
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rbp + 0x30], ecx
mov rcx, qword [0x140307988]
call qword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
nop dword [rax + rax]
or eax, 0x10000000
jge 0x140110d7b
mov edx, 0xdc0
jmp 0x140110c89
cmp byte [rax + 0xde], 0
jne 0x140110c9d
cmp byte [rax + 0xe0], 0
jne 0x140110d25
cmp byte [rax + 0xdf], 0
je 0x140110d7b
call fcn.140272e48
test eax, eax
je 0x140110d7b
call fcn.14011fc10
and dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
lea r8, str.EnableExpeditedUpdateNthAsync
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupOOBENDUP
mov rcx, 0xffffffff80000002
call fcn.14007bd70
test eax, eax
js 0x140110d7b
cmp dword [rbp + 0x30], 0
je 0x140110d7b
call fcn.14011fd34
test eax, eax
jns 0x140110d7b
mov edx, 0xdec
mov rcx, qword [rbp + 0x28]
mov r8, r14
mov r9d, eax
call fcn.14009d7ec
jmp 0x140110d7b
mov rcx, qword [rax + 0x150]
test rcx, rcx
je 0x140110cc6
call fcn.1402c02fc
test eax, eax
jns 0x140110cc6
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdcd
call fcn.14009d7ec
call fcn.140071adc
xor ebx, ebx
mov dword [rbp + 0x38], eax
and dword [rbp + 0x30], ebx
lea r9, [rbp + 0x30]
lea r8, str.PrivacyConsentPresentationVersion
mov rcx, r15
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPrivacy
call fcn.14002cdc0
test eax, eax
js 0x140110cfd
mov ecx, dword [rbp + 0x30]
lea eax, [rcx - 1]
cmp eax, 2
cmovbe ebx, ecx
mov dword [rbp + 0x30], ebx
call fcn.140272e48
mov dword [rbp + 0x40], eax
call fcn.1402729f8
lea r9, [rbp + 0x38]
mov dword [rbp + 0x48], eax
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.14026a4d8
lea rcx, [0x14037d930]
call fcn.1401200fc
test al, al
je 0x140110d7b
mov rax, qword [rdi]
cmp byte [rax + 0xe0], 0
je 0x140110d7b
mov rcx, qword [rax + 0x158]
test rcx, rcx
je 0x140110d6a
call fcn.1402c02fc
test eax, eax
jns 0x140110d6a
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xddd
call fcn.14009d7ec
call fcn.140272e48
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], eax
call fcn.14010f788
lea r8, str.ExplorerStartCount
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUserOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140110db0
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdf1
call fcn.140188f6c
lea r8, str.IsExistingUser
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOOBE
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140110de5
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdf2
call fcn.140188f6c
lea r8, str.ExitReason
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140110e1a
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdf3
call fcn.140188f6c
lea r8, str.SubResult
mov rcx, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140110e4f
mov rcx, qword [rbp + 0x28]
mov r9d, eax
mov r8, r14
mov edx, 0xdf4
call fcn.140188f6c
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret