Function at 0x180011768
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x130
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1800824d0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rdx
mov rbp, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
cmp rdx, r12
je 0x1800117b1
mov dword [rdx], r12d
mov rdx, rcx
lea rcx, [rsp + 0xc8]
call fcn.18000129c
nop
cmp qword [rax + 0x20], 8
jb 0x1800117cf
mov r9, qword [rax + 8]
jmp 0x1800117d3
lea r9, [rax + 8]
lea r8, str.SoftwareWOW6432Nodeprojonepodlpusbmgr_approveds
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xf8]
call fcn.18002182c
nop
cmp qword [rsp + 0xe8], 8
jb 0x180011807
mov rcx, qword [rsp + 0xd0]
call fcn.180043070
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r12
mov word [rsp + 0xd0], r12w
cmp qword [rsp + 0x110], r12
jne 0x18001184d
cmp qword [rsp + 0x118], 8
jb 0x180011846
mov rcx, qword [rsp + 0x100]
call fcn.180043070
xor eax, eax
jmp 0x180011bfb
and dword [rsp + 0x58], 0xfffffe00
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xa0]
call fcn.180003fdc
nop
mov r14d, 1
mov dword [rsp + 0x20], r14d
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18003b668
nop
lea edi, [r14 + 2]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.18000132c
cmp al, r12b
je 0x1800118f7
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r12b
lea r8d, [r14 + 0x19]
lea rdx, str.endTime:_unique:
lea rcx, [rsp + 0x28]
call fcn.1800026f8
nop
lea edi, [r14 + 6]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.180010afc
cmp al, r12b
je 0x1800118f7
mov sil, r14b
jmp 0x1800118fa
mov sil, r12b
test dil, 4
je 0x180011928
and edi, 0xfffffffb
cmp qword [rsp + 0x48], 0x10
jb 0x180011915
mov rcx, qword [rsp + 0x30]
call fcn.180043070
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r12b
test dil, 2
je 0x180011965
and edi, 0xfffffffd
cmp qword [rsp + 0x98], 0x10
jb 0x180011949
mov rcx, qword [rsp + 0x80]
call fcn.180043070
mov qword [rsp + 0x98], 0xf
mov qword [rsp + 0x90], r12
mov byte [rsp + 0x80], r12b
test r14b, dil
je 0x180011985
and edi, 0xfffffffe
cmp qword [rsp + 0xc0], 0x10
jb 0x180011985
mov rcx, qword [rsp + 0xa8]
call fcn.180043070
cmp sil, r12b
je 0x180011b88
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r12b
mov r8d, 7
lea rdx, str.useOnce
lea rcx, [rsp + 0x28]
call fcn.1800026f8
nop
cmp byte [rsp + 0x58], 7
jne 0x1800119f7
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.18002c660
mov rcx, rax
call fcn.18002c980
cmp al, r12b
je 0x1800119f7
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.18002c660
mov rcx, rax
call fcn.18002b69c
mov esi, eax
jmp 0x1800119fa
mov esi, r12d
cmp qword [rsp + 0x48], 0x10
jb 0x180011a0c
mov rcx, qword [rsp + 0x30]
call fcn.180043070
cmp esi, r12d
je 0x180011a44
cmp rbx, r12
je 0x180011a19
mov dword [rbx], r14d
lea rcx, [rsp + 0x50]
call fcn.18002b33c
nop
cmp qword [rsp + 0x118], 8
jb 0x180011a3c
mov rcx, qword [rsp + 0x100]
call fcn.180043070
mov eax, r14d
jmp 0x180011bfb
lea rdx, str.unique
lea rcx, [rsp + 0x50]
call fcn.18002c6ac
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.18002b4dc
nop
or edi, 8
mov dword [rsp + 0x20], edi
mov rdx, rbp
mov rcx, rax
call fcn.18001bfe0
cmp al, r12b
je 0x180011acf
lea rdx, str.endTime
lea rcx, [rsp + 0x50]
call fcn.18002c6ac
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.18002b4dc
mov rbx, rax
or edi, 0x10
mov dword [rsp + 0x20], edi
mov edx, r14d
lea rcx, [rsp + 0x78]
call fcn.180020334
nop
or edi, 0x20
mov dword [rsp + 0x20], edi
mov rdx, rax
mov rcx, rbx
call fcn.180003918
cmp al, r12b
jne 0x180011acf
mov bl, r14b
jmp 0x180011ad2
mov bl, r12b
test dil, 0x20
je 0x180011b0f
and edi, 0xffffffdf
cmp qword [rsp + 0x98], 0x10
jb 0x180011af3
mov rcx, qword [rsp + 0x80]
call fcn.180043070
mov qword [rsp + 0x98], 0xf
mov qword [rsp + 0x90], r12
mov byte [rsp + 0x80], r12b
test dil, 0x10
je 0x180011b3d
and edi, 0xffffffef
cmp qword [rsp + 0x48], 0x10
jb 0x180011b2a
mov rcx, qword [rsp + 0x30]
call fcn.180043070
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r12b
test dil, 8
je 0x180011b5b
cmp qword [rsp + 0xc0], 0x10
jb 0x180011b5b
mov rcx, qword [rsp + 0xa8]
call fcn.180043070
cmp bl, r12b
je 0x180011b88
lea rcx, [rsp + 0x50]
call fcn.18002b33c
nop
cmp qword [rsp + 0x118], 8
jb 0x180011b83
mov rcx, qword [rsp + 0x100]
call fcn.180043070
mov eax, r14d
jmp 0x180011bfb
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.18000129c
cmp qword [rax + 0x20], 8
jb 0x180011ba5
mov r8, qword [rax + 8]
jmp 0x180011ba9
lea r8, [rax + 8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpusbmgr_approveds
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp qword [rsp + 0xc0], 8
jb 0x180011bd6
mov rcx, qword [rsp + 0xa8]
call fcn.180043070
nop
lea rcx, [rsp + 0x50]
call fcn.18002b33c
nop
cmp qword [rsp + 0x118], 8
jb 0x180011bf9
mov rcx, qword [rsp + 0x100]
call fcn.180043070
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180042bb0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret