Function at 0x1800256c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, rcx
xor r14d, r14d
mov ebx, 0x20a
mov dword [rsp + 0x44], r14d
mov r8d, ebx
lea rcx, [rbp + 0x170]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x48], 0x105
mov dil, byte [0x1800b78f3]
test dil, 0x20
jne 0x1800431a8
mov r8, rbx
lea rcx, [rsp + 0x60]
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x40], r14d
mov sil, 0x10
lea r15, str.ParametersDnsActiveIfs
test sil, dil
jne 0x1800431c8
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x1800431f4
sub ebx, dword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov eax, dword [rsp + 0x40]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x18002581c
mov r8d, 0x7ffffffe
mov r9, r15
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x180025800
movzx eax, word [r9 + rdx]
test ax, ax
je 0x180025800
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x1800257e0
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r14w
test ebx, ebx
js 0x180043227
test byte [0x1800b78f3], sil
jne 0x18004324e
test ebx, ebx
js 0x180043290
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18002592a
cmp ebx, 0x490
je 0x1800432e7
cmp ebx, 2
je 0x1800432e7
test ebx, ebx
jg 0x18002591a
js 0x1800432bc
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x18002593c
test byte [0x1800b78f3], 0x20
jne 0x1800432ef
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800258eb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jmp 0x18002588b
test byte [0x1800b78f1], 4
je 0x18002586e
jmp 0x18004329d
test byte [0x1800b78f3], 0x20
jne 0x1800432c9
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x170]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov dword [rsp + 0x48], 0x105
jmp 0x180025891
test byte [0x1800b78f3], sil
je 0x180025831
jmp 0x180043276
mov ecx, 0x41
lea rdx, [0x18009f2c0]
mov r8, rsi
call fcn.1800879b4
mov dil, byte [0x1800b78f3]
jmp 0x18002572d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r15
call fcn.180094330
nop
jmp 0x180025759
test byte [0x1800b78f3], sil
je 0x180043219
mov dword [rsp + 0x28], edi
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r15
call fcn.180094248
mov ecx, edi
call fcn.1800828c8
mov ebx, eax
jmp 0x180025974
test byte [0x1800b78f3], sil
je 0x180025831
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x180025974
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r15
call fcn.180094124
nop
jmp 0x180025974
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x180025831
mov ecx, ebx
call fcn.180011928
nop
jmp 0x180025864
mov ecx, 0xa
lea r8, [rsp + 0x60]
mov r9d, ebx
lea rdx, [0x18009f440]
call fcn.180087538
nop
jmp 0x18002586e
mov dword [rsp + 0x44], 0x61d
jmp 0x1800258c8
mov ecx, 0x42
lea r8, [rbp + 0x170]
lea rdx, [0x18009f2c0]
call fcn.180087814
nop
jmp 0x180025949
mov ebx, r14d
jmp 0x1800258c8
mov ecx, 0x43
lea rdx, [0x18009f2c0]
mov r8d, ebx
call fcn.1800876bc
nop
jmp 0x1800258d5