Function at 0x140004790
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov edi, ecx
mov byte [r9], r14b
test r8b, r8b
je 0x1400047f1
mov ebx, 0x3e8
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoFreeUnusedLibrariesEx]
nop dword [rax + rax]
mov edx, edi
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.140003fc8
mov ebx, eax
test eax, eax
jns 0x14000484c
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004837
test byte [rcx + 0x1c], 1
je 0x140004837
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x15
mov r9d, eax
call fcn.1400036c4
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004845
call fcn.14000166c
mov eax, ebx
jmp 0x1400050bd
lea r12, [0x14001a028]
mov r13d, 1
cmp edi, 2
jne 0x140004910
mov r8d, 0x20006
mov qword [rbp - 0x18], r14
lea rdx, str.SOFTWAREMicrosoftWindows_Security_HealthPlatform
lea rcx, [rbp - 0x18]
call fcn.14000749c
mov rbx, qword [rbp - 0x18]
test eax, eax
js 0x1400048f5
lea rdx, str.NewLocation
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jle 0x1400048ac
movzx r8d, ax
or r8d, 0x80070000
mov ecx, 0x80000000
lea eax, [r8 + rcx]
test ecx, eax
jne 0x1400048f5
cmp r8d, 0x80070002
je 0x1400048f5
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x1400048fc
test byte [rcx + 0x1c], r13b
je 0x1400048fc
mov rcx, qword [rcx + 0x10]
lea r9, str.NewLocation
mov dword [rsp + 0x20], r8d
mov edx, 0x1d
lea r8, [0x140015120]
call fcn.1400072bc
mov rcx, qword [0x14001a028]
test rbx, rbx
je 0x140004917
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x14001a028]
mov rbx, qword [rbp - 0x20]
lea r15, [0x140014a88]
cmp rcx, r12
je 0x140004946
test byte [rcx + 0x1c], 4
je 0x140004946
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9d, edi
mov qword [rsp + 0x20], rbx
mov r8, r15
call fcn.140005768
or qword [rbp - 0x20], 0xffffffffffffffff
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov dword [rsp + 0x28], r14d
call fcn.14000efdc
mov edi, eax
test eax, eax
jns 0x1400049b2
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004988
test byte [rcx + 0x1c], r13b
je 0x140004988
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9d, eax
mov r8, r15
call fcn.1400036c4
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x14000499e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x1400049ab
mov rcx, rbx
call fcn.14000166c
mov eax, edi
jmp 0x1400050bd
mov rdi, qword [rbp - 0x20]
lea rcx, [rbp - 0x18]
mov rdx, rdi
mov qword [rbp - 0x18], r14
call fcn.1400061d4
mov esi, eax
test eax, eax
jns 0x140004a29
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x1400049f2
test byte [rcx + 0x1c], r13b
je 0x1400049f2
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9d, eax
mov r8, r15
call fcn.1400036c4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140004a00
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140004a15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004a22
mov rcx, rbx
call fcn.14000166c
mov eax, esi
jmp 0x1400050bd
mov rsi, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
mov rdx, rsi
mov qword [rbp - 0x20], r14
call fcn.140010840
mov r14d, eax
test eax, eax
jns 0x140004aaf
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004a6a
test byte [rcx + 0x1c], r13b
je 0x140004a6a
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9d, eax
mov r8, r15
call fcn.1400036c4
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004a78
call fcn.14000166c
test rsi, rsi
je 0x140004a85
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140004a9a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004aa7
mov rcx, rbx
call fcn.14000166c
mov eax, r14d
jmp 0x1400050bd
mov r14, qword [rbp - 0x20]
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140004b3b
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004af5
test byte [rcx + 0x1c], r13b
je 0x140004af5
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1a]
mov r9d, 0x8007007b
mov r8, r15
call fcn.1400036c4
test r14, r14
je 0x140004b02
mov rcx, r14
call fcn.14000166c
test rsi, rsi
je 0x140004b0f
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140004b24
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004b31
mov rcx, rbx
call fcn.14000166c
mov eax, 0x8007007b
jmp 0x1400050bd
mov word [rax], dx
cmp dword [rbp + 0x48], edx
je 0x140004b94
mov byte [rbp + 0x58], dl
mov rcx, r14
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x18]
call fcn.140003f24
mov r15, qword [rbp - 0x18]
xor edx, edx
test eax, eax
js 0x140004b7e
mov rcx, qword [0x14001ae70]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
sete byte [rbp + 0x58]
test r15, r15
je 0x140004b8d
mov rcx, r15
call fcn.14000166c
xor edx, edx
mov al, dl
cmp byte [rbp + 0x58], dl
je 0x140004b97
mov al, r13b
mov rcx, qword [rbp + 0x60]
mov r15, rdx
mov byte [rbp + 0x58], al
mov qword [rbp + 0x60], rdx
mov byte [rcx], al
test al, al
jne 0x140004cb3
mov al, byte [0x14001ae28]
mov rcx, rsi
neg al
sbb edx, edx
and edx, 0x20
add edx, 4
call fcn.140011100
mov r15d, eax
test eax, eax
jns 0x140004c3c
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004bf8
test byte [rcx + 0x1c], r13b
je 0x140004bf8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x1b
mov r9d, eax
call fcn.1400036c4
test r14, r14
je 0x140004c05
mov rcx, r14
call fcn.14000166c
test rsi, rsi
je 0x140004c12
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140004c27
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004c34
mov rcx, rbx
call fcn.14000166c
mov eax, r15d
jmp 0x1400050bd
