Function at 0x1400a4fc0
Capabilities:
Create thread
Delete registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rsi, rcx
mov edx, 0xcc
mov rcx, qword [0x140376780]
call qword [sym.imp.USER32.dll_LoadMenuW]
mov rdi, rax
mov qword [rsp + 0xa8], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rbx, rax
mov qword [rsp + 0x98], rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x1400a52ea
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x1400a52ea
call fcn.1400c1f80
cmp dword [rax + 0x78], 6
jl 0x1400a5062
call fcn.1400c1f80
lea rcx, str.Displaying_debugging_menu...
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x750
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
lea r8, str.TrayWnd::ShowDebuggingMenu
mov edx, 6
mov rcx, rax
call fcn.1400c23b0
call fcn.1400cf380
movzx ebp, al
call fcn.1400c1f80
cmp dword [rax + 0x78], 6
jl 0x1400a50c3
call fcn.1400c1f80
lea rdx, [0x140274878]
lea rcx, [0x140274870]
test bpl, bpl
cmovne rcx, rdx
mov qword [rsp + 0x30], rcx
lea rcx, str.Logging_enabled:__s.
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x755
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
lea r8, str.TrayWnd::ShowDebuggingMenu
mov edx, 6
mov rcx, rax
call fcn.1400c23b0
mov rcx, rbx
test bpl, bpl
je 0x1400a50fb
mov edx, 0x9c57
mov r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x1400a5109
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400a5109
mov edx, 0x9c58
jmp 0x1400a510e
xor r8d, r8d
mov edx, 0x9c58
call qword [sym.imp.USER32.dll_RemoveMenu]
mov edx, 0x9c59
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.USER32.dll_RemoveMenu]
mov rcx, qword [rsi + 0x538]
xor r14d, r14d
test rcx, rcx
je 0x1400a5139
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
lea r8d, [r14 + 1]
jne 0x1400a513c
mov r8d, r14d
mov edx, 0x9c57
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov qword [rsp + 0xa0], r14
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
or ebx, 0x120
mov qword [rsp + 0x28], r14
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa4]
mov r8d, dword [rsp + 0xa0]
mov edx, ebx
lea rcx, [rsp + 0x98]
call fcn.1400a7130
sub eax, 0x9c57
je 0x1400a5210
sub eax, 1
je 0x1400a51cc
cmp eax, 1
jne 0x1400a533f
mov rcx, rsi
call fcn.1400a92e0
jmp 0x1400a533f
mov rcx, rsi
call fcn.1400a92e0
mov rcx, qword [rsi + 0x540]
test rcx, rcx
je 0x1400a51e6
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rsi
lea r8, [0x1400a2650]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x538], rax
jmp 0x1400a533f
call fcn.1400c1f80
cmp dword [rax + 0x78], 6
jl 0x1400a5269
call fcn.1400c1f80
lea r8, str.Disabling
lea rcx, str.Enabling
test bpl, bpl
cmovne rcx, r8
mov qword [rsp + 0x30], rcx
lea rcx, str._s_logging_from_system_tray_debugging_menu
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x77e
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
lea r8, str.TrayWnd::ShowDebuggingMenu
mov edx, 6
mov rcx, rax
call fcn.1400c23b0
test bpl, bpl
sete cl
xor edx, edx
call fcn.1400cfbc0
lea rcx, [rsp + 0x40]
call fcn.1400a0860
test bpl, bpl
jne 0x1400a52c6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LoggingEnabledTime
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400a52d8
lea rdx, str.LoggingEnabledTime
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a533f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400a533f
call fcn.1400c1f80
cmp dword [rax + 0x78], 3
jl 0x1400a533f
call fcn.1400c1f80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0xcc
lea rax, str.Unable_to_load_menu__d__Error:__d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x74c
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
lea r8, str.TrayWnd::ShowDebuggingMenu
mov edx, 3
mov rcx, rbx
call fcn.1400c23b0
nop
test rdi, rdi
je 0x1400a534d
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyMenu]
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret