Function at 0x17910
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x748
mov rax, qword [0x00027100]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov dword [rsp + 0x480], 0xc0000001
mov qword [rsp + 0x260], 0
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x490], ax
lea rdi, [rsp + 0x492]
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x270], ax
lea rdi, [rsp + 0x272]
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rdi, [rsp + 0x490]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdi, [rsp + 0x270]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x690], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x698], rax
mov rax, qword [rsp + 0x698]
mov qword [rsp + 0x6a0], rax
mov rax, qword [rsp + 0x690]
movzx eax, word [rax]
mov word [rsp + 0x6a8], ax
mov rcx, qword [rsp + 0x698]
movzx eax, word [rsp + 0x6a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x690]
add rax, 2
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x698]
add rax, 2
mov qword [rsp + 0x698], rax
cmp word [rsp + 0x6a8], 0
jne 0x179ff
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x6b0], rax
lea rax, [rsp + 0x490]
mov qword [rsp + 0x6b8], rax
mov rax, qword [rsp + 0x6b8]
mov qword [rsp + 0x6c0], rax
mov rax, qword [rsp + 0x6b0]
movzx eax, word [rax]
mov word [rsp + 0x6c8], ax
mov rcx, qword [rsp + 0x6b8]
movzx eax, word [rsp + 0x6c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x6b0]
add rax, 2
mov qword [rsp + 0x6b0], rax
mov rax, qword [rsp + 0x6b8]
add rax, 2
mov qword [rsp + 0x6b8], rax
cmp word [rsp + 0x6c8], 0
jne 0x17a88
lea rdi, [rsp + 0x490]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x000239a0]
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x470]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x20]
mov edx, 0xf003f
lea rcx, [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x480], eax
cmp dword [rsp + 0x480], 0
jl 0x17ba1
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [rsp + 0x480], eax
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.000180f0
lea rdi, [rsp + 0x490]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x6d0], rax
lea rax, [rsp + 0x490]
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x6d8]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6d0]
movzx eax, word [rax]
mov word [rsp + 0x6e8], ax
mov rcx, qword [rsp + 0x6d8]
movzx eax, word [rsp + 0x6e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x6d0]
add rax, 2
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x6d8]
add rax, 2
mov qword [rsp + 0x6d8], rax
cmp word [rsp + 0x6e8], 0
jne 0x17bf4
lea rdi, [rsp + 0x490]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x000240f0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x490]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, [rsp + 0x60]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x17c92
lea rdi, [rsp + 0x490]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x00024110]
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x470]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x20]
mov edx, 0xf003f
lea rcx, [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x480], eax
cmp dword [rsp + 0x480], 0
jl 0x17d63
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [rsp + 0x480], eax
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdi, [rsp + 0x490]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x6f0], rax
lea rax, [rsp + 0x490]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x700], rax
mov rax, qword [rsp + 0x6f0]
movzx eax, word [rax]
mov word [rsp + 0x708], ax
mov rcx, qword [rsp + 0x6f8]
movzx eax, word [rsp + 0x708]
mov word [rcx], ax
mov rax, qword [rsp + 0x6f0]
add rax, 2
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f8]
add rax, 2
mov qword [rsp + 0x6f8], rax
cmp word [rsp + 0x708], 0
jne 0x17da4
lea rdi, [rsp + 0x490]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x000239b0]
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x470]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x20]
mov edx, 0xf003f
lea rcx, [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x480], eax
cmp dword [rsp + 0x480], 0
jl 0x17ebd
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [rsp + 0x480], eax
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdi, [rsp + 0x490]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x710], rax
lea rax, [rsp + 0x490]
mov qword [rsp + 0x718], rax
mov rax, qword [rsp + 0x718]
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x710]
movzx eax, word [rax]
mov word [rsp + 0x728], ax
mov rcx, qword [rsp + 0x718]
movzx eax, word [rsp + 0x728]
mov word [rcx], ax
mov rax, qword [rsp + 0x710]
add rax, 2
mov qword [rsp + 0x710], rax
mov rax, qword [rsp + 0x718]
add rax, 2
mov qword [rsp + 0x718], rax
cmp word [rsp + 0x728], 0
jne 0x17efe
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x470]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x20]
mov edx, 0xf003f
lea rcx, [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x480], eax
cmp dword [rsp + 0x480], 0
jl 0x17ff1
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [rsp + 0x480], eax
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.00021b70
add rsp, 0x748
pop rdi
pop rsi
ret