Function at 0x140044e6f
Capabilities:
Delete registry value

Disassembly:
jmp 0x140081200
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140117040]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140126122]
call fcn.140045ec3
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
lea rcx, [rbp + 0x28]
call fcn.140044a41
nop
mov rdx, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x168]
call fcn.1400460e4
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x68]
call fcn.140045996
nop
lea rcx, [rbp + 0x168]
call fcn.1400445f5
nop
lea rcx, [rbp + 0x28]
call fcn.140044a64
lea rcx, [rbp + 8]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140081392
lea rcx, [rbp + 0x68]
call fcn.140044a64
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x140081347
lea rdx, str.Deleted_FeatureUsage_entry_for:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400443a2
mov rdx, qword [rbp + 0x1d0]
mov rcx, rax
call fcn.140045b76
mov qword [rbp + 0x198], rax
lea rdx, [0x140044127]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140081385
lea rdx, str.Failed_to_delete_FeatureUsage_entry_for:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443a2
mov rdx, qword [rbp + 0x1d0]
mov rcx, rax
call fcn.140045b76
mov qword [rbp + 0x198], rax
lea rdx, [0x140044127]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1400813c1
lea rdx, str.Failed_to_open_FeatureUsage_registry_key.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443a2
mov qword [rbp + 0x198], rax
lea rdx, [0x140044127]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x68]
call fcn.140045a81
nop
lea rcx, [rbp + 0x28]
call fcn.140045a81
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1400d7110]
call fcn.1400459af
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.140044ef1
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret