Function at 0x14003e1a0
Capabilities:
Delete registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1403ddfb8]
xor rax, rbp
mov qword [rbp + 0x18], rax
xor ebx, ebx
mov dword [rbp + 0x10], 6
mov qword [rsp + 0x38], rbx
lea r8, str.SoftwareMcAfeePEFOEM
mov qword [rsp + 0x30], rbx
or r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
xor edx, edx
lea ecx, [rbx + 3]
mov qword [rbp + 8], rbx
mov esi, ebx
mov dword [rbp], ebx
mov r14d, ebx
mov dword [rbp + 4], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14003e218
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14003e21f
mov esi, eax
mov dword [rbp], eax
mov edi, ebx
test edi, edi
jne 0x14003e487
movsxd rdi, esi
mov rcx, rbx
lea rax, [rdi + 0x10]
cmp rax, rdi
cmova rcx, rax
test rcx, rcx
je 0x14003e482
lea rax, [rdi + 0x10]
mov rcx, rbx
cmp rax, rdi
movabs r15, 0xffffffffffffff0
cmova rcx, rax
lea rax, [rdi + 0x10]
cmp rcx, 0x400
mov rcx, rbx
ja 0x14003e29e
cmp rax, rdi
cmova rcx, rax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14003e27c
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.14026e690
sub rsp, rax
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x14003e482
mov dword [rsi], 0xcccc
jmp 0x14003e2b8
cmp rax, rdi
cmova rcx, rax
call fcn.14029de2c
mov rsi, rax
test rax, rax
je 0x14003e2bc
mov dword [rax], 0xdddd
add rsi, 0x10
test rsi, rsi
je 0x14003e482
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14028e7e0
lea r9, [rbp]
mov r8, rsi
lea rdx, str.SoftwareMcAfeePEFOEM
mov ecx, 3
call fcn.14003e4c0
mov edi, eax
test eax, eax
jne 0x14003e457
mov qword [rsp + 0x38], rbx
lea r8, str.silentinfactory
mov qword [rsp + 0x30], rbx
lea ecx, [rax + 3]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14003e32b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14003e333
mov r14d, eax
mov dword [rbp + 4], eax
mov edi, ebx
test edi, edi
jne 0x14003e457
movsxd rdi, r14d
mov rcx, rbx
lea rax, [rdi + 0x10]
cmp rax, rdi
cmova rcx, rax
test rcx, rcx
je 0x14003e452
lea rax, [rdi + 0x10]
mov rcx, rbx
cmp rax, rdi
cmova rcx, rax
lea rax, [rdi + 0x10]
cmp rcx, 0x400
ja 0x14003e3a5
cmp rax, rdi
cmova rbx, rax
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x14003e383
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.14026e690
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14003e452
mov dword [rbx], 0xcccc
jmp 0x14003e3c2
cmp rax, rdi
cmova rbx, rax
mov rcx, rbx
call fcn.14029de2c
mov rbx, rax
test rax, rax
je 0x14003e3c6
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x14003e452
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.14028e7e0
lea r9, [rbp + 4]
mov r8, rbx
lea rdx, str.silentinfactory
mov ecx, 3
call fcn.14003e4c0
mov edi, eax
test eax, eax
jne 0x14003e457
cmp dword [rbp + 0x10], 6
je 0x14003e416
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14003e40f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x10], 6
lea rax, [rbp + 8]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x10], eax
mov edi, eax
test eax, eax
jne 0x14003e457
mov rcx, qword [rbp + 8]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
jmp 0x14003e457
mov edi, recv
cmp dword [rsi - 0x10], 0xdddd
lea rcx, [rsi - 0x10]
jne 0x14003e469
call fcn.140290594
test rbx, rbx
je 0x14003e487
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x14003e487
call fcn.140290594
jmp 0x14003e487
mov edi, recv
cmp dword [rbp + 0x10], 6
je 0x14003e49c
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14003e49c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14026d870
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x20]
pop r15
pop r14
pop rbp
ret