Function at 0x180060cb0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x188]
sub rsp, 0x270
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r14d, r14d
mov rdi, rcx
mov qword [rsp + 0x48], r14
test rcx, rcx
jne 0x180060cfb
lea ebx, [rcx + 0x57]
jmp 0x180060f7e
test byte [0x1800b78f1], 4
je 0x180060d18
mov ecx, 0x27
lea rdx, [0x1800a3388]
mov r8, rdi
call fcn.180087814
mov ebx, 0x20a
lea rcx, [rsp + 0x50]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x40], r14d
test byte [0x1800b78f3], 0x10
lea r13, str.ParametersDnsPolicyConfig
je 0x180060d67
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r13
call fcn.180094330
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jns 0x180060dd7
test byte [0x1800b78f3], 0x10
je 0x180060dc9
mov dword [rsp + 0x28], eax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r13
call fcn.180094248
mov ecx, esi
call fcn.1800828c8
mov ebx, eax
jmp 0x180060ea7
sub ebx, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov eax, dword [rsp + 0x40]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x180060e59
mov r8d, 0x7ffffffe
mov r9, r13
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x180060e3d
movzx eax, word [r9 + rdx]
test ax, ax
je 0x180060e3d
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x180060e1d
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r14w
test ebx, ebx
jns 0x180060e7c
test byte [0x1800b78f3], 0x10
je 0x180060ec4
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x180060ea7
test byte [0x1800b78f3], 0x10
je 0x180060ec4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r13
call fcn.180094124
test byte [0x1800b78f3], 0x10
je 0x180060ec4
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
test ebx, ebx
jns 0x180060ed1
mov ecx, ebx
call fcn.180011928
jmp 0x180060efc
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180060f28
test byte [0x1800b78f1], 4
je 0x180060f24
mov ecx, 0xa
lea r8, [rsp + 0x50]
mov r9d, eax
lea rdx, [0x18009f440]
call fcn.180087538
test ebx, ebx
jne 0x180060f68
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180060f68
test byte [0x1800b78f1], 4
je 0x180060f68
mov ecx, 0x28
lea rdx, [0x1800a3388]
mov r9d, eax
mov r8, rdi
call fcn.180087538
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180060f7e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test byte [0x1800b78f1], 4
je 0x180060f9e
mov ecx, 0x29
lea rdx, [0x1800a3388]
mov r9d, ebx
mov r8, rdi
call fcn.180087538
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret