Function at 0x140004770
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov edi, ecx
mov byte [r9], r14b
test r8b, r8b
je 0x1400047d1
mov ebx, 0x3e8
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov edx, edi
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.140003fa8
mov ebx, eax
test eax, eax
jns 0x14000482c
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004817
test byte [rcx + 0x1c], 1
je 0x140004817
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x15
mov r9d, eax
call fcn.1400036a4
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004825
call fcn.14000164c
mov eax, ebx
jmp 0x14000509d
lea r12, [0x14001a028]
mov r13d, 1
cmp edi, 2
jne 0x1400048f0
mov r8d, 0x20006
mov qword [rbp - 0x18], r14
lea rdx, str.SOFTWAREMicrosoftWindows_Security_HealthPlatform
lea rcx, [rbp - 0x18]
call fcn.14000747c
mov rbx, qword [rbp - 0x18]
test eax, eax
js 0x1400048d5
lea rdx, str.NewLocation
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jle 0x14000488c
movzx r8d, ax
or r8d, 0x80070000
mov ecx, 0x80000000
lea eax, [r8 + rcx]
test ecx, eax
jne 0x1400048d5
cmp r8d, 0x80070002
je 0x1400048d5
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x1400048dc
test byte [rcx + 0x1c], r13b
je 0x1400048dc
mov rcx, qword [rcx + 0x10]
lea r9, str.NewLocation
mov dword [rsp + 0x20], r8d
mov edx, 0x1d
lea r8, [0x140015110]
call fcn.14000729c
mov rcx, qword [0x14001a028]
test rbx, rbx
je 0x1400048f7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x14001a028]
mov rbx, qword [rbp - 0x20]
lea r15, [0x140014a78]
cmp rcx, r12
je 0x140004926
test byte [rcx + 0x1c], 4
je 0x140004926
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9d, edi
mov qword [rsp + 0x20], rbx
mov r8, r15
call fcn.140005748
or qword [rbp - 0x20], 0xffffffffffffffff
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov dword [rsp + 0x28], r14d
call fcn.14000efdc
mov edi, eax
test eax, eax
jns 0x140004992
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004968
test byte [rcx + 0x1c], r13b
je 0x140004968
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9d, eax
mov r8, r15
call fcn.1400036a4
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x14000497e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000498b
mov rcx, rbx
call fcn.14000164c
mov eax, edi
jmp 0x14000509d
mov rdi, qword [rbp - 0x20]
lea rcx, [rbp - 0x18]
mov rdx, rdi
mov qword [rbp - 0x18], r14
call fcn.1400061b4
mov esi, eax
test eax, eax
jns 0x140004a09
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x1400049d2
test byte [rcx + 0x1c], r13b
je 0x1400049d2
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9d, eax
mov r8, r15
call fcn.1400036a4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400049e0
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x1400049f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004a02
mov rcx, rbx
call fcn.14000164c
mov eax, esi
jmp 0x14000509d
mov rsi, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
mov rdx, rsi
mov qword [rbp - 0x20], r14
call fcn.140010840
mov r14d, eax
test eax, eax
jns 0x140004a8f
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004a4a
test byte [rcx + 0x1c], r13b
je 0x140004a4a
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9d, eax
mov r8, r15
call fcn.1400036a4
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004a58
call fcn.14000164c
test rsi, rsi
je 0x140004a65
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x140004a7a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004a87
mov rcx, rbx
call fcn.14000164c
mov eax, r14d
jmp 0x14000509d
mov r14, qword [rbp - 0x20]
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140004b1b
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004ad5
test byte [rcx + 0x1c], r13b
je 0x140004ad5
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1a]
mov r9d, 0x8007007b
mov r8, r15
call fcn.1400036a4
test r14, r14
je 0x140004ae2
mov rcx, r14
call fcn.14000164c
test rsi, rsi
je 0x140004aef
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x140004b04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004b11
mov rcx, rbx
call fcn.14000164c
mov eax, 0x8007007b
jmp 0x14000509d
mov word [rax], dx
cmp dword [rbp + 0x48], edx
je 0x140004b74
mov byte [rbp + 0x58], dl
mov rcx, r14
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x18]
call fcn.140003f04
mov r15, qword [rbp - 0x18]
xor edx, edx
test eax, eax
js 0x140004b5e
mov rcx, qword [0x14001ae70]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
sete byte [rbp + 0x58]
test r15, r15
je 0x140004b6d
mov rcx, r15
call fcn.14000164c
xor edx, edx
mov al, dl
cmp byte [rbp + 0x58], dl
je 0x140004b77
mov al, r13b
mov rcx, qword [rbp + 0x60]
mov r15, rdx
mov byte [rbp + 0x58], al
mov qword [rbp + 0x60], rdx
mov byte [rcx], al
test al, al
jne 0x140004c93
mov al, byte [0x14001ae28]
mov rcx, rsi
neg al
sbb edx, edx
and edx, 0x20
add edx, 4
call fcn.140011100
mov r15d, eax
test eax, eax
jns 0x140004c1c
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004bd8
test byte [rcx + 0x1c], r13b
je 0x140004bd8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x1b
mov r9d, eax
call fcn.1400036a4
test r14, r14
je 0x140004be5
mov rcx, r14
call fcn.14000164c
test rsi, rsi
je 0x140004bf2
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x140004c07
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004c14
