Function at 0x180021698
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x170
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, rdx
movsxd rsi, ecx
xor r13d, r13d
mov ebx, r13d
mov dword [rsp + 0x30], ebx
lea ebp, [r13 + 7]
lea r15d, [r13 + 0xf]
cmp esi, r13d
je 0x180021a0f
and dword [rsp + 0x90], 0xfffffe00
mov qword [r11 - 0x100], r13
mov qword [r11 - 0xf8], r13
mov qword [r11 - 0xf0], r13
lea rax, [r11 - 0xe0]
mov qword [r11 - 0xe8], rax
lea edx, [rbp - 6]
lea rcx, [rsp + 0x60]
call fcn.1800382dc
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800290b0
mov rdi, rax
lea rdx, str.time
lea rcx, [rsp + 0x88]
call fcn.18002a61c
mov rcx, rax
mov rdx, rdi
call fcn.18002933c
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180021775
mov rcx, qword [rsp + 0x68]
call fcn.180048114
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xb0], rax
cmp r12, r13
je 0x1800217ed
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0xb8]
call fcn.180003158
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call fcn.180001328
nop
mov ebx, 3
mov dword [rsp + 0x30], ebx
jmp 0x18002181e
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0x38]
call fcn.180002ed4
lea rax, [rsp + 0x38]
mov ebx, 4
mov dword [rsp + 0x30], ebx
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.1800290b0
mov rdi, rax
lea rdx, str.reason
lea rcx, [rsp + 0x88]
call fcn.18002a61c
mov rcx, rax
mov rdx, rdi
call fcn.18002933c
nop
test bl, 4
je 0x18002187e
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0x58], 0x10
jb 0x18002186f
mov rcx, qword [rsp + 0x40]
call fcn.180048114
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], r13b
test bl, 2
je 0x1800218b1
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0x80], 0x10
jb 0x18002189f
mov rcx, qword [rsp + 0x68]
call fcn.180048114
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
test bl, 1
je 0x1800218d5
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
cmp qword [rsp + 0xd8], 8
jb 0x1800218d5
mov rcx, qword [rsp + 0xc0]
call fcn.180048114
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x40], 1
btr dword [rsp + 0x40], 8
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x38], rsi
lea rdx, str.flags
lea rcx, [rsp + 0x88]
call fcn.18002a61c
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.18002933c
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call fcn.18002ac20
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18003e2fc
nop
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.1800012a0
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002196c
mov rcx, qword [rsp + 0x68]
call fcn.180048114
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
cmp qword [rsp + 0xd8], 0x10
jb 0x180021996
mov rcx, qword [rsp + 0xc0]
call fcn.180048114
lea r9, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae r9, qword [rsp + 0x140]
mov dword [rsp + 0x20], r13d
lea r8, str.3A0419DE
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call fcn.180039ec8
cmp qword [rsp + 0x158], 8
jb 0x1800219e7
mov rcx, qword [rsp + 0x140]
call fcn.180048114
mov qword [rsp + 0x158], rbp
mov qword [rsp + 0x150], r13
mov word [rsp + 0x140], r13w
lea rcx, [rsp + 0x88]
call fcn.1800292a4
jmp 0x180021a2a
lea r8, str.3A0419DE
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.18001c924
mov ebp, eax
cmp eax, r13d
je 0x180021c7f
cmp esi, r13d
je 0x180021a94
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.180003158
nop
or ebx, 8
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.180001328
nop
or ebx, 0x10
mov dword [rsp + 0x30], ebx
jmp 0x180021ad2
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
xor r8d, r8d
lea rdx, [0x18006c857]
lea rcx, [rsp + 0x88]
call fcn.180002ed4
lea rax, [rsp + 0x88]
or ebx, 0x20
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x128], r13
mov byte [rsp + 0x118], r13b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.1800029c8
nop
test bl, 0x20
je 0x180021b3a
and ebx, 0xffffffdf
cmp qword [rsp + 0xa8], 0x10
jb 0x180021b22
mov rcx, qword [rsp + 0x90]
call fcn.180048114
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
test bl, 0x10
je 0x180021b69
and ebx, 0xffffffef
cmp qword [rsp + 0x80], 0x10
jb 0x180021b57
mov rcx, qword [rsp + 0x68]
call fcn.180048114
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
test bl, 8
je 0x180021b94
cmp qword [rsp + 0x58], 8
jb 0x180021b80
mov rcx, qword [rsp + 0x40]
call fcn.180048114
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
cmp esi, r13d
je 0x180021bb5
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdx, qword [rsp + 0x118]
jmp 0x180021bb8
mov rdx, r13
lea rbx, str.EMERGENCY_STATE
mov rcx, rbx
call fcn.18001b608
cmp ebp, 1
jne 0x180021c0d
cmp esi, r13d
je 0x180021bed
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdx, qword [rsp + 0x118]
jmp 0x180021bf0
mov rdx, r13
mov rax, qword [0x1800968d8]
cmp rax, r13
jne 0x180021c06
mov rcx, rbx
call fcn.18001bfac
jmp 0x180021c67
mov rcx, rbx
call rax
jmp 0x180021c67
cmp esi, r13d
je 0x180021c2e
lea rdi, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdi, qword [rsp + 0x118]
jmp 0x180021c31
mov rdi, r13
mov rax, qword [0x1800968e0]
cmp rax, r13
jne 0x180021c5e
call fcn.18001b530
mov rcx, rax
lea rdx, str.AE399B5D
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800968e0], rax
cmp rax, r13
je 0x180021c67
mov rdx, rdi
mov rcx, rbx
call rax
nop
cmp qword [rsp + 0x130], 0x10
jb 0x180021c7f
mov rcx, qword [rsp + 0x118]
call fcn.180048114
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret