Function at 0x140004a40
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov edi, ecx
mov byte [r9], r14b
test r8b, r8b
je 0x140004aa1
mov ebx, 0x3e8
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov edx, edi
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.140004218
mov ebx, eax
test eax, eax
jns 0x140004afc
mov rcx, qword [0x14001b028]
lea rdx, [0x14001b028]
cmp rcx, rdx
je 0x140004ae7
test byte [rcx + 0x1c], 1
je 0x140004ae7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x15
mov r9d, eax
call fcn.14000391c
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004af5
call fcn.14000165c
mov eax, ebx
jmp 0x14000536d
lea r12, [0x14001b028]
mov r13d, 1
cmp edi, 2
jne 0x140004bc0
mov r8d, 0x20006
mov qword [rbp - 0x18], r14
lea rdx, str.SOFTWAREMicrosoftWindows_Security_HealthPlatform
lea rcx, [rbp - 0x18]
call fcn.1400078c8
mov rbx, qword [rbp - 0x18]
test eax, eax
js 0x140004ba5
lea rdx, str.NewLocation
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jle 0x140004b5c
movzx r8d, ax
or r8d, 0x80070000
mov ecx, 0x80000000
lea eax, [r8 + rcx]
test ecx, eax
jne 0x140004ba5
cmp r8d, 0x80070002
je 0x140004ba5
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004bac
test byte [rcx + 0x1c], r13b
je 0x140004bac
mov rcx, qword [rcx + 0x10]
lea r9, str.NewLocation
mov dword [rsp + 0x20], r8d
mov edx, 0x1d
lea r8, [0x1400161b0]
call fcn.1400076e8
mov rcx, qword [0x14001b028]
test rbx, rbx
je 0x140004bc7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x14001b028]
mov rbx, qword [rbp - 0x20]
lea r15, [0x140015af8]
cmp rcx, r12
je 0x140004bf6
test byte [rcx + 0x1c], 4
je 0x140004bf6
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9d, edi
mov qword [rsp + 0x20], rbx
mov r8, r15
call fcn.140005a18
or qword [rbp - 0x20], 0xffffffffffffffff
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov dword [rsp + 0x28], r14d
call fcn.14000f7fc
mov edi, eax
test eax, eax
jns 0x140004c62
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004c38
test byte [rcx + 0x1c], r13b
je 0x140004c38
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9d, eax
mov r8, r15
call fcn.14000391c
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x140004c4e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004c5b
mov rcx, rbx
call fcn.14000165c
mov eax, edi
jmp 0x14000536d
mov rdi, qword [rbp - 0x20]
lea rcx, [rbp - 0x18]
mov rdx, rdi
mov qword [rbp - 0x18], r14
call fcn.1400064e0
mov esi, eax
test eax, eax
jns 0x140004cd9
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004ca2
test byte [rcx + 0x1c], r13b
je 0x140004ca2
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9d, eax
mov r8, r15
call fcn.14000391c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140004cb0
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x140004cc5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004cd2
mov rcx, rbx
call fcn.14000165c
mov eax, esi
jmp 0x14000536d
mov rsi, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
mov rdx, rsi
mov qword [rbp - 0x20], r14
call fcn.140011034
mov r14d, eax
test eax, eax
jns 0x140004d5f
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004d1a
test byte [rcx + 0x1c], r13b
je 0x140004d1a
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9d, eax
mov r8, r15
call fcn.14000391c
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004d28
call fcn.14000165c
test rsi, rsi
je 0x140004d35
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x140004d4a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004d57
mov rcx, rbx
call fcn.14000165c
mov eax, r14d
jmp 0x14000536d
mov r14, qword [rbp - 0x20]
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140004deb
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004da5
test byte [rcx + 0x1c], r13b
je 0x140004da5
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1a]
mov r9d, 0x8007007b
mov r8, r15
call fcn.14000391c
test r14, r14
je 0x140004db2
mov rcx, r14
call fcn.14000165c
test rsi, rsi
je 0x140004dbf
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x140004dd4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004de1
mov rcx, rbx
call fcn.14000165c
mov eax, 0x8007007b
jmp 0x14000536d
mov word [rax], dx
cmp dword [rbp + 0x48], edx
je 0x140004e44
mov byte [rbp + 0x58], dl
mov rcx, r14
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x18]
call fcn.140004174
mov r15, qword [rbp - 0x18]
xor edx, edx
test eax, eax
js 0x140004e2e
mov rcx, qword [0x14001be90]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
sete byte [rbp + 0x58]
test r15, r15
je 0x140004e3d
mov rcx, r15
call fcn.14000165c
xor edx, edx
mov al, dl
cmp byte [rbp + 0x58], dl
je 0x140004e47
mov al, r13b
mov rcx, qword [rbp + 0x60]
mov r15, rdx
mov byte [rbp + 0x58], al
mov qword [rbp + 0x60], rdx
mov byte [rcx], al
test al, al
jne 0x140004f63
mov al, byte [0x14001be50]
mov rcx, rsi
neg al
sbb edx, edx
and edx, 0x20
add edx, 4
call fcn.140011900
mov r15d, eax
test eax, eax
jns 0x140004eec
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004ea8
test byte [rcx + 0x1c], r13b
je 0x140004ea8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x1b
mov r9d, eax
call fcn.14000391c
test r14, r14
je 0x140004eb5
mov rcx, r14
call fcn.14000165c
test rsi, rsi
je 0x140004ec2
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x140004ed7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004ee4
mov rcx, rbx
call fcn.14000165c
mov eax, r15d
