Function at 0x47ad38
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x5d90e0
push edi
mov dword [ebp - 0x2234], 1
inc dword [ecx]
add byte [eax], al
add bh, bh
adc eax, 0x5c3334
neg eax
push 0x5d90b4
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2238], esi
call dword [0x5c3334]
test eax, eax
je 0x47a499
test esi, esi
je 0x47a5a2
mov ecx, dword [ebp - 0x2224]
push edi
push str.NoRemove
push edi
call dword [0x5c3334]
test eax, eax
jne 0x47a5ce
mov ecx, dword [ebp - 0x2224]
push edi
mov dword [ebp - 0x2234], eax
call fcn.004f30b0
mov esi, eax
test esi, esi
js 0x47ade0
push 0x5d90ac
push edi
call dword [0x5c3334]
test eax, eax
jne 0x47a725
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.004f30e0
mov esi, eax
test esi, esi
js 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004f30f6
mov esi, eax
test esi, esi
js 0x47ade0
cmp word [edi], 0x3d
jne 0x47adc9
cmp dword [ebp + 0x10], 0
je 0x47a69d
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x2224]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2254], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2254]
mov dword [ebp - 0x2250], 0
add byte [eax], al
push eax
mov dword [ebp - 0x224c], 0
call 0x4f32fe
mov esi, eax
mov dword [ebp - 0x2254], 0
mov dword [ebp - 0x2250], 0
cmp dword [ebp + 0x14], 0
jne 0x47a70a
cmp dword [ebp - 0x2234], 0
je 0x47a70a
xor ebx, ebx
lea eax, [ebp - 0x2234]
dec dword [ecx - 0x223363]
call dword [eax + 0x68]
push es
add byte [edx], al
add byte [ebx + 0x53], dl
push dword [ebp - 0x2220]
call dword [0x5c3044]
test eax, eax
jne fcn.0047a6d8
mov ebx, dword [ebp - 0x2234]
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004f38e2
mov esi, eax
test esi, esi
js 0x47ade0
jmp 0x47ada2
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x47a752
mov edx, ecx
cmp dx, 0x5c
je 0x47a74a
push eax
call dword [0x5c3514]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x47a731
jmp 0x47a752
test eax, eax
jne 0x47add0
cmp dword [ebp + 0x10], 0
je 0x47aa6c
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47a7dc
cmp dword [esi], 0
je 0x47a7cf
push 0x5e22bc
call dword [0x5c33b0]
test eax, eax
jne 0x47a792
mov eax, 1
jmp 0x47a822
push str.RegOpenKeyTransactedW
push eax
call dword [0x5c3148]
mov esi, eax
test esi, esi
je 0x47a7d5
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47a7f7
cmp dword [esi + 4], 0
jne 0x47a7dc
mov eax, 1
jmp 0x47a7f7
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3044]
test eax, eax
jne 0x47a81c
test ebx, ebx
je 0x47a806
push ebx
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 0
test eax, eax
je 0x47ad57
push 0x5e4f40
push eax
call dword [0x5c3148]
mov ebx, eax
mov byte [0x68023c], 1
mov dword [0x680240], ebx
jmp 0x47ad6c
mov ebx, dword [0x680240]
mov byte [0x68023c], 1
jmp 0x47ad6c
lea eax, [ebp - 0x218]
test ebx, ebx
je 0x47ad8d
push 0
push 0
push eax
push dword [ebp - 0x2220]
mov ecx, ebx
call dword [0x5c3794]
call ebx
jmp 0x47ad9a
push eax
push dword [ebp - 0x2220]
call dword [0x5c3060]
pop esp
invalid
mov byte [ebp - 4], 0
test eax, eax
jne 0x47add7
cmp word [edi], 0x7d
je 0x47ade0
mov ebx, dword [ebp - 0x2230]
jmp 0x47a460
mov ecx, eax
call fcn.004f2c7a
mov esi, eax
mov ebx, dword [ebp - 0x2230]
test ebx, ebx
je 0x47adf1
push ebx
call dword [0x5c304c]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053fbcc
mov esp, ebp
pop ebp
ret 0x10