Function at 0x49ee90
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5873a8
mov eax, dword fs:[0]
push eax
mov eax, 0x8490
call fcn.0056b140
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.00402270
mov dword [ebp - 0x825c], eax
lea eax, [ebp - 0x28]
push eax
push 0x2001f
push 0
push 0x59dc90
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49ef1b
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x8489], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060d0
mov al, byte [ebp - 0x8489]
jmp 0x49f256
mov dword [ebp - 0x20], 0
mov dx, word [0x59dd68]
mov word [ebp - 0x8244], dx
push 0x206
push 0
lea eax, [ebp - 0x8242]
push eax
call fcn.00568440
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x803c], 0
mov dword [ebp - 0x8248], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x8258], 0
mov dword [ebp - 0x8254], 0
mov dword [ebp - 0x8038], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x8264], 0x3fff
lea ecx, [ebp - 0x8250]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x8038]
push eax
lea ecx, [ebp - 0x8254]
push ecx
lea edx, [ebp - 0x8258]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8248]
push ecx
lea edx, [ebp - 0x803c]
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x8244]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x49f018
mov byte [ebp - 0x848a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060d0
mov al, byte [ebp - 0x848a]
jmp 0x49f256
cmp dword [ebp - 0x8258], 0
je 0x49f230
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
jmp 0x49f03e
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x8258]
jae 0x49f230
mov dword [ebp - 0x8264], 0x3fff
xor edx, edx
mov word [ebp - 0x8034], dx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8264]
push eax
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x49f22b
xor ecx, ecx
mov word [ebp - 0x8464], cx
push 0x1fc
push 0
lea edx, [ebp - 0x8462]
push edx
call fcn.00568440
add esp, 0xc
mov dword [ebp - 0x846c], 0xff
lea eax, [ebp - 0x846c]
push eax
lea ecx, [ebp - 0x8464]
push ecx
push 0x6256b0
push 0
lea edx, [ebp - 0x8034]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x8468], eax
cmp dword [ebp - 0x8468], 0
jne 0x49f20d
lea ecx, [ebp - 0x8464]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
jne 0x49f10e
mov dword [ebp - 0x8494], 0
jmp 0x49f172
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x49f133
mov dword [ebp - 0x8498], 0
jmp 0x49f166
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.00570840
mov dword [ebp - 0x849c], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x849c]
push eax
call fcn.004022d0
mov dword [ebp - 0x8498], eax
mov ecx, dword [ebp - 0x8498]
mov dword [ebp - 0x8494], ecx
mov edx, dword [ebp - 0x8494]
push edx
lea ecx, [ebp - 0x8488]
call fcn.00406050
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x8488]
call fcn.00418ae0
cmp eax, dword [0x60735c]
je 0x49f200
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x8468], eax
cmp dword [ebp - 0x8468], 0
je 0x49f1e8
mov byte [ebp - 0x848b], 0
lea ecx, [ebp - 0x8488]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060d0
mov al, byte [ebp - 0x848b]
jmp 0x49f256
mov eax, dword [ebp - 0x8258]
sub eax, 1
mov dword [ebp - 0x8258], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x8488]
call fcn.004060d0
jmp 0x49f22b
mov byte [ebp - 0x848c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060d0
mov al, byte [ebp - 0x848c]
jmp 0x49f256
jmp 0x49f035
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x848d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004060d0
mov al, byte [ebp - 0x848d]
lea esp, [ebp - 0x84a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret