Function at 0x49d269
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c3a97
mov eax, dword fs:[0]
push eax
mov eax, 0x2264
call fcn.004333d8
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x221c], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2230], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2268], ecx
mov dword [ebp - 0x222c], ebx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
jmp 0x49d6d4
push 0x49d9dc
push edi
mov dword [ebp - 0x2220], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x49d9ec
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x49d308
test ebx, ebx
je 0x49d3e1
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
cmp dword [ebp + 0x10], 0
je 0x49d3e1
xor eax, eax
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
mov byte [ebp - 4], 1
mov ecx, edi
push 0x5c
pop edx
call fcn.0049c732
test eax, eax
jne 0x49d910
push edi
call fcn.0049cdf8
test eax, eax
je 0x49d398
mov eax, dword [ebp - 0x2230]
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], eax
xor eax, eax
push edi
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
call fcn.0049cece
xor eax, eax
mov dword [ebp - 0x2240], eax
mov dword [ebp - 0x223c], eax
mov dword [ebp - 0x2238], eax
jmp 0x49d39a
xor eax, eax
test ebx, ebx
je 0x49d3d8
mov ebx, dword [ebp - 0x221c]
mov ecx, ebx
push edi
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d903
push edi
mov ecx, ebx
call fcn.0049cd93
mov esi, eax
xor eax, eax
test esi, esi
js 0x49d905
mov byte [ebp - 4], al
mov dword [ebp - 0x223c], eax
jmp 0x49d687
mov byte [ebp - 4], al
mov dword [ebp - 0x223c], eax
push 0x49da04
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x221c]
test eax, eax
jne 0x49d40f
push edi
mov ecx, ebx
mov dword [ebp - 0x2220], eax
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
push 0x49da18
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x49d577
lea eax, [ebp - 0x2218]
mov ecx, ebx
push eax
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
push edi
mov ecx, ebx
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
push 0x3d
pop eax
cmp word [edi], ax
jne 0x49d91b
cmp dword [ebp + 0x10], 0
je 0x49d4d1
xor ecx, ecx
mov dword [ebp - 0x2258], ecx
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2230]
mov dword [ebp - 0x2258], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2258]
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
mov ecx, ebx
push eax
call fcn.0049c96a
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
mov dword [ebp - 0x2250], eax
test esi, esi
js 0x49d943
mov byte [ebp - 4], al
mov dword [ebp - 0x2254], eax
jmp 0x49d687
cmp dword [ebp + 0x14], 0
jne 0x49d560
cmp dword [ebp - 0x2220], 0
je 0x49d560
xor ebx, ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
mov dword [ebp - 0x2244], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x224c]
push 0x20006
push ebx
push dword [ebp - 0x2230]
call fcn.00437bb7
test eax, eax
jne 0x49d96f
mov ebx, dword [ebp - 0x224c]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x49d53c
cmp eax, 2
jne 0x49d94e
xor eax, eax
mov byte [ebp - 4], al
test ebx, ebx
je 0x49d554
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x224c], eax
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2248], eax
push edi
mov ecx, ebx
call fcn.0049cd93
mov esi, eax
test esi, esi
jns 0x49d8f6
jmp 0x49d920
push 0x5c
pop edx
mov ecx, edi
call fcn.0049c732
test eax, eax
jne 0x49d91b
cmp dword [ebp + 0x10], eax
je 0x49d6df
mov esi, dword [ebp - 0x2230]
lea ecx, [ebp - 0x222c]
push 0x2001f
push edi
push esi
call fcn.00437bb7
test eax, eax
je 0x49d651
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x222c]
call fcn.00437bb7
test eax, eax
je 0x49d651
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2270]
push eax
xor edx, edx
lea eax, [ebp - 0x2220]
mov dword [ebp - 0x2220], edx
push eax
test ecx, ecx
je 0x49d5f8
sub esp, 0x14
push edi
push esi
call fcn.0049c76c
jmp 0x49d609
push edx
push 0x2001f
push edx
push edx
push edx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x49d7f6
xor edx, edx
mov eax, edx
cmp dword [ebp - 0x222c], eax
je 0x49d631
push dword [ebp - 0x222c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [ebp - 0x222c], edx
mov ecx, dword [ebp - 0x2220]
mov dword [ebp - 0x2228], edx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], edx
test eax, eax
jne 0x49d7f6
push edi
mov ecx, ebx
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
push 0x3d
pop eax
cmp word [edi], ax
jne 0x49d687
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x222c]
push eax
call fcn.0049c96a
mov esi, eax
test esi, esi
js 0x49d920
push 0x7b
pop eax
cmp word [edi], ax
jne 0x49d8f6
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x49d698
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x49d8f6
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x222c]
push edi
call fcn.0049d269
mov esi, eax
test esi, esi
js 0x49d920
mov ecx, ebx
push edi
call fcn.0049d124
jmp 0x49d568
cmp dword [ebp + 0x14], 0
jne 0x49d711
push 0x20019
push edi
push dword [ebp - 0x2230]
lea ecx, [ebp - 0x222c]
call fcn.00437bb7
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x226c], ebx
test eax, eax
je 0x49d724
jmp 0x49d71b
mov dword [ebp - 0x2234], 2
xor ebx, ebx
inc ebx
mov dword [ebp - 0x226c], ebx
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00574864
add esp, 0x10
push eax
call fcn.00439f60
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0049d124
mov esi, eax
test esi, esi
js 0x49d920
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0049cd93
mov esi, eax
test esi, esi
js 0x49d920
push 0x7b
pop eax
cmp word [edi], ax
jne 0x49d7d3
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2268]
jne 0x49d77a
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x49d7d3
mov ecx, dword [ebp - 0x221c]
xor eax, eax
push ebx
mov ebx, dword [ebp - 0x222c]
push eax
push ebx
push edi
call fcn.0049d269
mov esi, eax
test esi, esi
jns 0x49d7bc
cmp dword [ebp - 0x226c], 0
je 0x49d920
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0049d124
mov esi, eax
test esi, esi
jns 0x49d7d9
jmp 0x49d920
mov ebx, dword [ebp - 0x222c]
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x49d8f6
test eax, eax
je 0x49d804
cmp dword [ebp + 0x14], 0
jne 0x49d8f6
mov ecx, eax
call fcn.0049d0f4
mov esi, eax
jmp 0x49d920
cmp dword [ebp + 0x14], 0
je 0x49d84c
push ebx
call fcn.0049cfc3
test eax, eax
je 0x49d84c
lea eax, [ebp - 0x218]
push eax
call fcn.0049cdf8
test eax, eax
je 0x49d8f6
cmp dword [ebp - 0x2220], 0
je 0x49d8f6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x222c]
call fcn.0049cece
jmp 0x49d8f6
push ebx
call fcn.0049cfc3
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2234], ecx
test ebx, ebx
je 0x49d877
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2234]
xor ebx, ebx
mov dword [ebp - 0x222c], ebx
jmp 0x49d879
xor ebx, ebx
mov dword [ebp - 0x2228], ebx
test eax, eax
jne 0x49d7f6
cmp dword [ebp - 0x2220], eax
je 0x49d8f6
test ecx, ecx
jne 0x49d8f6
mov dword [ebp - 0x2264], ebx
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x225c], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2264]
mov eax, dword [ebp - 0x2230]
mov dword [ebp - 0x2264], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x225c], ebx
call fcn.0049d068
mov dword [ebp - 0x2264], ebx
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x225c], ebx
test eax, eax
jne 0x49d99e
mov byte [ebp - 4], bl
mov dword [ebp - 0x2260], ebx
push 0x7d
pop eax
cmp word [edi], ax
je 0x49d920
jmp 0x49d2d5
xor eax, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x223c], eax
jmp 0x49d920
xor eax, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x223c], eax
mov esi, 0x80020009
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x222c]
test eax, eax
je 0x49d9b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x222c], eax
jmp 0x49d9b7
mov byte [ebp - 4], al
mov dword [ebp - 0x2254], eax
jmp 0x49d920
mov ecx, eax
call fcn.0049d0f4
mov esi, eax
xor eax, eax
mov byte [ebp - 4], al
test ebx, ebx
je 0x49d96b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x49d990
xor ebx, ebx
jmp 0x49d996
mov ecx, eax
call fcn.0049d0f4
mov esi, eax
mov byte [ebp - 4], bl
cmp dword [ebp - 0x224c], 0
je 0x49d996
push dword [ebp - 0x224c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
jmp 0x49d920
mov ecx, eax
call fcn.0049d0f4
mov esi, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2260], ebx
jmp 0x49d920
xor eax, eax
mov dword [ebp - 0x2228], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040548e
leave
ret 0x10