Function at 0x449ee0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499006
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.0048f7d0
mov eax, dword [0x4c17d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2224], esi
mov dword [ebp - 0x2220], esi
mov edx, dword [ebp + 0x14]
mov eax, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x2244], edx
call fcn.00449d60
mov edi, eax
cmp edi, esi
jl 0x44a5ee
cmp word [ebx], 0x7d
je 0x44a5ec
lea esp, [esp]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x2228], 1
call edi
mov esi, eax
neg esi
push str.ForceRemove
sbb esi, esi
push ebx
inc esi
call edi
test eax, eax
je 0x449f93
test esi, esi
je 0x44a0aa
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x44a0ac
push 0x5c
mov eax, ebx
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
call fcn.00449490
add esp, 4
test eax, eax
jne 0x44a553
push ebx
call fcn.00449b00
test eax, eax
je 0x44a009
mov eax, dword [ebp - 0x222c]
push ebx
lea ecx, [ebp - 0x2238]
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2234], edi
call fcn.00449b40
mov dword [ebp - 0x2238], edi
mov dword [ebp - 0x2234], edi
cmp esi, edi
je 0x44a0a2
mov esi, dword [ebp - 0x221c]
mov eax, ebx
mov ecx, esi
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a570
mov edi, ebx
mov ecx, esi
call fcn.00449aa0
mov edi, eax
test edi, edi
jl 0x44a570
mov dword [ebp - 0x2234], 0
cmp word [ebx], 0x7b
jne 0x44a093
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x44a093
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2224]
push 0
push eax
push ecx
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.00449ee0
mov edi, eax
test edi, edi
jl 0x44a5db
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
cmp word [ebx], 0x7d
jne 0x449f60
jmp 0x44a5db
mov dword [ebp - 0x2234], edi
jmp 0x44a0ac
xor edi, edi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44a0db
mov ecx, dword [ebp - 0x221c]
mov dword [ebp - 0x2228], eax
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
xor edi, edi
push 0x4b0d04
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44a212
mov ecx, dword [ebp - 0x221c]
lea eax, [ebp - 0x2218]
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
cmp word [ebx], 0x3d
jne 0x44a55e
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x44a186
mov ecx, dword [ebp - 0x222c]
mov byte [ebp - 4], 1
push ebx
lea edx, [ebp - 0x224c]
mov dword [ebp - 0x224c], ecx
mov ecx, dword [ebp - 0x221c]
push edx
lea edx, [ebp - 0x2218]
mov dword [ebp - 0x2248], esi
call fcn.004496f0
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x224c], esi
mov dword [ebp - 0x2248], esi
jl 0x44a578
mov byte [ebp - 4], 0
mov dword [ebp - 0x2248], esi
jmp 0x44a047
cmp dword [ebp + 0x14], esi
jne 0x44a1fc
cmp dword [ebp - 0x2228], esi
je 0x44a1fc
mov eax, dword [ebp - 0x222c]
xor edi, edi
push eax
mov ecx, 0x20006
xor edx, edx
lea esi, [ebp - 0x2240]
mov dword [ebp - 0x2240], edi
mov dword [ebp - 0x223c], edi
call fcn.00416330
cmp eax, edi
jne 0x44a590
mov esi, dword [ebp - 0x2240]
lea ecx, [ebp - 0x2218]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x44a1e3
cmp eax, 2
jne 0x44a590
cmp esi, edi
je 0x44a1f4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2240], edi
mov dword [ebp - 0x223c], edi
xor esi, esi
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.00449aa0
mov edi, eax
cmp edi, esi
jmp 0x44a08d
push 0x5c
mov eax, ebx
call fcn.00449490
add esp, 4
test eax, eax
jne 0x44a55e
cmp dword [ebp + 0x10], edi
je 0x44a334
mov eax, dword [ebp - 0x222c]
lea edx, [ebp - 0x2228]
push edx
push 0x2001f
push edi
push ebx
push eax
mov dword [ebp - 0x2228], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x44a27f
mov ecx, dword [ebp - 0x2224]
xor eax, eax
cmp ecx, edi
je 0x44a267
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2228]
mov dword [ebp - 0x2220], edi
