Function at 0x4bc2e0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x508
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], esp
push ebx
mov dword [ebp - 4], 0
call fcn.004fa6c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x214]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x4bc36b
mov edx, ecx
sub edx, eax
mov dl, byte [ebp + edx - 0x214]
cmp dl, 0x5c
mov byte [ebp + eax - 0x114], dl
jne 0x4bc368
cmp eax, 2
jge 0x4bc36b
inc eax
jmp 0x4bc348
sub ecx, eax
xor edx, edx
mov edi, ecx
cmp edx, edi
jge 0x4bc386
mov cl, byte [ebp + edx - 0x214]
mov byte [ebp + edx - 0x514], cl
inc edx
jmp 0x4bc371
mov byte [ebp + edi - 0x514], 0
xor esi, esi
cmp esi, eax
jge 0x4bc3b7
lea edx, [ebp + esi - 0x213]
mov dl, byte [edx + edi]
cmp dl, 0x5c
je 0x4bc3ac
mov byte [ebp + esi - 0x114], dl
jne 0x4bc3b4
mov byte [ebp + esi - 0x114], 0
inc esi
jmp 0x4bc390
push str.key
mov ecx, 0xf558a0
mov byte [ebp + eax - 0x114], 0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x514]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push str.entry
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x114]
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edi, [ebp - 0x514]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x414]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp + eax - 0x414]
cmp cl, 0x5c
je 0x4bc494
mov byte [ebp + eax - 0x194], cl
inc eax
jmp 0x4bc47e
mov byte [ebp + eax - 0x194], 0
inc eax
xor edx, edx
mov cl, byte [ebp + eax - 0x414]
test cl, cl
je 0x4bc4b5
mov byte [ebp + edx - 0x314], cl
inc eax
inc edx
jmp 0x4bc49f
mov byte [ebp + edx - 0x314], 0
mov esi, str.HKCU
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4bc4f0
test cl, cl
je 0x4bc4ec
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4bc4f0
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc4c8
xor eax, eax
jmp 0x4bc4f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc57e
lea eax, [ebp + 8]
lea ecx, [ebp - 0x314]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc57e
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edx, [ebp - 0x114]
push edx
push eax
call ebx
lea ecx, [ebp - 0x114]
push str.default
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc561
lea edx, [ebp - 0x114]
push str._default_
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc569
mov eax, dword [ebp + 8]
push 0
push eax
call ebx
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x114]
push ecx
push edx
call edi
jmp 0x4bc58a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, str.HKCR
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4bc5b9
test cl, cl
je 0x4bc5b5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4bc5b9
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc595
xor eax, eax
jmp 0x4bc5be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc635
lea eax, [ebp + 8]
lea ecx, [ebp - 0x314]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc635
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
push edx
push eax
call ebx
lea ecx, [ebp - 0x114]
push str.default
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc620
lea edx, [ebp - 0x114]
push str._default_
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc628
mov eax, dword [ebp + 8]
push 0
push eax
call ebx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x114]
push ecx
push edx
call edi
mov esi, str.HKLM
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4bc664
test cl, cl
je 0x4bc660
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4bc664
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc640
xor eax, eax
jmp 0x4bc669
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc716
push str.key2::
mov ecx, 0xf558a0
call fcn.004f0087
lea ecx, [ebp - 0x314]
push ecx
mov ecx, eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp + 8]
lea eax, [ebp - 0x314]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc716
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x114]
push ecx
push edx
call ebx
lea eax, [ebp - 0x114]
push str.default
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc701
lea ecx, [ebp - 0x114]
push str._default_
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc709
mov edx, dword [ebp + 8]
push 0
push edx
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
push ecx
call edi
mov esi, 0x51a568
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4bc745
test cl, cl
je 0x4bc741
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4bc745
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc721
xor eax, eax
jmp 0x4bc74a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc81b
push 0x200
call fcn.004f266a
add esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ae740
mov edx, dword [ebp - 0x14]
add esp, 4
lea ecx, [ebp - 0x314]
add edx, 0x100
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x414]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp + 8]
lea edx, [ebp - 0x414]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc80f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
push ecx
call ebx
lea edx, [ebp - 0x114]
push str.default
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc7fa
lea eax, [ebp - 0x114]
push str._default_
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc802
mov ecx, dword [ebp + 8]
push 0
push ecx
call ebx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
push edx
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004f265f
add esp, 4
mov esi, str.HKEY_CURRENT_CONFIG
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4bc84a
test cl, cl
je 0x4bc846
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4bc84a
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc826
xor eax, eax
jmp 0x4bc84f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc8b9
lea eax, [ebp + 8]
lea ecx, [ebp - 0x314]
push eax
push 0xf003f
push 0
push ecx
push htons
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc8b9
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
push edx
push eax
call ebx
lea ecx, [ebp - 0x114]
push str.default
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc8b1
lea edx, [ebp - 0x114]
push str._default_
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc8b9
mov eax, dword [ebp + 8]
push 0
push eax
call ebx
mov esi, str.HKEY_DYN_DATA
lea eax, [ebp - 0x194]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4bc8e8
test cl, cl
je 0x4bc8e4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4bc8e8
add eax, 2
add esi, 2
test cl, cl
jne 0x4bc8c4
xor eax, eax
jmp 0x4bc8ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4bc93e
lea eax, [ebp + 8]
lea ecx, [ebp - 0x314]
push eax
push 0xf003f
push 0
push ecx
push htons
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bc93e
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
push edx
push eax
call ebx
lea ecx, [ebp - 0x114]
push str.default
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4bc93e
mov edx, dword [ebp + 8]
push eax
push edx
call ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret