Function at 0x4cfa60
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a255
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x2f
push str.HKLMSYSTEMCurrentControlSet_servicesmfencbdc
push dword [edi + 0x2c]
mov dword [ebp - 0x50], edi
push ecx
lea ecx, [edi + 0x1c]
call fcn.00485920
test eax, eax
je 0x4cfda7
push 0x2e
push str.HKLMSYSTEMCurrentControlSet_servicesmfencrk
push dword [edi + 0x2c]
push ecx
lea ecx, [edi + 0x1c]
call fcn.00485920
test eax, eax
je 0x4cfda7
push 0x2e
push str.HKLMSYSTEMCurrentControlSet_servicesmfehidk
push dword [edi + 0x2c]
push ecx
lea ecx, [edi + 0x1c]
call fcn.00485920
test eax, eax
je 0x4cfda7
xor eax, eax
mov dword [ebp - 0x4c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 7
push eax
lea edx, [ebp - 0x4c]
lea ecx, [edi + 0x1c]
call fcn.004f6dd0
mov esi, eax
add esp, 4
mov dword [ebp - 0x48], esi
test esi, esi
jne 0x4cfc5e
push 6
push ecx
call fcn.004a1320
add esp, 4
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4cfc14
sub esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe8]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe8]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x1fc
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Deleting_Registry_Key
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.0047abe0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 0x10
jb 0x4cfbe0
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp - 0x2c]
call fcn.0047abe0
lea ecx, [ebp - 0xe8]
call fcn.00479050
jmp 0x4cfc0d
mov dword [ebp - 4], 7
lea ecx, [edi + 0x4c]
mov edx, str.false
call fcn.004a0a20
test al, al
mov eax, dword [ebp - 0x44]
je 0x4cfc3f
cmp dword [ebp - 0x30], 8
jae 0x4cfc31
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
jmp 0x4cfc5b
cmp dword [ebp - 0x30], 8
jae 0x4cfc48
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea esi, [eax - 5]
neg esi
sbb esi, esi
and esi, eax
mov dword [ebp - 0x48], esi
call fcn.004a1320
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x4cfc79
cmp byte [ecx + 0x19], 6
jb 0x4cfc79
mov cl, 1
jmp 0x4cfc7b
xor cl, cl
cmp byte [eax], 0
jne 0x4cfc8e
cmp byte [eax + 1], 0
jne 0x4cfc8e
test cl, cl
je 0x4cfd8a
sub esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe8]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe8]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x231
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Deleted_RegKey
mov ecx, eax
call fcn.0047f0b0
lea edx, [edi + 0x1c]
mov ecx, eax
call fcn.004a1750
mov edx, str.._status_is
mov ecx, eax
call fcn.0047f0b0
push esi
mov ecx, eax
call fcn.0047b2d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.0047abe0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b620
mov edi, eax
mov byte [ebp - 4], 0x10
cmp dword [edi + 0x14], 0x10
jb 0x4cfd40
mov edi, dword [edi]
call fcn.004a1320
push edi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp - 0x2c]
call fcn.0047abe0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xd
call fcn.0047b5a0
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4cfd8a
cmp dword [ebp - 0x30], 8
jb 0x4cfda0
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4cfda0
push eax
call fcn.00507b54
add esp, 4
mov eax, esi
jmp 0x4cff30
mov eax, dword [0x59f554]
test al, 1
jne 0x4cfdd8
or eax, 1
mov dword [0x59f554], eax
mov dword [ebp - 4], 0
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4cfded
cmp byte [eax + 0x19], 6
jb 0x4cfded
mov al, 1
jmp 0x4cfdef
xor al, al
cmp byte [0x59f560], 0
jne 0x4cfe09
cmp byte [0x59f561], 0
jne 0x4cfe09
test al, al
je 0x4cff2e
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xe8]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe8]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x1f3
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Deliberately_NOT_deleting_Registry_Key
mov ecx, eax
call fcn.0047f0b0
lea edx, [edi + 0x1c]
mov ecx, eax
call fcn.004a1750
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x4cfe9b
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4cfe9b
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x4cfeb8
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x4cfee3
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 5
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 4
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x4cff06
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4cff06
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.0047b5a0
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005072fd
mov esp, ebp
pop ebp
ret