mov rcx, rbx
call fcn.14000164c
mov eax, r15d
jmp 0x14000509d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x60]
call fcn.140003bac
xor edx, edx
mov r15d, eax
test eax, eax
jns 0x140004c8f
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004c5c
test byte [rcx + 0x1c], r13b
je 0x140004c5c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x1c
mov r9d, eax
call fcn.1400036a4
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x140004bd8
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004bd8
mov r15, qword [rbp + 0x60]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x18]
mov rdx, rsi
mov r8d, 0x1000
call fcn.14000f2c0
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004d5d
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004cde
test byte [rcx + 0x1c], r13b
je 0x140004cde
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x1d
mov r9d, eax
call fcn.1400036a4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140004cf3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004d19
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x140004d26
mov rcx, r14
call fcn.14000164c
test rsi, rsi
je 0x140004d33
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x140004d48
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004d55
mov rcx, rbx
call fcn.14000164c
mov eax, dword [rbp + 0x60]
jmp 0x14000509d
mov r12, qword [rbp - 0x18]
lea r8, str.ServiceMainEx
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14000f614
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004def
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004dac
test byte [rcx + 0x1c], r13b
je 0x140004dac
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov r9d, eax
call fcn.1400036a4
test r12, r12
je 0x140004dc0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004d19
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004d19
lea r8, str.ServiceHandlerEx
mov rdx, r12
lea rcx, [rbp - 0x18]
call fcn.14000f614
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004e2c
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004dac
test byte [rcx + 0x1c], r13b
je 0x140004dac
mov edx, 0x1f
jmp 0x140004d99
mov r13, qword [rbp + 0x50]
add r13, 8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x58], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor eax, eax
cmp byte [0x14001ae28], al
mov ecx, eax
movzx eax, byte [rbp + 0x58]
setne cl
add eax, eax
or eax, ecx
mov rcx, qword [rbp + 0x50]
mov dword [rcx + 0x60], eax
movabs r10, 0xd9a82f985ed58970
mov rax, qword [rbp - 0x20]
mov rdx, rcx
xor ecx, ecx
call qword [0x140013c50]
mov dword [rbp + 0x58], eax
mov rcx, r13
mov rax, qword [rbp + 0x50]
and dword [rax + 0x60], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
mov rcx, r13
and qword [rax + 0x58], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14001a028]
lea r13, [0x14001a028]
cmp rcx, r13
je 0x140004ef7
test byte [rcx + 0x1c], 4
je 0x140004ef7
mov r9d, dword [rbp + 0x58]
lea r8, [0x140014a78]
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
call fcn.1400036a4
test r12, r12
je 0x140004f0b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
nop dword [rax + rax]
mov rcx, rax
sub rcx, qword [0x14001ae30]
cmp rcx, 0xea60
jbe 0x140004ffb
mov qword [0x14001ae30], rax
xor eax, eax
mov dword [0x14001ae2c], eax
mov eax, dword [rbp + 0x58]
cmp eax, 4
jne 0x1400050af
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004770
mov r12d, eax
test eax, eax
jns 0x140005039
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x140004f91
test byte [rcx + 0x1c], 1
je 0x140004f91
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x22
mov r9d, eax
call fcn.1400036a4
test r15, r15
je 0x140004fb7
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x140004fc4
mov rcx, r14
call fcn.14000164c
test rsi, rsi
je 0x140004fd1
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x140004fe6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004ff3
mov rcx, rbx
call fcn.14000164c
mov eax, r12d
jmp 0x14000509d
mov eax, dword [0x14001ae2c]
inc eax
mov dword [0x14001ae2c], eax
cmp eax, 5
jbe 0x140004f3d
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x140005039
test byte [rcx + 0x1c], 1
je 0x140005039
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov edx, 0x21
call fcn.1400056b4
test r15, r15
je 0x14000505f
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x14000506c
mov rcx, r14
call fcn.14000164c
test rsi, rsi
je 0x140005079
mov rcx, rsi
call fcn.14000164c
cmp rdi, 0xffffffffffffffff
je 0x14000508e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000509b
mov rcx, rbx
call fcn.14000164c
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x14000512b
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004770
mov r12d, eax
test eax, eax
jns 0x140005039
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x1400050fc
test byte [rcx + 0x1c], 1
je 0x1400050fc
mov edx, 0x23
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a78]
mov r9d, r12d
call fcn.1400036a4
test r15, r15
je 0x140004fb7
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004fb7
cmp eax, 2
jne 0x140005039
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
xor ecx, ecx
call fcn.140004770
mov r12d, eax
test eax, eax
jns 0x140005039
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x1400050fc
test byte [rcx + 0x1c], 1
je 0x1400050fc
mov edx, 0x24
jmp 0x1400050e9