Function at 0x444dc0
Capabilities:
Delete registry key
Delete registry value
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4bb958
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x47e0
push 0
push 0x4e02a8
call fcn.004906c0
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
add esp, 0xc
mov dword [0x4e02b0], 1
push 0x60
push dword [0x4dfbf0]
push 0x32
call ebx
push 0x60
push dword [0x4dfbf0]
mov dword [0x4e02c8], eax
push 0x28a
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e02d0], eax
push 0x64
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e02c4], eax
push 0x384
call ebx
push 0x60
push dword [0x4dfbf0]
mov dword [0x4e02cc], eax
push 0x96
mov dword [0x4e02a8], 0x2c
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e02f4], eax
push 0x96
call ebx
push 0x60
push dword [0x4dfbf0]
mov dword [0x4e02f0], eax
push 0x28
mov dword [0x4e02d4], 0x2c
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e0320], eax
push 0x28
call ebx
push 0x60
push dword [0x4dfbf0]
mov dword [0x4e031c], eax
push 0x28
mov dword [0x4e0300], 0x2c
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e034c], eax
push 0x28
call ebx
push 0x60
push dword [0x4dfbf0]
mov dword [0x4e0348], eax
push 0x28
mov dword [0x4e032c], 0x2c
call ebx
push 0x60
push dword [0x4dfbec]
mov dword [0x4e0378], eax
push 0x28
call ebx
mov dword [0x4e0374], eax
mov dword [0x4e0358], 0x2c
mov dword [0x4e4a24], 0xffffffff
mov dword [0x4e4a30], 0xffffffff
mov dword [0x4e4a3c], 0xffffffff
mov dword [0x4e4a48], 0xffffffff
xor esi, esi
mov dword [0x4e4a54], 0xffffffff
mov dword [0x4e4a60], 0xffffffff
mov dword [0x4e4a6c], 0xffffffff
mov dword [0x4e4a78], 0xffffffff
mov dword [0x4e0634], 6
movzx eax, word [esi*4 + 0x4d87c0]
push 0x60
push dword [0x4dfbec]
mov dword [ebp + esi*4 - 0x5d4], eax
mov dword [esi*4 + 0x4e06f8], eax
movzx eax, word [esi*4 + 0x4d87c2]
push eax
call ebx
mov word [esi*2 + 0x4e0638], ax
inc esi
cmp esi, dword [0x4e0634]
jl 0x444f70
mov dword [0x4e0884], 2
xor esi, esi
jmp 0x444fc0
movzx eax, word [esi*4 + 0x4d87d8]
push 0x60
push dword [0x4dfbec]
mov dword [esi*4 + 0x4e0994], eax
movzx eax, word [esi*4 + 0x4d87da]
push eax
call ebx
mov word [esi*2 + 0x4e0888], ax
inc esi
cmp esi, dword [0x4e0884]
jl 0x444fc0
mov dword [0x4e0950], 4
xor esi, esi
nop
movzx eax, word [esi*4 + 0x4d87e0]
push 0x60
push dword [0x4dfbec]
mov dword [esi*4 + 0x4e08c8], eax
movzx eax, word [esi*4 + 0x4d87e2]
push eax
call ebx
mov word [esi*2 + 0x4e0954], ax
inc esi
cmp esi, dword [0x4e0950]
jl 0x445000
lea eax, [ebp - 0x60]
push eax
push 0x5c
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x48
push dword [0x4dfbf0]
mov dword [ebp - 0x50], 0x190
push 8
call ebx
neg eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], eax
lea esi, [ebp - 0x60]
mov ecx, 0x17
mov edi, 0x4e03b0
rep movsd dword es:[edi], dword [esi]
push 0x4bb9b0
call fcn.0048faa4
add esp, 4
mov dword [ebp - 0x768], eax
lea ecx, [ebp - 0x768]
push 0x4d8bb8
call fcn.00433cc0
mov eax, dword [0x4e03b0]
test eax, eax
jle 0x4450b4
push 0x48
push dword [0x4dfbf0]
push eax
call ebx
neg eax
mov dword [0x4e03b0], eax
lea eax, [ebp - 0x75c]
push eax
push 0x4bb9b0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4452b0
lea eax, [ebp - 0x760]
mov dword [ebp - 0x760], 0x6f8
push eax
lea eax, [ebp - 0x758]
push eax
push 0
push 0
push 0x4bba00
push dword [ebp - 0x75c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4452b0
mov eax, dword [ebp - 0x758]
add eax, 0xfffffe0b
cmp eax, 0x140
ja 0x4452b0
mov edx, dword [ebp - 0x5d8]
xor eax, eax
mov esi, 0x7d0
test edx, edx
jle 0x44519a
nop
movzx ecx, word [ebp + eax*2 - 0x6c0]
test cx, cx
je 0x44515c
cmp cx, si
ja 0x44515c
mov ecx, dword [ebp + eax*4 - 0x184]
test ecx, ecx
jle 0x44515c
cmp ecx, 0xa028
jg 0x44515c
inc eax
cmp eax, edx
jl 0x445130
jmp 0x44519a
xor eax, eax
mov edi, edi
movzx ecx, word [ebp + eax*2 - 0x6c0]
test cx, cx
je 0x4452b0
cmp cx, si
ja 0x4452b0
mov ecx, dword [ebp + eax*4 - 0x5d4]
test ecx, ecx
jle 0x4452b0
cmp ecx, 0xa028
jg 0x4452b0
inc eax
cmp eax, edx
jl 0x445160
mov edx, dword [ebp - 0x554]
xor eax, eax
test edx, edx
jle 0x4451ea
jmp 0x4451b0
movzx ecx, word [ebp + eax*2 - 0x640]
test cx, cx
je 0x4452b0
cmp cx, si
ja 0x4452b0
mov ecx, dword [ebp + eax*4 - 0x550]
test ecx, ecx
jle 0x4452b0
cmp ecx, 0xa028
jg 0x4452b0
inc eax
cmp eax, edx
jl 0x4451b0
mov edx, dword [ebp - 0x4d0]
xor eax, eax
test edx, edx
jle 0x445236
jmp 0x445200
movzx ecx, word [ebp + eax*2 - 0x680]
test cx, cx
je 0x4452b0
cmp cx, si
ja 0x4452b0
mov ecx, dword [ebp + eax*4 - 0x4cc]
test ecx, ecx
jle 0x4452b0
cmp ecx, 0xa028
jg 0x4452b0
inc eax
cmp eax, edx
jl 0x445200
push dword [ebp - 0x760]
lea eax, [ebp - 0x758]
push eax
push 0x4e02a8
call fcn.00440ab0
add esp, 0xc
push 0x4bba00
push dword [ebp - 0x75c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x75c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4e45d4]
mov ecx, 0x64
test eax, eax
cmove eax, ecx
mov ecx, 0xffd0d0
mov dword [0x4e45d4], eax
mov eax, dword [0x4e49f8]
test eax, eax
cmove eax, ecx
cmp dword [0x4e06f8], 0
mov dword [0x4e49f8], eax
jne 0x4452b0
mov ecx, 0x20
lea esi, [ebp - 0x5d4]
mov edi, 0x4e06f8
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [0x4e0634], edi
jle 0x44530a
mov ebx, 0x4e0638
mov esi, 0x4e06f8
cmp dword [esi], 3
jne 0x4452fb
mov eax, dword [0x4e0634]
dec eax
mov dword [0x4e0634], eax
sub eax, edi
shl eax, 2
push eax
lea eax, [esi + 4]
push eax
push esi
call fcn.00490070
mov eax, dword [0x4e0634]
sub eax, edi
add eax, eax
push eax
lea eax, [ebx + 2]
push eax
push ebx
call fcn.00490070
add esp, 0x18
inc edi
add esi, 4
add ebx, 2
cmp edi, dword [0x4e0634]
jl 0x4452c4
xor esi, esi
or edi, 0xffffffff
cmp dword [0x4e0634], esi
jle 0x445387
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ecx]
cmp dword [esi*4 + 0x4e06f8], 4
jne 0x445337
cmp byte [0x4e45d2], 0
mov edi, esi
jne 0x445382
jmp 0x445379
call fcn.004529e0
test al, al
jne 0x445379
cmp byte [0x4e45d2], al
jne 0x445379
mov eax, dword [esi*4 + 0x4e06f8]
cmp eax, 0x649
jl 0x445379
cmp eax, 0x664
jg 0x445379
push 0x30
push 0x4b0220
push 0x4bba18
push 0
mov byte [0x4e45d2], 1
call ebx
cmp edi, 0xffffffff
jne 0x4453a5
inc esi
cmp esi, dword [0x4e0634]
jl 0x445320
cmp edi, 0xffffffff
jne 0x4453a5
mov dword [esi*4 + 0x4e06f8], 4
mov eax, 0xc8
mov word [esi*2 + 0x4e0638], ax
inc dword [0x4e0634]
xor esi, esi
cmp dword [0x4e0a1c], esi
jle 0x4453cf
mov edi, 0x4e0a20
push edi
push esi
push 0
call fcn.00442a40
inc esi
add esp, 0xc
add edi, 0x5f4
cmp esi, dword [0x4e0a1c]
jl 0x4453b4
cmp word [0x4e47ee], 0
jne 0x4453ee
push 0x104
push 0x4e47ee
push 0x4bbaac
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x4e03b0
call ebx
mov dword [0x4e0298], eax
lea edi, [ebp - 0x60]
lea eax, [ebp - 0x60]
mov ecx, 0x17
mov esi, 0x4e03b0
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 0x4b], 1
call ebx
push dword [ebp - 0x768]
mov dword [0x4e029c], eax
call fcn.0048faf7
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret