Function at 0x4b41b8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov dword [ebp - 0x9c], 0x928c176b
mov dword [ebp - 0x98], 0x928c176b
mov dword [ebp - 0x94], 0x928c176b
mov dword [ebp - 0x90], 0x928c176b
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x1c], 3
jmp 0x4b4200
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4b4278
mov dword [ebp - 0x20], 0
jmp 0x4b4216
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x4b4229
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x24], 0
jmp 0x4b420f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24], 0
jmp 0x4b424e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 3
jg 0x4b4276
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x4b4274
push 0x200a
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x4b4239
jmp 0x4b41f9
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x9c], 0
push 0
call fcn.0049f11a
pop ecx
mov dword [ebp - 0x18], 0x3bd6525
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x4b42af
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x4b42c2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0xfffffff8
jmp 0x4b42a8
mov dword [ebp - 4], 0
jmp 0x4b42d2
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4b42e8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x8c], 0
jmp 0x4b42cb
mov dword [ebp - 4], 0
jmp 0x4b42f8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x4b430b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0xfad5
jmp 0x4b42f1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0xa0], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x40], 0x4320e32c
push 0xfffffffffffffffe
pop eax
sub eax, 0x4320e32c
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x8c]
mov dword [ebp - 0x50], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x50]
mov dword [ebp + eax - 0x8c], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
neg eax
add eax, 5
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
jle 0x4b438c
mov dword [ebp - 0x68], 1
jmp 0x4b4390
and dword [ebp - 0x68], 0
imul eax, dword [ebp - 0x68], 0x17f4
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
je 0x4b44a9
mov eax, 0xffff
test eax, eax
je 0x4b44a9
mov dword [ebp - 0x28], 0x4fa72d50
mov dword [ebp - 0x7c], 0xa7967268
mov dword [ebp - 0x78], 0x79d62bf
mov dword [ebp - 0x74], 0xffffffff
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
cmp dword [ebp + eax - 0x40], ecx
je 0x4b43e8
mov dword [ebp - 0x4c], 1
jmp 0x4b43ec
and dword [ebp - 0x4c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x4c], eax
jg 0x4b4411
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x40], 0
je 0x4b4411
mov dword [ebp - 0x60], 1
jmp 0x4b4415
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0xb4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0xbc], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x8c], 1
xor eax, eax
inc eax
neg eax
add eax, dword [ebp - 0x60]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x34]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x40]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jb 0x4b4481
mov dword [ebp - 0x6c], 1
jmp 0x4b4485
and dword [ebp - 0x6c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
jmp 0x4b4649
mov dword [ebp - 0x10], 0x68d270c1
mov dword [ebp - 8], 2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 8], eax
jle 0x4b44de
mov dword [ebp - 0x5c], 1
jmp 0x4b44e2
and dword [ebp - 0x5c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
add eax, dword [ebp - 0x5c]
imul eax, eax, 0xfffffffb
cmp dword [ebp - 0x10], eax
jg 0x4b4500
mov dword [ebp - 0x70], 1
jmp 0x4b4504
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xc], 0x546153b7
cmp dword [ebp - 8], 0
je 0x4b4544
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xa4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jne 0x4b4544
and dword [ebp - 0x54], 0
jmp 0x4b454b
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x54]
cmp eax, 0xffff
jae 0x4b4562
mov dword [ebp - 0x64], 1
jmp 0x4b4566
and dword [ebp - 0x64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp eax, dword [ebp - 0x64]
jle 0x4b457e
mov dword [ebp - 0x48], 1
jmp 0x4b4582
and dword [ebp - 0x48], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x18]
jg 0x4b4596
mov dword [ebp - 0x44], 1
jmp 0x4b459a
and dword [ebp - 0x44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x44], eax
jl 0x4b45df
mov eax, 0xedb9cc51
test eax, eax
je 0x4b45df
mov dword [ebp - 0x58], 0x28f0e43d
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4b45dd
push 0
push 0
push 0x1a94
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x4b4649
mov dword [ebp - 8], 0
jmp 0x4b45ef
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff0
jne 0x4b4649
mov dword [ebp - 0x10], 0
jmp 0x4b4605
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x24
jle 0x4b4647
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x4b4621
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xc], 2
jmp 0x4b4631
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x4b4645
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x40], 0
je 0x4b4643
jmp 0x4b4645
jmp 0x4b462a
jmp 0x4b45fe
jmp 0x4b45e8
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10