mov dword [ebp - 0x2224], ecx
cmp eax, edi
je 0x44a2ef
xor edi, edi
mov eax, dword [ebp - 0x222c]
lea edx, [ebp - 0x2228]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [ebp - 0x2228], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x44a2cd
mov ecx, dword [ebp - 0x2224]
xor eax, eax
cmp ecx, edi
je 0x44a2b7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2228]
mov dword [ebp - 0x2220], edi
mov dword [ebp - 0x2224], ecx
cmp eax, edi
je 0x44a2ef
mov edx, dword [ebp - 0x222c]
push ebx
push edx
mov edx, 0x2001f
lea esi, [ebp - 0x2224]
call fcn.0040fc60
mov edi, eax
test edi, edi
jne 0x44a59d
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
cmp word [ebx], 0x3d
jne 0x44a047
mov ecx, dword [ebp - 0x221c]
push ebx
lea eax, [ebp - 0x2224]
push eax
xor edx, edx
call fcn.004496f0
mov edi, eax
test edi, edi
jl 0x44a5db
jmp 0x44a047
cmp dword [ebp + 0x14], edi
jne 0x44a463
mov edx, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2230]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [ebp - 0x2230], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x44a387
mov ecx, dword [ebp - 0x2224]
xor eax, eax
cmp ecx, edi
je 0x44a375
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2230]
mov dword [ebp - 0x2220], edi
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2230], eax
cmp eax, edi
je 0x44a398
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.00479ed8
push eax
call fcn.00416510
mov ecx, dword [ebp - 0x221c]
add esp, 0x14
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
mov ecx, dword [ebp - 0x221c]
mov edi, ebx
call fcn.00449aa0
mov edi, eax
test edi, edi
jl 0x44a5db
cmp word [ebx], 0x7b
jne 0x44a433
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x44a433
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x2224]
mov ecx, dword [ebp - 0x221c]
push esi
push 0
push eax
push ebx
call fcn.00449ee0
mov edi, eax
test edi, edi
jge 0x44a41c
test esi, esi
je 0x44a5db
mov ecx, dword [ebp - 0x221c]
mov eax, ebx
call fcn.00449d60
mov edi, eax
test edi, edi
jl 0x44a5db
mov eax, dword [ebp - 0x2230]
mov ecx, dword [ebp - 0x2244]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x44a093
test eax, eax
je 0x44a472
test ecx, ecx
jne 0x44a093
call fcn.00449d20
mov edi, eax
jmp 0x44a5db
mov dword [ebp - 0x2230], 2
jmp 0x44a391
mov esi, dword [ebp - 0x2224]
test ecx, ecx
je 0x44a4bf
mov ecx, esi
call fcn.00449cd0
test eax, eax
je 0x44a4bf
lea edx, [ebp - 0x218]
push edx
call fcn.00449b00
test eax, eax
je 0x44a093
cmp dword [ebp - 0x2228], 0
je 0x44a093
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2224]
call fcn.00449b40
jmp 0x44a093
mov ecx, esi
call fcn.00449cd0
mov dword [ebp - 0x2258], eax
xor eax, eax
mov dword [ebp - 0x2230], eax
test esi, esi
je 0x44a4ef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x2224], 0
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x44a5b1
cmp dword [ebp - 0x2228], eax
je 0x44a093
cmp dword [ebp - 0x2258], eax
jne 0x44a093
mov edx, dword [ebp - 0x222c]
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2250], ecx
cmp eax, ecx
jne 0x44a5c9
lea esi, [ebp - 0x2254]
call fcn.00416380
jmp 0x44a093
lea esi, [ebp - 0x2238]
call fcn.00416380
lea esi, [ebp - 0x2224]
call fcn.00416380
mov eax, 0x80020009
jmp 0x44a5ee
lea esi, [ebp - 0x2238]
jmp 0x44a5d6
lea esi, [ebp - 0x224c]
call fcn.00416380
lea esi, [ebp - 0x2224]
call fcn.00416380
jmp 0x44a5ec
call fcn.00449d20
lea esi, [ebp - 0x2240]
jmp 0x44a5d4
lea esi, [ebp - 0x2224]
call fcn.00416380
mov eax, edi
call fcn.00449d20
jmp 0x44a5ee
lea esi, [ebp - 0x2224]
call fcn.00416380
mov eax, dword [ebp - 0x2230]
call fcn.00449d20
jmp 0x44a5ee
call fcn.00449d20
lea esi, [ebp - 0x2254]
mov edi, eax
call fcn.00416380
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x44a5ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477b1d
mov esp, ebp
pop ebp
ret 0x10