Function at 0x7fff25db7a70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r15d, r15d
mov dword [rsp + 0x20], 2
mov r14, rcx
mov qword [rsp + 0x40], r15
mov r8, rdx
mov qword [rsp + 0x50], r15
lea rdx, [0x7fff25f08a60]
mov r9d, 0xf003f
lea rcx, [rsp + 0x40]
mov edi, r15d
call fcn.7fff25d71490
mov ebx, eax
test eax, eax
jns 0x7fff25db7b11
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x7fff25db7b8e
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
mov edx, edi
mov qword [rsp + 0x38], r15
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25dfaaf0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x20006
mov rdx, r14
call fcn.7fff25d44d18
mov ebx, eax
test eax, eax
js 0x7fff25db7ad1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25db7ad1
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0x40], r15
jmp 0x7fff25db7adf
cmp dword [rsp + 0x30], 0x102
jae 0x7fff25dfac47
mov ecx, dword [rsp + 0x6c]
lea rax, [rsp + 0x70]
add rax, rcx
lea rdx, [rbp + 0x64]
cmp rax, rdx
jae 0x7fff25dfac47
shr rcx, 1
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0xf003f
lea rdx, [rsp + 0x70]
mov word [rsp + rcx*2 + 0x70], r15w
mov rcx, qword [rsp + 0x40]
call fcn.7fff25d44d18
test eax, eax
jne 0x7fff25dfac47
mov ebx, r15d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x104
mov edx, ebx
mov qword [rsp + 0x48], r15
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
mov esi, eax
test eax, eax
js 0x7fff25dfac11
cmp dword [rsp + 0x30], 0x102
jae 0x7fff25dfac03
mov eax, dword [rsp + 0x6c]
lea rcx, [rsp + 0x70]
add rcx, rax
lea rdx, [rbp + 0x64]
cmp rcx, rdx
jae 0x7fff25dfac03
shr rax, 1
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov r8d, 0xf003f
mov word [rsp + rax*2 + 0x70], r15w
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.7fff25d44d18
test eax, eax
jne 0x7fff25dfac03
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jns 0x7fff25dfabf0
inc ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25dfac05
inc ebx
cmp esi, 0x8000001a
jne 0x7fff25dfab4d
mov rcx, qword [rsp + 0x38]
cmp esi, 0x8000001a
jne 0x7fff25dfac4e
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25dfac30
inc edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25db7b11
inc edi
jmp 0x7fff25db7b11
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25db7b4b