Function at 0x1400334b4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
lea rcx, [rbp - 0x20]
call fcn.140034d5c
nop
lea rcx, [rbp - 0x20]
call fcn.140034f50
lea rdx, str.SOFTWAREMcAfeeRemediation
mov rsi, 0xffffffff80000002
mov rcx, rsi
test al, al
je 0x140033635
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x20], eax
test eax, eax
jne 0x1400335f8
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0x20], eax
test eax, eax
jne 0x1400335d9
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x20], eax
mov ebx, 5
lea edi, [rbx - 4]
test eax, 0xfffffffc
jne 0x140033549
cmp eax, edi
jne 0x140033584
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x140033584
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_close_remediation_registry_key__error:__d
mov qword [rsp + 0x20], rax
mov r9d, 0xd2
lea r8, str.CSIS::_RemoveRegistryHive
lea rdx, str.E:BT98e4b0b8_6261_4b66_a156_8e0ef62b3d71UBF_1CSIS_srcCSISUpgradeRemediation.cpp
mov ecx, ebx
call fcn.140032100
xor r9d, r9d
mov r8d, 0x100
lea rdx, str.SOFTWAREMcAfeeRemediation
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov dword [rbp + 0x20], eax
test eax, 0xfffffffc
jne 0x1400335af
cmp eax, edi
jne 0x1400336da
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x1400336d7
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_remove_remediation_registry_key__error:__d
mov r9d, 0xdd
jmp 0x1400336bd
mov ebx, 5
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x1400336d7
mov r9d, 0xe2
jmp 0x1400336ad
add eax, 0xfffffffe
mov edi, 1
cmp eax, edi
jbe 0x1400336da
lea ebx, [rdi + 4]
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x1400336d7
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_open_remediation_registry_key__error:__d
mov r9d, 0xeb
jmp 0x1400336bd
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0x20], eax
test eax, eax
jne 0x14003368d
lea rdx, str.SOFTWAREMcAfeeRemediation
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp + 0x20], eax
test eax, 0xfffffffc
jne 0x140033665
mov edi, 1
cmp eax, edi
jne 0x1400336da
mov ebx, 5
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x1400336d7
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_remove_remediation_registry_key__error:__d
mov r9d, 0xfc
jmp 0x1400336bd
add eax, 0xfffffffe
mov edi, 1
cmp eax, edi
jbe 0x1400336da
lea ebx, [rdi + 4]
mov ecx, ebx
call fcn.1400e2070
test eax, eax
je 0x1400336d7
mov r9d, 0x105
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_remove_remediation_registry_hive__error:__d
mov qword [rsp + 0x20], rax
lea r8, str.CSIS::_RemoveRegistryHive
lea rdx, str.E:BT98e4b0b8_6261_4b66_a156_8e0ef62b3d71UBF_1CSIS_srcCSISUpgradeRemediation.cpp
mov ecx, ebx
call fcn.140032100
xor dil, dil
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x14003370d
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14003370d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov edx, esi
lock xadd dword [rbx + 0xc], edx
add edx, esi
jne 0x14003370d
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
mov al, dil
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret