Function at 0x1400631d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, qword [rcx + 0x348]
xor r12d, r12d
mov r15, rdx
mov r14, rcx
mov ebp, r12d
test rsi, rsi
jne 0x140063202
mov rsi, qword [rcx + 0x48]
mov rbx, qword [0x140126ab0]
or rdi, 0xffffffffffffffff
test rbx, rbx
je 0x1400632ca
cmp qword [r14 + 0x348], rbp
je 0x140063237
mov rcx, qword [rbx + 0x348]
test rcx, rcx
je 0x140063237
mov rdx, rsi
call fcn.1400a9bbc
test eax, eax
je 0x14006324c
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400632ba
mov rdx, rsi
call fcn.1400a9bbc
test eax, eax
jne 0x1400632ba
mov rcx, qword [rbx + 0x350]
call fcn.1400a82b0
cmp word [r15], bp
je 0x14006326f
mov rcx, r15
call fcn.1400a8238
mov qword [rbx + 0x350], rax
jmp 0x140063276
mov qword [rbx + 0x350], r12
mov rcx, qword [0x14012bbd8]
lea r9, [rsp + 0x30]
mov r8, rdi
mov edx, 0x1053
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x1400632ba
mov rcx, qword [0x14012bbd0]
movsxd r8, eax
mov r9, rdi
mov edx, 0x7eb
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rbx + 0x698]
test rbx, rbx
jne 0x140063216
mov rcx, qword [0x14012b690]
test rcx, rcx
je 0x140063349
cmp qword [rcx], rbp
je 0x140063337
mov rbx, r12
mov rax, r12
mov rcx, qword [rax + rcx]
mov rdx, rsi
call fcn.1400a9bbc
mov rcx, qword [0x14012b690]
test eax, eax
je 0x14006330c
inc rbx
inc ebp
mov rax, rbx
shl rax, 4
cmp qword [rax + rcx], r12
jne 0x1400632e1
jmp 0x140063337
movsxd rbx, ebp
add rbx, rbx
mov rcx, qword [rcx + rbx*8 + 8]
call fcn.1400a82b0
mov rcx, r15
call fcn.1400a8238
mov rcx, qword [0x14012b690]
mov qword [rcx + rbx*8 + 8], rax
mov rcx, qword [0x14012b690]
test rcx, rcx
je 0x140063349
movsxd r14, ebp
shl r14, 4
cmp qword [r14 + rcx], r12
jne 0x1400633a2
lea eax, [rbp + 2]
movsxd rdx, eax
shl rdx, 4
call fcn.1400a83a8
movsxd rbx, ebp
mov rcx, rsi
mov r14, rbx
mov qword [0x14012b690], rax
shl r14, 4
call fcn.1400a8238
mov rcx, qword [0x14012b690]
mov qword [r14 + rcx], rax
mov rcx, r15
call fcn.1400a8238
mov rcx, qword [0x14012b690]
mov qword [r14 + rcx + 8], rax
mov rax, qword [0x14012b690]
lea rcx, [rbx + 1]
add rcx, rcx
mov qword [rax + rcx*8], r12
lea r8, [rsp + 0x90]
lea rdx, str.SoftwareSysinternalsProcess_ExplorerProcessComments
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140063435
mov rdx, qword [0x14012b690]
mov rcx, qword [rdx + r14 + 8]
cmp word [rcx], r12w
jne 0x1400633f0
mov rdx, qword [rdx + r14]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140063427
cmp word [rcx + rdi*2 + 2], r12w
lea rdi, [rdi + 1]
jne 0x1400633f0
mov rdx, qword [rdx + r14]
lea eax, [rdi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret