Function at 0x1800209c4
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x170
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, rdx
movsxd rsi, ecx
xor r13d, r13d
mov ebx, r13d
mov dword [rsp + 0x30], ebx
lea ebp, [r13 + 7]
lea r15d, [r13 + 0xf]
cmp esi, r13d
je 0x180020d3b
and dword [rsp + 0x90], 0xfffffe00
mov qword [r11 - 0x100], r13
mov qword [r11 - 0xf8], r13
mov qword [r11 - 0xf0], r13
lea rax, [r11 - 0xe0]
mov qword [r11 - 0xe8], rax
lea edx, [rbp - 6]
lea rcx, [rsp + 0x60]
call fcn.180036600
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180027d28
mov rdi, rax
lea rdx, str.time
lea rcx, [rsp + 0x88]
call fcn.180029294
mov rcx, rax
mov rdx, rdi
call fcn.180027fb4
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180020aa1
mov rcx, qword [rsp + 0x68]
call fcn.180042a14
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xb0], rax
cmp r12, r13
je 0x180020b19
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0xb8]
call fcn.1800030e4
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call fcn.1800012e4
nop
mov ebx, 3
mov dword [rsp + 0x30], ebx
jmp 0x180020b4a
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], r13b
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0x38]
call fcn.180002e60
lea rax, [rsp + 0x38]
mov ebx, 4
mov dword [rsp + 0x30], ebx
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.180027d28
mov rdi, rax
lea rdx, str.reason
lea rcx, [rsp + 0x88]
call fcn.180029294
mov rcx, rax
mov rdx, rdi
call fcn.180027fb4
nop
test bl, 4
je 0x180020baa
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0x58], 0x10
jb 0x180020b9b
mov rcx, qword [rsp + 0x40]
call fcn.180042a14
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], r13b
test bl, 2
je 0x180020bdd
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0x80], 0x10
jb 0x180020bcb
mov rcx, qword [rsp + 0x68]
call fcn.180042a14
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
test bl, 1
je 0x180020c01
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0xd8], 8
jb 0x180020c01
mov rcx, qword [rsp + 0xc0]
call fcn.180042a14
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x40], 1
btr dword [rsp + 0x40], 8
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x38], rsi
lea rdx, str.flags
lea rcx, [rsp + 0x88]
call fcn.180029294
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.180027fb4
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call fcn.180029850
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18003d1f8
nop
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.18000125c
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180020c98
mov rcx, qword [rsp + 0x68]
call fcn.180042a14
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
cmp qword [rsp + 0xd8], 0x10
jb 0x180020cc2
mov rcx, qword [rsp + 0xc0]
call fcn.180042a14
lea r9, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae r9, qword [rsp + 0x140]
mov dword [rsp + 0x20], r13d
lea r8, str.3A0419DE
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call fcn.1800385c0
cmp qword [rsp + 0x158], 8
jb 0x180020d13
mov rcx, qword [rsp + 0x140]
call fcn.180042a14
mov qword [rsp + 0x158], rbp
mov qword [rsp + 0x150], r13
mov word [rsp + 0x140], r13w
lea rcx, [rsp + 0x88]
call fcn.180027f1c
jmp 0x180020d56
lea r8, str.3A0419DE
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.18001b4e8
mov ebp, eax
cmp eax, r13d
je 0x180020fab
cmp esi, r13d
je 0x180020dc0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.1800030e4
nop
or ebx, 8
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1800012e4
nop
or ebx, 0x10
mov dword [rsp + 0x30], ebx
jmp 0x180020dfe
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
xor r8d, r8d
lea rdx, [0x1800656f7]
lea rcx, [rsp + 0x88]
call fcn.180002e60
lea rax, [rsp + 0x88]
or ebx, 0x20
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x128], r13
mov byte [rsp + 0x118], r13b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.180002954
nop
test bl, 0x20
je 0x180020e66
and ebx, 0xffffffdf
cmp qword [rsp + 0xa8], 0x10
jb 0x180020e4e
mov rcx, qword [rsp + 0x90]
call fcn.180042a14
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
test bl, 0x10
je 0x180020e95
and ebx, 0xffffffef
cmp qword [rsp + 0x80], 0x10
jb 0x180020e83
mov rcx, qword [rsp + 0x68]
call fcn.180042a14
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
test bl, 8
je 0x180020ec0
cmp qword [rsp + 0x58], 8
jb 0x180020eac
mov rcx, qword [rsp + 0x40]
call fcn.180042a14
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
cmp esi, r13d
je 0x180020ee1
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdx, qword [rsp + 0x118]
jmp 0x180020ee4
mov rdx, r13
lea rbx, str.EMERGENCY_STATE
mov rcx, rbx
call fcn.18001a1cc
cmp ebp, 1
jne 0x180020f39
cmp esi, r13d
je 0x180020f19
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdx, qword [rsp + 0x118]
jmp 0x180020f1c
mov rdx, r13
mov rax, qword [0x18008bc38]
cmp rax, r13
jne 0x180020f32
mov rcx, rbx
call fcn.18001ab70
jmp 0x180020f93
mov rcx, rbx
call rax
jmp 0x180020f93
cmp esi, r13d
je 0x180020f5a
lea rdi, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdi, qword [rsp + 0x118]
jmp 0x180020f5d
mov rdi, r13
mov rax, qword [0x18008bc40]
cmp rax, r13
jne 0x180020f8a
call fcn.18001a0f4
mov rcx, rax
lea rdx, str.AE399B5D
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18008bc40], rax
cmp rax, r13
je 0x180020f93
mov rdx, rdi
mov rcx, rbx
call rax
nop
cmp qword [rsp + 0x130], 0x10
jb 0x180020fab
mov rcx, qword [rsp + 0x118]
call fcn.180042a14
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret