Function at 0x180022a40
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov qword [rsp + 0x2c0], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rsi, rcx
xor r12d, r12d
mov dword [rax + 0x10], r12d
lea ecx, [r12 + 8]
call fcn.18006ea94
test rax, rax
je 0x180022a87
mov qword [rax], rsi
jmp 0x180022a8a
mov rax, r12
mov qword [rsi], rax
mov qword [rsi + 0x18], r12
mov qword [rsi + 0x20], r12
mov qword [rsi + 0x28], r12
mov ebp, 1
mov dword [rsp + 0x318], ebp
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x1a0]
call fcn.18003441c
nop
mov rcx, qword [rsp + 0x1c0]
sub rcx, qword [rsp + 0x1b8]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18002389a
lea rcx, [rsp + 0x280]
call fcn.180022360
nop
mov rcx, qword [rsp + 0x1b8]
mov rbx, rcx
mov rdi, qword [rsp + 0x1c0]
cmp rcx, rdi
jbe 0x180022b2d
call fcn.18006e940
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r15, [fcn.180021650]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rcx, rdi
jbe 0x180022b6a
call fcn.18006e940
test rbx, rbx
je 0x180022b79
cmp rbx, qword [rsp + 0x1a0]
je 0x180022b7e
call fcn.18006e940
cmp r14, rdi
je 0x180023807
test rbx, rbx
jne 0x180022b96
call fcn.18006e940
mov rdx, r12
jmp 0x180022b99
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x180022ba4
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x180022bb5
lea r13, [r14 + 8]
mov rdx, qword [r13]
jmp 0x180022bbc
lea r13, [r14 + 8]
mov rdx, r13
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r12
mov word [rsp + 0x28], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.180006960
nop
test r15, r15
je 0x180022c14
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call fcn.180021650
mov edi, eax
mov dword [rsp + 0x320], eax
jmp 0x180022c1f
mov edi, r12d
mov dword [rsp + 0x320], r12d
cmp qword [rsp + 0x40], 8
jb 0x180022c31
mov rcx, qword [rsp + 0x28]
call fcn.18006e998
test edi, edi
jne 0x180022c79
test rbx, rbx
jne 0x180022c44
call fcn.18006e940
mov rdx, r12
jmp 0x180022c47
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x180022c52
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x180022c5d
mov r13, qword [r13]
mov r8, r13
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1800237d1
mov r8, qword [rsp + 0x2b0]
mov rcx, qword [r8 + 8]
mov rax, rcx
mov rbx, r8
cmp byte [rcx + 0x49], 0
jne 0x180022cb6
mov edx, dword [rax + 0x18]
cmp edx, edi
jae 0x180022c9e
mov rax, qword [rax + 0x10]
jmp 0x180022cb0
cmp byte [rbx + 0x49], 0
je 0x180022caa
cmp edi, edx
cmovb rbx, rax
mov r8, rax
mov rax, qword [rax]
cmp byte [rax + 0x49], 0
je 0x180022c91
cmp byte [rbx + 0x49], 0
jne 0x180022cbf
mov rcx, qword [rbx]
cmp byte [rcx + 0x49], 0
jne 0x180022cdc
cmp edi, dword [rcx + 0x18]
jae 0x180022cd2
mov rbx, rcx
mov rcx, qword [rcx]
jmp 0x180022cd6
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x49], 0
je 0x180022cc5
mov qword [rsp + 0x68], r8
mov r15, qword [rsp + 0x280]
mov qword [rsp + 0x60], r15
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0xa0], xmm0
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
nop dword [rax]
test rsi, rsi
je 0x180022d1a
cmp rsi, r15
je 0x180022d1f
call fcn.18006e940
cmp rdi, rbx
je 0x180022d88
inc r12
test rsi, rsi
jne 0x180022d31
call fcn.18006e940
cmp byte [rdi + 0x49], 0
je 0x180022d3e
call fcn.18006e940
jmp 0x180022d10
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x49], 0
jne 0x180022d62
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x49], 0
jne 0x180022d10
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x49], 0
je 0x180022d54
jmp 0x180022d10
mov rax, qword [rdi + 8]
cmp byte [rax + 0x49], 0
jne 0x180022d83
nop dword [rax]
cmp rdi, qword [rax + 0x10]
jne 0x180022d83
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x49], 0
je 0x180022d70
mov rdi, rax
jmp 0x180022d10
test r12, r12
jne 0x180022de8
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x180022da1
call fcn.18006e940
mov rdx, r12
jmp 0x180022da7
mov rdx, qword [rbx]
xor r12d, r12d
cmp r14, qword [rdx + 0x20]
jb 0x180022db2
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x180022dbd
mov r13, qword [r13]
mov r8, r13
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov rsi, qword [rsp + 0x310]
lea r15, [fcn.180021650]
jmp 0x1800237d1
and dword [rsp + 0x78], 0xfffffe00
xor r12d, r12d
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], r12
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x180022e1f
call fcn.18006e940
mov rdx, r12
jmp 0x180022e22
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x180022e2d
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x180022e3a
mov r9, qword [r13]
jmp 0x180022e3d
mov r9, r13
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x250]
call fcn.180034278
nop
or ebp, 2
mov dword [rsp + 0x318], ebp
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.180001450
nop
or ebp, 4
mov dword [rsp + 0x318], ebp
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.18000e2f0
test al, al
je 0x180022e9b
cmp byte [rsp + 0x78], 7
jne 0x180022e9b
xor dil, dil
jmp 0x180022e9e
mov dil, 1
test bpl, 4
je 0x180022ee2
and ebp, 0xfffffffb
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0xf8], 0x10
jb 0x180022ec6
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
mov qword [rsp + socket8], 0xf
mov qword [rsp + 0xf0], r12
mov byte [rsp + 0xe0], 0
test bpl, 2
je 0x180022f0a
and ebp, 0xfffffffd
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0x270], 8
jb 0x180022f0a
mov rcx, qword [rsp + 0x258]
call fcn.18006e998
test dil, dil
je 0x180022fd8
test rbx, rbx
jne 0x180022f22
call fcn.18006e940
mov rdx, r12
jmp 0x180022f25
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x180022f30
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x180022f3b
mov r13, qword [r13]
mov r8, r13
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
movsx eax, byte [rsp + 0x78]
cmp eax, 4
je 0x180022f81
add eax, 0xfffffffa
cmp eax, 1
ja 0x180022f93
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x180022f93
mov rcx, rdi
call fcn.18005a3b8
mov rcx, rdi
call fcn.18006e998
jmp 0x180022f93
bt dword [rsp + 0x78], 8
jae 0x180022f93
mov rcx, qword [rsp + 0x70]
call fcn.18006fc10
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800237c2
lea rdi, [rcx - 8]
lea r9, [0x18005595c]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18007ace4
mov rcx, rdi
call fcn.18007a6f4
mov rsi, qword [rsp + 0x310]
lea r15, [fcn.180021650]
jmp 0x1800237d1
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x280]
call fcn.180026490
cmp qword [rax + 0x20], 8
jb 0x180022ffa
mov rax, qword [rax + 8]
jmp 0x180022ffe
add rax, 8
test rax, rax
je 0x1800231d5
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], 0
mov r8d, 8
lea rdx, str.procName
lea rcx, [rsp + 0x20]
call fcn.180006440
nop
or ebp, 8
mov dword [rsp + 0x318], ebp
mov qword [rsp + 0x198], socket
mov qword [rsp + 0x190], r12
mov byte [rsp + 0x180], 0
xor r8d, r8d
lea rdx, [0x18009545a]
lea rcx, [rsp + 0x178]
call fcn.180006440
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x150]
call fcn.18000f1f0
nop
or ebp, 0x10
mov dword [rsp + 0x318], ebp
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1800013c0
nop
or ebp, 0x20
mov dword [rsp + 0x318], ebp
cmp qword [rax + 0x20], 8
jb 0x1800230c1
mov rax, qword [rax + 8]
