Function at 0x4a33ac
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4a3805
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4c67ec]
mov edx, dword [edx]
call fcn.00405a9c
mov edx, dword [ebp - 0xc]
mov eax, 0x4a3820
call fcn.004063b4
test eax, eax
setg byte [ebp - 6]
mov ebx, 0x80000001
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042efec
mov esi, eax
mov edx, 0x4a383c
mov eax, esi
call fcn.0042fae0
test al, al
je 0x4a342c
mov edx, 0x4a383c
xor ecx, ecx
mov eax, esi
call fcn.0042f130
lea ecx, [ebp - 4]
mov edx, 0x4a38c8
mov eax, esi
call fcn.0042f884
mov edx, 0x80000002
mov eax, esi
call fcn.0042f0c8
mov edx, 0x4a383c
mov eax, esi
call fcn.0042fae0
test al, al
je 0x4a346a
mov ebx, 0x80000002
mov edx, 0x4a383c
xor ecx, ecx
mov eax, esi
call fcn.0042f130
lea ecx, [ebp - 4]
mov edx, 0x4a38c8
mov eax, esi
call fcn.0042f884
mov eax, esi
call fcn.00403c94
cmp ebx, 0x80000002
jne 0x4a34a9
call fcn.004a4784
test al, al
jne 0x4a34a9
cmp byte [ebp - 6], 0
je 0x4a3496
mov dl, 1
mov eax, 0x4a38f4
call fcn.004a47f8
jmp 0x4a34a2
mov dl, 1
mov eax, 0x4a393c
call fcn.004a47f8
push 0
call sub.kernel32.dll_ExitProcess
mov byte [ebp - 5], 0
cmp byte [ebp - 6], 0
jne 0x4a358d
xor ecx, ecx
mov dl, 1
mov eax, dword [0x465404]
call fcn.00468148
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, 0x4a3974
call fcn.004a8854
mov edx, dword [ebp - 0x10]
lea eax, [edi + 0x38]
call fcn.004058f0
lea edx, [ebp - 0x14]
mov eax, 0x4a3990
call fcn.004a8854
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00468c40
lea edx, [ebp - 0x18]
mov eax, 0x4a39cc
call fcn.004a8854
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00468c00
lea edx, [ebp - 0x1c]
mov eax, 0x4a3a24
call fcn.004a8854
mov edx, dword [ebp - 0x1c]
lea eax, [edi + 0x8c]
call fcn.004058f0
mov eax, dword [0x49e3e4]
mov dword [edi + 0xdc], eax
mov dword [edi + 0xd8], 0x4a33a8
movzx edx, word [0x4a3a68]
mov eax, edi
call fcn.00468b00
movzx eax, byte [0x4a3a6c]
mov byte [edi + 0x3c], al
mov byte [edi + 0x48], 1
mov eax, edi
mov si, 0xffe1
call fcn.00403edc
test al, al
jne 0x4a356f
push 0
call sub.kernel32.dll_ExitProcess
cmp dword [edi + 0x70], 6
je 0x4a357c
push 0
call sub.kernel32.dll_ExitProcess
test byte [edi + 0x59], 1
setne al
mov byte [ebp - 5], al
mov eax, edi
call fcn.00403c94
cmp byte [ebp - 5], 0
je 0x4a35e1
push 0
push pe_nt_image_headers32
push 0x4a3a70
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyExW
push 0
push pe_nt_image_headers32
push 0x4a3a70
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyExW
mov cl, 1
mov edx, 0x4a3ab8
mov eax, 0x80000001
call fcn.0049e444
mov edx, 0x4a3ab8
mov cl, 1
mov eax, 0x80000002
call fcn.0049e444
call fcn.0049e15c
cmp ebx, 0x80000002
jne 0x4a3610
xor ecx, ecx
mov edx, 0x4a3af0
mov eax, 0x80000002
call fcn.0049ce30
xor ecx, ecx
mov edx, 0x4a3b78
mov eax, 0x80000002
call fcn.0049ce30
push 0
push pe_nt_image_headers32
push 0x4a3c04
push ebx
call sub.advapi32.dll_RegDeleteKeyExW
push 0
push pe_nt_image_headers32
push 0x4a3c90
push ebx
call sub.advapi32.dll_RegDeleteKeyExW
mov cl, 1
mov edx, 0x4a3d38
mov eax, ebx
call fcn.0049e444
mov edx, 0x4a3d38
xor ecx, ecx
mov eax, ebx
call fcn.0049e444
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov esi, eax
mov edx, ebx
mov eax, esi
call fcn.0042f0c8
mov edx, 0x4a3dc0
mov eax, esi
call fcn.0042f42c
mov eax, esi
call fcn.00403c94
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042efec
mov esi, eax
mov edx, 0x4a383c
mov eax, esi
call fcn.0042f42c
mov edx, 0x80000002
mov eax, esi
call fcn.0042f0c8
mov edx, 0x4a383c
mov eax, esi
call fcn.0042f42c
mov eax, esi
call fcn.00403c94
mov cl, 1
mov edx, 0x4a3ea0
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a3f28
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a3fb4
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4040
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a40cc
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4114
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4164
mov eax, ebx
call fcn.0049e444
mov edx, 0x4a4114
xor ecx, ecx
mov eax, ebx
call fcn.0049e444
mov edx, 0x4a4164
xor ecx, ecx
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a41b0
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4230
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a42bc
mov eax, ebx
call fcn.0049e444
push 0
push pe_nt_image_headers32
push 0x4a4338
push ebx
call sub.advapi32.dll_RegDeleteKeyExW
mov cl, 1
mov edx, 0x4a4428
mov eax, ebx
call fcn.0049e444
mov edx, 0x4a4428
xor ecx, ecx
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a44b4
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4528
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4588
mov eax, ebx
call fcn.0049e444
mov cl, 1
mov edx, 0x4a4624
mov eax, ebx
call fcn.0049e444
mov eax, dword [ebp - 4]
call fcn.004a314c
call fcn.0049e60c
push 0x7d0
call sub.kernel32.dll_Sleep
call fcn.0049ea40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a380c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004058e8
lea eax, [ebp - 4]
call fcn.004058e0
ret