Function at 0x140034ea0
Capabilities:
Delete registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], r12
mov rax, qword [0x1403ceac0]
xor rax, rbp
mov qword [rbp + 0x10], rax
xor r15d, r15d
mov dword [rbp + 8], 6
mov qword [rsp + 0x38], r15
lea r8, str.SoftwareMcAfeePEFOEM
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edi, r15d
lea r9d, [r15 - 1]
mov qword [rbp], r15
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x140034f22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14d, r15d
test eax, eax
jne 0x140035208
movsxd rbx, r14d
mov rcx, r15
lea rax, [rbx + 0x10]
cmp rax, rbx
cmova rcx, rax
test rcx, rcx
je 0x140035203
movabs r12, 0xffffffffffffff0
cmp rcx, 0x400
ja 0x140034f7d
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x140034f5b
mov rax, r12
and rax, 0xfffffffffffffff0
call fcn.140297960
sub rsp, rax
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x140035203
mov dword [rsi], 0xcccc
jmp 0x140034f90
call fcn.1402c79a8
mov rsi, rax
test rax, rax
je 0x140034f94
mov dword [rax], 0xdddd
add rsi, 0x10
test rsi, rsi
je 0x140035203
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1402b60e0
mov qword [rsp + 0x38], r15
lea r8, str.SoftwareMcAfeePEFOEM
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140035026
cmp r14d, eax
jge 0x140034fe9
mov ebx, 0xea
jmp 0x1400351d8
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1402b60e0
mov qword [rsp + 0x38], r15
lea r8, str.SoftwareMcAfeePEFOEM
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rsi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140035036
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400351d8
mov qword [rsp + 0x38], r15
lea r8, str.silentinfactory
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x14003507c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14d, r15d
test eax, eax
jne 0x1400351d8
movsxd rbx, r14d
mov rcx, r15
lea rax, [rbx + 0x10]
cmp rax, rbx
cmova rcx, rax
test rcx, rcx
je 0x1400351d3
cmp rcx, 0x400
ja 0x1400350cd
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400350ab
mov rax, r12
and rax, 0xfffffffffffffff0
call fcn.140297960
sub rsp, rax
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1400351d3
mov dword [rdi], 0xcccc
jmp 0x1400350e0
call fcn.1402c79a8
mov rdi, rax
test rax, rax
je 0x1400350e4
mov dword [rax], 0xdddd
add rdi, 0x10
test rdi, rdi
je 0x1400351d3
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1402b60e0
mov qword [rsp + 0x38], r15
lea r8, str.silentinfactory
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140035176
cmp r14d, eax
jge 0x140035139
mov ebx, 0xea
jmp 0x1400351d8
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1402b60e0
mov qword [rsp + 0x38], r15
lea r8, str.silentinfactory
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140035182
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400351d8
cmp dword [rbp + 8], 6
je 0x140035197
mov rcx, qword [rbp]
test rcx, rcx
je 0x140035197
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 8], eax
mov ebx, eax
test eax, eax
jne 0x1400351d8
mov rcx, qword [rbp]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, eax
jmp 0x1400351d8
mov ebx, select
cmp dword [rsi - 0x10], 0xdddd
lea rcx, [rsi - 0x10]
jne 0x1400351ea
call fcn.1402ba464
test rdi, rdi
je 0x140035208
cmp dword [rdi - 0x10], 0xdddd
lea rcx, [rdi - 0x10]
jne 0x140035208
call fcn.1402ba464
jmp 0x140035208
mov ebx, select
cmp dword [rbp + 8], 6
je 0x14003521d
mov rcx, qword [rbp]
test rcx, rcx
je 0x14003521d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.140296f70
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
mov r12, qword [rbp + 0x58]
lea rsp, [rbp + 0x20]
pop r15
pop r14
pop rbp
ret