jmp 0x1800230c5
add rax, 8
test rax, rax
je 0x1800231d5
mov qword [rsp + 0xd0], socket
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xb8], 0
mov r8d, 8
lea rdx, str.procName
lea rcx, [rsp + 0xb0]
call fcn.180006440
nop
or ebp, 0x40
mov dword [rsp + 0x318], ebp
mov qword [rsp + 0x1f0], socket
mov qword [rsp + 0x1e8], r12
mov byte [rsp + 0x1d8], 0
xor r8d, r8d
lea rdx, [0x18009545a]
lea rcx, [rsp + 0x1d0]
call fcn.180006440
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x100]
call fcn.18000f1f0
nop
bts ebp, 7
mov dword [rsp + 0x318], ebp
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1800013c0
nop
bts ebp, 8
mov dword [rsp + 0x318], ebp
cmp qword [rax + 0x20], 8
jb 0x180023199
mov rdi, qword [rax + 8]
jmp 0x18002319d
lea rdi, [rax + 8]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x280]
call fcn.180026490
cmp qword [rax + 0x20], 8
jb 0x1800231bf
mov rcx, qword [rax + 8]
jmp 0x1800231c3
lea rcx, [rax + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800231d5
xor dil, dil
jmp 0x1800231d8
mov dil, 1
bt ebp, 8
jae 0x18002321e
btr ebp, 8
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0xf8], 8
jb 0x180023201
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], r12
mov word [rsp + 0xe0], r12w
test bpl, bpl
jns 0x180023262
btr ebp, 7
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0x120], 0x10
jb 0x180023246
mov rcx, qword [rsp + 0x108]
call fcn.18006e998
mov qword [rsp + 0x120], socket
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x108], 0
test bpl, 0x40
je 0x1800232a6
and ebp, 0xffffffbf
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0xd0], 0x10
jb 0x18002328a
mov rcx, qword [rsp + 0xb8]
call fcn.18006e998
mov qword [rsp + 0xd0], socket
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xb8], 0
test bpl, 0x20
je 0x1800232eb
and ebp, 0xffffffdf
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0x148], 8
jb 0x1800232ce
mov rcx, qword [rsp + 0x130]
call fcn.18006e998
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], r12
mov word [rsp + 0x130], r12w
test bpl, 0x10
je 0x18002332f
and ebp, 0xffffffef
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0x170], 0x10
jb 0x180023313
mov rcx, qword [rsp + 0x158]
call fcn.18006e998
mov qword [rsp + 0x170], socket
mov qword [rsp + 0x168], r12
mov byte [rsp + 0x158], 0
test bpl, 8
je 0x180023351
and ebp, 0xfffffff7
mov dword [rsp + 0x318], ebp
cmp qword [rsp + 0x40], 0x10
jb 0x180023351
mov rcx, qword [rsp + 0x28]
call fcn.18006e998
test dil, dil
je 0x1800233b4
test rbx, rbx
jne 0x180023365
call fcn.18006e940
mov rdx, r12
jmp 0x180023368
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x180023373
call fcn.18006e940
cmp qword [r14 + 0x20], 8
jb 0x18002337e
mov r13, qword [r13]
mov r8, r13
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
lea rcx, [rsp + 0x70]
call fcn.180055f84
mov rsi, qword [rsp + 0x310]
lea r15, [fcn.180021650]
jmp 0x1800237d1
mov qword [rsp + socket8], 0xf
mov qword [rsp + 0xf0], r12
mov byte [rsp + 0xe0], 0
mov r8d, 6
lea rdx, str.hash4k
lea rcx, [rsp + 0xd8]
call fcn.180006440
nop
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], 0
mov r8d, 8
lea rdx, str.procPath
lea rcx, [rsp + 0x20]
call fcn.180006440
nop
mov qword [rsp + 0x120], socket
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x108], 0
mov r8d, 4
lea rdx, str.mode
lea rcx, [rsp + 0x100]
call fcn.180006440
nop
mov qword [rsp + 0xd0], socket
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xb8], 0
mov r8d, 3
lea rdx, [0x180096cf8]
lea rcx, [rsp + 0xb0]
call fcn.180006440
nop
mov qword [rsp + 0x1f0], socket
mov qword [rsp + 0x1e8], r12