jmp 0x14000536d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x60]
call fcn.140003e24
xor edx, edx
mov r15d, eax
test eax, eax
jns 0x140004f5f
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004f2c
test byte [rcx + 0x1c], r13b
je 0x140004f2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x1c
mov r9d, eax
call fcn.14000391c
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x140004ea8
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
jmp 0x140004ea8
mov r15, qword [rbp + 0x60]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x18]
mov rdx, rsi
mov r8d, 0x1000
call fcn.14000fae0
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x14000502d
mov rcx, qword [0x14001b028]
cmp rcx, r12
je 0x140004fae
test byte [rcx + 0x1c], r13b
je 0x140004fae
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x1d
mov r9d, eax
call fcn.14000391c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140004fc3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004fe9
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
test r14, r14
je 0x140004ff6
mov rcx, r14
call fcn.14000165c
test rsi, rsi
je 0x140005003
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x140005018
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140005025
mov rcx, rbx
call fcn.14000165c
mov eax, dword [rbp + 0x60]
jmp 0x14000536d
mov r12, qword [rbp - 0x18]
lea r8, str.ServiceMainEx
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14000fe34
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x1400050bf
mov rcx, qword [0x14001b028]
lea rdx, [0x14001b028]
cmp rcx, rdx
je 0x14000507c
test byte [rcx + 0x1c], r13b
je 0x14000507c
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov r9d, eax
call fcn.14000391c
test r12, r12
je 0x140005090
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004fe9
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
jmp 0x140004fe9
lea r8, str.ServiceHandlerEx
mov rdx, r12
lea rcx, [rbp - 0x18]
call fcn.14000fe34
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x1400050fc
mov rcx, qword [0x14001b028]
lea rdx, [0x14001b028]
cmp rcx, rdx
je 0x14000507c
test byte [rcx + 0x1c], r13b
je 0x14000507c
mov edx, 0x1f
jmp 0x140005069
mov r13, qword [rbp + 0x50]
add r13, 8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x58], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor eax, eax
cmp byte [0x14001be50], al
mov ecx, eax
movzx eax, byte [rbp + 0x58]
setne cl
add eax, eax
or eax, ecx
mov rcx, qword [rbp + 0x50]
mov dword [rcx + 0x60], eax
movabs r10, 0xd9a82f985ed58970
mov rax, qword [rbp - 0x20]
mov rdx, rcx
xor ecx, ecx
call qword [0x140014c00]
mov dword [rbp + 0x58], eax
mov rcx, r13
mov rax, qword [rbp + 0x50]
and dword [rax + 0x60], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
mov rcx, r13
and qword [rax + 0x58], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14001b028]
lea r13, [0x14001b028]
cmp rcx, r13
je 0x1400051c7
test byte [rcx + 0x1c], 4
je 0x1400051c7
mov r9d, dword [rbp + 0x58]
lea r8, [0x140015af8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
call fcn.14000391c
test r12, r12
je 0x1400051db
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
nop dword [rax + rax]
mov rcx, rax
sub rcx, qword [0x14001be58]
cmp rcx, 0xea60
jbe 0x1400052cb
mov qword [0x14001be58], rax
xor eax, eax
mov dword [0x14001be54], eax
mov eax, dword [rbp + 0x58]
cmp eax, 4
jne 0x14000537f
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004a40
mov r12d, eax
test eax, eax
jns 0x140005309
mov rcx, qword [0x14001b028]
cmp rcx, r13
je 0x140005261
test byte [rcx + 0x1c], 1
je 0x140005261
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x22
mov r9d, eax
call fcn.14000391c
test r15, r15
je 0x140005287
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
test r14, r14
je 0x140005294
mov rcx, r14
call fcn.14000165c
test rsi, rsi
je 0x1400052a1
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x1400052b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x1400052c3
mov rcx, rbx
call fcn.14000165c
mov eax, r12d
jmp 0x14000536d
mov eax, dword [0x14001be54]
inc eax
mov dword [0x14001be54], eax
cmp eax, 5
jbe 0x14000520d
mov rcx, qword [0x14001b028]
cmp rcx, r13
je 0x140005309
test byte [rcx + 0x1c], 1
je 0x140005309
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov edx, 0x21
call fcn.140005984
test r15, r15
je 0x14000532f
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
test r14, r14
je 0x14000533c
mov rcx, r14
call fcn.14000165c
test rsi, rsi
je 0x140005349
mov rcx, rsi
call fcn.14000165c
cmp rdi, 0xffffffffffffffff
je 0x14000535e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000536b
mov rcx, rbx
call fcn.14000165c
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x1400053fb
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004a40
mov r12d, eax
test eax, eax
jns 0x140005309
mov rcx, qword [0x14001b028]
cmp rcx, r13
je 0x1400053cc
test byte [rcx + 0x1c], 1
je 0x1400053cc
mov edx, 0x23
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015af8]
mov r9d, r12d
call fcn.14000391c
test r15, r15
je 0x140005287
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140014c00]
jmp 0x140005287
cmp eax, 2
jne 0x140005309
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
xor ecx, ecx
call fcn.140004a40
mov r12d, eax
test eax, eax
jns 0x140005309
mov rcx, qword [0x14001b028]
cmp rcx, r13
je 0x1400053cc
test byte [rcx + 0x1c], 1
je 0x1400053cc
mov edx, 0x24
jmp 0x1400053b9