Function at 0x4990e0
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d352b
mov eax, dword fs:[0]
push eax
mov eax, 0x2244
call fcn.0049d6f0
mov eax, dword [0x4fe0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
push ebx
mov dword [ebp - 4], 0
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a96
cmp word [ebx], 0x7d
je 0x499a83
nop dword [eax]
nop word [eax + eax]
push str.Delete
push ebx
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4e36a0
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4991a3
test edi, edi
je 0x4992a5
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
cmp dword [ebp + 0x10], 0
je 0x4992a5
movzx eax, word [ebx]
mov edx, ebx
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test ax, ax
je 0x499204
cmp ax, 0x5c
je 0x4991fc
push edx
call dword [sym.imp.USER32.dll_CharNextW]
mov edx, eax
movzx ecx, word [edx]
mov eax, ecx
test cx, cx
jne 0x4991e1
jmp 0x499204
test edx, edx
jne 0x499a6c
mov esi, 0x4d5614
nop dword [eax]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x49925e
add esi, 4
cmp esi, 0x4d5644
jl 0x499210
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2244]
push ebx
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], 0
call fcn.004989e0
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test edi, edi
je 0x49929b
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
push ebx
mov ecx, edi
call fcn.0049aa70
mov esi, eax
test esi, esi
js 0x499a83
mov dword [ebp - 0x2240], 0
jmp 0x4996c5
mov dword [ebp - 0x2240], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4992d5
mov ecx, dword [ebp - 0x2224]
xor edi, edi
push ebx
mov dword [ebp - 0x2234], edi
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
jmp 0x4992db
mov edi, dword [ebp - 0x2234]
push 0x4e3698
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x49942b
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
cmp word [ebx], 0x3d
jne 0x499a6c
cmp dword [ebp + 0x10], 0
je 0x4993ac
mov eax, dword [ebp - 0x2220]
mov edi, dword [ebp - 0x2224]
mov ecx, edi
mov dword [ebp - 0x2250], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2250]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
call fcn.00497120
mov esi, eax
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
test esi, esi
js 0x499a83
mov byte [ebp - 4], 0
mov dword [ebp - 0x224c], 0
jmp 0x4996c5
cmp dword [ebp + 0x14], 0
jne 0x499410
test edi, edi
je 0x499410
lea eax, [ebp - 0x2234]
mov dword [ebp - 0x2234], 0
push eax
push 0x20006
push 0
push 0
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x499a78
mov edi, dword [ebp - 0x2234]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x499405
cmp eax, 2
jne 0x499a54
test edi, edi
je 0x499410
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.0049aa70
mov esi, eax
test esi, esi
js 0x499a83
jmp 0x499a48
movzx ecx, word [ebx]
mov eax, ebx
test cx, cx
je 0x499458
mov edx, ecx
cmp dx, 0x5c
je 0x499450
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x499437
jmp 0x499458
test eax, eax
jne 0x499a6c
cmp dword [ebp + 0x10], 0
je 0x499720
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x4994c8
cmp dword [esi], 0
je 0x4994bb
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x499518
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4994c1
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x4994e3
cmp dword [esi + 4], 0
jne 0x4994c8
mov eax, 1
jmp 0x4994e3
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x499518
mov ecx, dword [ebp - 0x2230]
test ecx, ecx
je 0x4994f8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
je 0x49968c
jmp 0x49951e
mov edi, dword [ebp - 0x2230]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x49957e
cmp dword [esi], 0
je 0x499571
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4995c6
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x499577
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x499599
cmp dword [esi + 4], 0
jne 0x49957e
mov eax, 1
jmp 0x499599
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4995c6
test edi, edi
je 0x4995a8
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
je 0x49968c
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x499633
cmp dword [esi], 0
je 0x499626
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x499a73
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49962c
push 0
push dword [esi]
lea ecx, [ebp - 0x2238]
push ecx
lea ecx, [ebp - 0x221c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x49965b
cmp dword [esi + 4], 0
jne 0x499633
mov eax, 1
jmp 0x49965b
lea eax, [ebp - 0x2238]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x499a78
test edi, edi
je 0x49966e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x499a78
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
cmp word [ebx], 0x3d
jne 0x4996c5
push ebx
push 0
lea eax, [ebp - 0x2230]
mov ecx, edi
push eax
call fcn.00497120
mov esi, eax
test esi, esi
js 0x499a83
cmp word [ebx], 0x7b
jne 0x499a48
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4996d4
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x499a48
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x2230]
push ebx
call fcn.004990e0
mov esi, eax
test esi, esi
js 0x499a83
push ebx
mov ecx, edi
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
jmp 0x499a48
cmp dword [ebp + 0x14], 0
jne 0x4997e0
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x499794
cmp dword [esi], 0
je 0x499787
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49975a
lea edi, [eax + 1]
jmp 0x4997e5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49978d
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x4997af
cmp dword [esi + 4], 0
jne 0x499794
mov edi, 1
jmp 0x4997b1
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4997e5
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x4997c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], 0
jmp 0x4997e5
mov edi, 2
test edi, edi
mov eax, 1
push 0xffffffffffffffff
cmove eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004a6b78
push eax
call fcn.00404610
mov ecx, dword [ebp - 0x2224]
add esp, 0x14
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.0049aa70
mov esi, eax
test esi, esi
js 0x499a83
cmp word [ebx], 0x7b
jne 0x4998a7
mov ecx, ebx
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x499850
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x4998a7
push dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2224]
push 0
push dword [ebp - 0x2230]
push ebx
call fcn.004990e0
mov esi, eax
test esi, esi
jns 0x499891
cmp dword [ebp - 0x221c], 0
je 0x499a83
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00498300
mov esi, eax
test esi, esi
js 0x499a83
cmp edi, 2
je 0x499a48
test edi, edi
je 0x4998c4
cmp dword [ebp + 0x14], 0
jne 0x499a48
push edi
jmp 0x499a79
cmp dword [ebp + 0x14], 0
je 0x499956
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x499956
cmp dword [ebp - 0x221c], eax
jbe 0x499956
mov edi, 0x4d5614
push dword [edi]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x499a48
add edi, 4
cmp edi, 0x4d5644
jl 0x499910
cmp dword [ebp - 0x2234], 0
je 0x499a48
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.004989e0
jmp 0x499a48
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x49998f
xor edi, edi
jmp 0x49999b
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb edi, edi
neg edi
mov ecx, dword [ebp - 0x2230]
xor eax, eax
test ecx, ecx
je 0x4999b6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x499a78
cmp dword [ebp - 0x2234], eax
je 0x499a48
test edi, edi
jne 0x499a48
cmp byte [0x513580], al
jne 0x499a13
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x499a05
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x513584], eax
mov byte [0x513580], 1
jmp 0x499a18
mov eax, dword [0x513584]
mov byte [0x513580], 1
jmp 0x499a18
mov eax, dword [0x513584]
test eax, eax
je 0x499a31
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x2220]
call eax
jmp 0x499a44
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x499a78
cmp word [ebx], 0x7d
jne 0x499170
jmp 0x499a83
push eax
call fcn.0048b400
add esp, 4
mov esi, eax
test edi, edi
je 0x499a83
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x499a83
mov esi, 0x80020009
jmp 0x499a83
mov eax, 1
push eax
call fcn.0048b400
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x499a94
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049d3dd
mov esp, ebp
pop ebp
ret 0x10