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x60]
call fcn.140003bcc
xor edx, edx
mov r15d, eax
test eax, eax
jns 0x140004caf
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004c7c
test byte [rcx + 0x1c], r13b
je 0x140004c7c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x1c
mov r9d, eax
call fcn.1400036c4
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x140004bf8
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004bf8
mov r15, qword [rbp + 0x60]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x18]
mov rdx, rsi
mov r8d, 0x1000
call fcn.14000f2c0
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004d7d
mov rcx, qword [0x14001a028]
cmp rcx, r12
je 0x140004cfe
test byte [rcx + 0x1c], r13b
je 0x140004cfe
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x1d
mov r9d, eax
call fcn.1400036c4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140004d13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004d39
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x140004d46
mov rcx, r14
call fcn.14000166c
test rsi, rsi
je 0x140004d53
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140004d68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140004d75
mov rcx, rbx
call fcn.14000166c
mov eax, dword [rbp + 0x60]
jmp 0x1400050bd
mov r12, qword [rbp - 0x18]
lea r8, str.ServiceMainEx
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14000f614
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004e0f
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004dcc
test byte [rcx + 0x1c], r13b
je 0x140004dcc
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov r9d, eax
call fcn.1400036c4
test r12, r12
je 0x140004de0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test r15, r15
je 0x140004d39
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004d39
lea r8, str.ServiceHandlerEx
mov rdx, r12
lea rcx, [rbp - 0x18]
call fcn.14000f614
mov dword [rbp + 0x60], eax
test eax, eax
jns 0x140004e4c
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x140004dcc
test byte [rcx + 0x1c], r13b
je 0x140004dcc
mov edx, 0x1f
jmp 0x140004db9
mov r13, qword [rbp + 0x50]
add r13, 8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x58], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor eax, eax
cmp byte [0x14001ae28], al
mov ecx, eax
movzx eax, byte [rbp + 0x58]
setne cl
add eax, eax
or eax, ecx
mov rcx, qword [rbp + 0x50]
mov dword [rcx + 0x60], eax
movabs r10, 0xd9a82f985ed58970
mov rax, qword [rbp - 0x20]
mov rdx, rcx
xor ecx, ecx
call qword [0x140013c50]
mov dword [rbp + 0x58], eax
mov rcx, r13
mov rax, qword [rbp + 0x50]
and dword [rax + 0x60], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp + 0x50]
mov rcx, r13
and qword [rax + 0x58], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14001a028]
lea r13, [0x14001a028]
cmp rcx, r13
je 0x140004f17
test byte [rcx + 0x1c], 4
je 0x140004f17
mov r9d, dword [rbp + 0x58]
lea r8, [0x140014a88]
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
call fcn.1400036c4
test r12, r12
je 0x140004f2b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
nop dword [rax + rax]
mov rcx, rax
sub rcx, qword [0x14001ae30]
cmp rcx, 0xea60
jbe 0x14000501b
mov qword [0x14001ae30], rax
xor eax, eax
mov dword [0x14001ae2c], eax
mov eax, dword [rbp + 0x58]
cmp eax, 4
jne 0x1400050cf
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004790
mov r12d, eax
test eax, eax
jns 0x140005059
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x140004fb1
test byte [rcx + 0x1c], 1
je 0x140004fb1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x22
mov r9d, eax
call fcn.1400036c4
test r15, r15
je 0x140004fd7
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x140004fe4
mov rcx, r14
call fcn.14000166c
test rsi, rsi
je 0x140004ff1
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x140005006
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x140005013
mov rcx, rbx
call fcn.14000166c
mov eax, r12d
jmp 0x1400050bd
mov eax, dword [0x14001ae2c]
inc eax
mov dword [0x14001ae2c], eax
cmp eax, 5
jbe 0x140004f5d
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x140005059
test byte [rcx + 0x1c], 1
je 0x140005059
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov edx, 0x21
call fcn.1400056d4
test r15, r15
je 0x14000507f
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
test r14, r14
je 0x14000508c
mov rcx, r14
call fcn.14000166c
test rsi, rsi
je 0x140005099
mov rcx, rsi
call fcn.14000166c
cmp rdi, 0xffffffffffffffff
je 0x1400050ae
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x1400050bb
mov rcx, rbx
call fcn.14000166c
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x14000514b
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
lea ecx, [rax - 2]
call fcn.140004790
mov r12d, eax
test eax, eax
jns 0x140005059
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x14000511c
test byte [rcx + 0x1c], 1
je 0x14000511c
mov edx, 0x23
mov rcx, qword [rcx + 0x10]
lea r8, [0x140014a88]
mov r9d, r12d
call fcn.1400036c4
test r15, r15
je 0x140004fd7
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov rax, qword [rcx]
movabs r10, 0xaffc1f65705f9070
mov rax, qword [rax + 8]
call qword [0x140013c50]
jmp 0x140004fd7
cmp eax, 2
jne 0x140005059
mov rdx, qword [rbp + 0x50]
lea r9, [rbp - 0x28]
mov r8b, 1
xor ecx, ecx
call fcn.140004790
mov r12d, eax
test eax, eax
jns 0x140005059
mov rcx, qword [0x14001a028]
cmp rcx, r13
je 0x14000511c
test byte [rcx + 0x1c], 1
je 0x14000511c
mov edx, 0x24
jmp 0x140005109