mov byte [rsp + 0x1d8], 0
xor r8d, r8d
lea rdx, [0x18009545a]
lea rcx, [rsp + 0x1d0]
call fcn.180006440
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x178]
call fcn.18000f1f0
mov rsi, rax
mov qword [rsp + 0x270], socket
mov qword [rsp + 0x268], r12
mov byte [rsp + 0x258], 0
xor r8d, r8d
lea rdx, [0x18009545a]
lea rcx, [rsp + 0x250]
call fcn.180006440
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x128]
call fcn.18000f1f0
nop
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1800013c0
mov rbx, rax
xor r8d, r8d
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.18000f070
mov edi, eax
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.18000f070
mov dword [rsp + 0x1f8], eax
mov dword [rsp + 0x1fc], edi
mov qword [rsp + 0x220], 7
mov qword [rsp + 0x218], r12
mov word [rsp + 0x208], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x200]
call fcn.180004f80
nop
mov qword [rsp + 0x248], socket
mov qword [rsp + 0x240], r12
mov byte [rsp + 0x230], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x228]
call fcn.180004de0
nop
lea rdx, [rsp + 0x1f8]
mov rsi, qword [rsp + 0x310]
mov rcx, rsi
call fcn.1800269b0
nop
cmp qword [rsp + 0x248], 0x10
jb 0x180023616
mov rcx, qword [rsp + 0x230]
call fcn.18006e998
mov qword [rsp + 0x248], socket
mov qword [rsp + 0x240], r12
mov byte [rsp + 0x230], 0
cmp qword [rsp + 0x220], 8
jb 0x18002364a
mov rcx, qword [rsp + 0x208]
call fcn.18006e998
mov qword [rsp + 0x220], 7
mov qword [rsp + 0x218], r12
mov word [rsp + 0x208], r12w
cmp qword [rsp + 0x170], 8
jb 0x18002367f
mov rcx, qword [rsp + 0x158]
call fcn.18006e998
mov qword [rsp + 0x170], 7
mov qword [rsp + 0x168], r12
mov word [rsp + 0x158], r12w
cmp qword [rsp + 0x148], 0x10
jb 0x1800236b4
mov rcx, qword [rsp + 0x130]
call fcn.18006e998
mov qword [rsp + 0x148], socket
mov qword [rsp + 0x140], r12
mov byte [rsp + 0x130], 0
cmp qword [rsp + 0x198], 0x10
jb 0x1800236e8
mov rcx, qword [rsp + 0x180]
call fcn.18006e998
mov qword [rsp + 0x198], socket
mov qword [rsp + 0x190], r12
mov byte [rsp + 0x180], 0
cmp qword [rsp + 0xd0], 0x10
jb 0x18002371c
mov rcx, qword [rsp + 0xb8]
call fcn.18006e998
mov qword [rsp + 0xd0], socket
mov qword [rsp + 0xc8], r12
mov byte [rsp + 0xb8], 0
cmp qword [rsp + 0x120], 0x10
jb 0x180023750
mov rcx, qword [rsp + 0x108]
call fcn.18006e998
mov qword [rsp + 0x120], socket
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x108], 0
cmp qword [rsp + 0x40], 0x10
jb 0x18002377e
mov rcx, qword [rsp + 0x28]
call fcn.18006e998
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], 0
cmp qword [rsp + 0xf8], 0x10
jb 0x1800237aa
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
nop
lea rcx, [rsp + 0x70]
call fcn.180055f84
mov rbx, qword [rsp + 0x50]
lea r15, [fcn.180021650]
jmp 0x1800237d1
mov rsi, qword [rsp + 0x310]
lea r15, [fcn.180021650]
test rbx, rbx
jne 0x1800237e0
call fcn.18006e940
mov rdx, r12
jmp 0x1800237e3
mov rdx, qword [rbx]
cmp r14, qword [rdx + 0x20]
jb 0x1800237ee
call fcn.18006e940
add r14, 0x28
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1b8]
jmp 0x180022b60
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x280]
mov qword [rsp + 0xa0], rcx
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xa0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x280]
call fcn.180028830
mov rcx, qword [rsp + 0x2b0]
call fcn.18006e998
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2b8], r12
mov rcx, qword [rsp + 0x280]
call fcn.18006e998
nop
lea rcx, [rsp + 0x1a0]
call fcn.180005860
mov rcx, qword [rsp + 0x1a0]
call fcn.18006e998
mov rax, rsi
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret