Function at 0x180017370
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x180071060]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r12, rcx
lea r8, str.SoftwareWOW6432Nodeprojonepodlppoprotect_regbanlogs_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.180013c40
nop
mov rdx, qword [rsp + 0x78]
lea rcx, str.log_size:_d
call fcn.180035bd8
lea r11, vtable.CRegBanNotifyParser.0
mov qword [rsp + 0x30], r11
mov qword [rsp + 0xe0], 7
xor r13d, r13d
mov qword [rsp + 0xd8], r13
mov word [rsp + 0xc8], r13w
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], r13
mov word [rsp + 0xf0], r13w
cmp qword [rsp + 0x78], r13
je 0x1800178f5
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
or r14, 0xffffffffffffffff
movabs r15, 0x7ffffffffffffffe
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
nop word [rax + rax]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rax]
test rbp, rbp
je 0x180017484
cmp rbp, qword [rsp + 0x40]
je 0x180017489
call fcn.18003ce6c
cmp rdi, rbx
je 0x1800178f5
lea rcx, [rsp + 0x20]
call fcn.180018000
mov rbx, rax
mov rsi, qword [rax + 0x18]
cmp rsi, 0xffffffffffffffff
cmova rsi, r14
lea rax, [rsp + 0xc0]
cmp rax, rbx
jne 0x1800174ea
mov r8, r14
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.180007060
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.180007060
mov r11, qword [rsp + 0xe0]
jmp 0x1800175bd
cmp rsi, r15
jbe 0x1800174f4
call fcn.18003c5a8
mov r11, qword [rsp + 0xe0]
cmp r11, rsi
jae 0x180017523
mov r8, qword [rsp + 0xd8]
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.180008090
mov r11, qword [rsp + 0xe0]
jmp 0x180017553
test rsi, rsi
jne 0x180017553
mov qword [rsp + 0xd8], r13
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, qword [rsp + 0xc8]
mov word [rax], r13w
mov r11, qword [rsp + 0xe0]
jmp 0x1800175bd
test rsi, rsi
je 0x1800175bd
cmp qword [rbx + 0x20], 8
jb 0x180017565
mov r8, qword [rbx + 8]
jmp 0x180017569
lea r8, [rbx + 8]
lea rcx, [rsp + 0xc8]
cmp r11, 8
cmovae rcx, qword [rsp + 0xc8]
lea rbx, [rsi + rsi]
lea rdx, [r11 + r11]
mov r9, rbx
call fcn.18003cecc
mov qword [rsp + 0xd8], rsi
lea rax, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rax, qword [rsp + 0xc8]
mov word [rax + rbx], r13w
mov r11, qword [rsp + 0xe0]
lea r9, [rsp + 0xc8]
cmp r11, 8
cmovae r9, qword [rsp + 0xc8]
lea r8, str.SoftwareWOW6432Nodeprojonepodlppoprotect_regbanlogs_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x80]
call fcn.1800337bc
mov rbx, rax
mov rsi, qword [rax + 0x18]
cmp rsi, 0xffffffffffffffff
cmova rsi, r14
lea rax, [rsp + 0xe8]
cmp rax, rbx
jne 0x180017633
mov r8, r14
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.180007060
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xe8]
call fcn.180007060
jmp 0x1800176f5
cmp rsi, r15
jbe 0x18001763d
call fcn.18003c5a8
mov rdx, qword [rsp + 0x108]
cmp rdx, rsi
jae 0x18001766c
mov r8, qword [rsp + 0x100]
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.180008090
mov rdx, qword [rsp + 0x108]
jmp 0x180017694
test rsi, rsi
jne 0x180017694
mov qword [rsp + 0x100], r13
lea rax, [rsp + 0xf0]
cmp rdx, 8
cmovae rax, qword [rsp + 0xf0]
mov word [rax], r13w
jmp 0x1800176f5
test rsi, rsi
je 0x1800176f5
cmp qword [rbx + 0x20], 8
jb 0x1800176a6
mov r8, qword [rbx + 8]
jmp 0x1800176aa
lea r8, [rbx + 8]
lea rcx, [rsp + 0xf0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xf0]
lea rbx, [rsi + rsi]
add rdx, rdx
mov r9, rbx
call fcn.18003cecc
mov qword [rsp + 0x100], rsi
lea rax, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rax, qword [rsp + 0xf0]
mov word [rax + rbx], r13w
cmp qword [rsp + 0xa0], 8
jb 0x18001770d
mov rcx, qword [rsp + 0x88]
call fcn.18003cec4
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], r13
mov word [rsp + 0x118], r13w
mov qword [rsp + 0x160], 7
mov qword [rsp + 0x158], r13
mov word [rsp + 0x148], r13w
mov qword [rsp + 0x188], 7
mov qword [rsp + 0x180], r13
mov word [rsp + 0x170], r13w
mov qword [rsp + 0x1b0], 7
mov qword [rsp + 0x1a8], r13
mov word [rsp + 0x198], r13w
mov qword [rsp + 0x1d8], 7
mov qword [rsp + 0x1d0], r13
mov word [rsp + 0x1c0], r13w
mov qword [rsp + 0x200], 7
mov qword [rsp + 0x1f8], r13
mov word [rsp + 0x1e8], r13w
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.180015b10
test eax, eax
je 0x180017840
lea rcx, str.Parser_Success_
call fcn.180035bd8
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.180016b30
nop
mov rdx, rax
mov rcx, r12
call fcn.180017240
nop
cmp qword [rsp + 0xa0], 8
jb 0x18001782c
mov rcx, qword [rsp + 0x88]
call fcn.18003cec4
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.1800162e0
jmp 0x18001784d
lea rcx, str.Parser_Err_
call fcn.180035bd8
nop
lea rcx, [rsp + 0x110]
call fcn.180017080
test rbp, rbp
jne 0x180017864
call fcn.18003ce6c
cmp byte [rdi + 0x41], 0
je 0x180017887
mov rdi, qword [rdi + 0x10]
mov qword [rsp + 0x28], rdi
cmp byte [rdi + 0x41], 0
je 0x180017470
call fcn.18003ce6c
jmp 0x180017470
mov rax, qword [rdi]
cmp byte [rax + 0x41], 0
jne 0x1800178b7
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x41], 0
jne 0x1800178ad
nop dword [rax]
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x41], 0
je 0x1800178a0
mov qword [rsp + 0x28], rdi
jmp 0x180017470
mov rax, qword [rdi + 8]
cmp byte [rax + 0x41], 0
jne 0x1800178d8
cmp rdi, qword [rax]
jne 0x1800178d8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], 0
je 0x1800178c1
cmp byte [rdi + 0x41], 0
je 0x1800178e8
call fcn.18003ce6c
jmp 0x180017470
mov rdi, rax
mov qword [rsp + 0x28], rax
jmp 0x180017470
lea rdx, str.SoftwareWOW6432Nodeprojonepodlppoprotect_regbanlogs_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
cmp qword [rsp + 0x108], 8
jb 0x180017922
mov rcx, qword [rsp + 0xf0]
call fcn.18003cec4
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], r13
mov word [rsp + 0xf0], r13w
cmp qword [rsp + 0xe0], 8
jb 0x180017957
mov rcx, qword [rsp + 0xc8]
call fcn.18003cec4
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], r13
mov word [rsp + 0xc8], r13w
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.1800180d0
mov rcx, qword [rsp + 0x70]
call fcn.18003cec4
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x40]
call fcn.18003cec4
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.18003c6c0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret