Function at 0x4b7960
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f5b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov ebp, ecx
cmp byte [0x103a972], 0
je 0x4b79b3
cmp byte [ebp + 0x324dd], 0
je 0x4b7c00
push 0
lea ecx, [esp + 0x2c]
call fcn.00456910
mov dword [esp + 0x448], 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x448], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x448], 2
mov edi, dword [sym.imp.mfc90.dll_Ordinal_2539]
lea eax, [esp + 0x18]
push str.tc_FileD
push eax
call edi
mov esi, dword [esp + 0x458]
push esi
lea ecx, [esp + 0x20]
push 0x4ff1b8
push ecx
call edi
add esp, 0x10
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x5116d8
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x44c], 3
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x450], 4
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x454], 5
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x458], 2
lea ecx, [esp + 0x38]
call fcn.00457a60
mov bl, 6
mov byte [esp + 0x448], bl
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x44c], 7
mov edi, dword [esp + 0x458]
push esi
push edi
mov byte [esp + 0x454], bl
mov ecx, ebp
call fcn.004a8800
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x44c], 8
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x450], 9
mov byte [esp + 0x450], bl
lea ecx, [esp + 0x30]
call fcn.00457e80
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.tc_Last
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x44c], 0xa
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.TC_Env
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x450], 0xb
mov byte [esp + 0x450], bl
lea ecx, [esp + 0x30]
call fcn.00457e80
push 0x3ff
lea eax, [esp + 0x41]
push 0
push eax
mov byte [esp + 0x48], 0
call sub.MSVCR90.dll_memset
mov edx, dword [esp + 0x20]
push 0x400
lea ecx, [esp + 0x4c]
push ecx
push edx
push str.SoftWareTrojanCut_tc_FileD
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x20
cmp eax, 0xffffffff
je 0x4b7bb6
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x44c], 0xc
push esi
push edi
mov byte [esp + 0x454], bl
mov ecx, ebp
call fcn.004a8800
mov ecx, dword [esp + 0x14]
push ecx
push str.SoftWareTrojanCut_tc_FileD
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov byte [esp + 0x448], 2
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x448], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x448], 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x448], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.00456840
xor eax, eax
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004e0148
add esp, 0x438
ret 8