Function at 0x18001d060
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rsi
push r13
push r15
sub rsp, 0x168
mov esi, dword [rsp + 0x1b0]
mov r13, r9
mov r9, rdx
mov r15, rcx
lea ebx, [rsi + 0x758]
mov dword [rsp + 0x20], ebx
cmp esi, ebx
jae 0x18001d3a2
mov rbx, qword [rsp + 0x30]
mov ecx, 1
mov qword [rax + 8], rbp
mov r11d, 0xfffb
movzx ebp, word [rsp + 0x1b0]
mov r10d, 0xfa5
mov qword [rax - 0x28], rdi
xor edi, edi
mov qword [rax - 0x30], r12
mov r12, qword [rsp + 0x30]
mov qword [rax - 0x38], r14
movzx r14d, word [rsp + 0x1b0]
mov eax, dword [rsp + 0x20]
nop dword [rax]
cmp esi, 0x1c0
ja 0x18001d1e3
je 0x18001d1db
mov eax, esi
sub eax, 0x4d
je 0x18001d19f
sub eax, 0x30
je 0x18001d147
sub eax, 0x87
je 0x18001d13d
sub eax, 5
je 0x18001d135
cmp eax, 0x30
jne 0x18001d370
mov rdx, qword [str.V1224_angTable]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cdqe
mov qword [rsp + 0x40], rax
jmp 0x18001d34f
mov r12, rcx
jmp 0x18001d370
mov ebp, edi
mov rbx, rdi
jmp 0x18001d370
mov rcx, qword [0x1800d57c8]
test rcx, rcx
je 0x18001d160
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [0x1800d57c8], rdi
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18001d34f
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
jmp 0x18001d34f
mov rax, qword [r15]
lea r9, [rsp + 0x28]
mov word [rsp + 0x1b0], cx
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov r8d, 0x10c
call fcn.180059270
mov qword [rsp + 0x30], rax
mov byte [rsp + rax + 0x50], 0
jmp 0x18001d34f
mov r14d, edi
jmp 0x18001d374
mov eax, esi
sub eax, 0x1c5
je 0x18001d2db
sub eax, 0x30
je 0x18001d29f
sub eax, 0x87
je 0x18001d21d
cmp eax, 0xbc
jne 0x18001d370
test r13, r13
je 0x18001d370
mov qword [r13], rbx
jmp 0x18001d370
mov rax, qword [r15]
mov rcx, qword [rax]
mov rdx, qword [rcx]
movzx eax, word [rdx]
sub ax, 0x51
test r11w, ax
je 0x18001d23d
mov word [0x1800d5918], r10w
jmp 0x18001d27b
mov eax, 0x8f
cmp eax, 0x8f
je 0x18001d25f
cmp eax, 0x61c1
jne 0x18001d26f
cmp word [rdx], 0x51
jne 0x18001d26f
movsxd rbx, dword [rdx + 2]
mov rbx, qword [rbx]
jmp 0x18001d26f
mov word [0x1800d5918], di
movzx ebp, word [rdx + 0xc]
movzx r14d, word [rdx + 0xa]
add eax, 0x6132
cmp eax, 0xc264
jbe 0x18001d242
test r9, r9
je 0x18001d284
mov word [r9], bp
mov eax, dword [rsp + 0x20]
mov ecx, 1
test r8, r8
je 0x18001d374
mov word [r8], r14w
jmp 0x18001d374
cmp qword [rsp + 0x40], 0
lea rdx, [rsp + 0x1b0]
mov rax, rdi
lea rcx, [rsp + 0x28]
sete al
mov r8d, 0x92
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x1b0], eax
mov rax, qword [r15]
mov qword [rsp + 0x28], rax
call fcn.18004ff10
xor edi, edi
jmp 0x18001d34f
mov rcx, qword [0x1800bd160]
test rcx, rcx
je 0x18001d2f3
call fcn.180073cf4
mov qword [0x1800bd160], rdi
mov rdi, qword [rsp + 0x30]
lea rcx, [rdi + 1]
call fcn.180073cfc
mov qword [0x1800bd160], rax
test rax, rax
je 0x18001d322
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [rdi + 1]
call fcn.180073290
xor edi, edi
jmp 0x18001d327
xor edi, edi
mov r12d, edi
mov rax, qword [r15]
lea rdx, [rsp + 0x1b0]
mov r8d, 0x92
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x1b0], r12d
call fcn.18004ff10
mov r9, qword [rsp + 0x198]
mov r11d, 0xfffb
mov r8, qword [rsp + 0x1a0]
mov r10d, 0xfa5
mov ecx, 1
mov eax, dword [rsp + 0x20]
add esi, 0xbc
cmp esi, eax
jb 0x18001d0e0
mov r14, qword [rsp + 0x150]
mov r12, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x190]
add rsp, 0x168
pop r15
pop r13
pop rsi
pop rbx
ret