Function at 0x47a990
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x49d8e7
push eax
mov eax, 0x2244
mov dword fs:[0], esp
call fcn.0044c450
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x226c]
mov edi, dword [esp + 0x2260]
push edi
mov dword [esp + 0x225c], ebx
mov dword [esp + 0x34], eax
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b050
cmp word [edi], 0x7d
push ebp
je 0x47b033
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x30], 1
call esi
mov ebp, eax
neg ebp
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x47aa25
cmp ebp, ebx
je 0x47ab4e
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
cmp dword [esp + 0x226c], ebx
je 0x47ab4e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
movzx ecx, word [edi]
mov byte [esp + 0x225c], 1
mov eax, edi
cmp cx, bx
je 0x47aa82
movzx ecx, cx
cmp cx, 0x5c
je 0x47aa7a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, bx
jne 0x47aa63
jmp 0x47aa82
cmp eax, ebx
jne 0x47afb5
mov ecx, dword [esp + 0x10]
push edi
call fcn.004791f0
test eax, eax
je 0x47aab1
mov ecx, dword [esp + 0x2268]
mov dword [esp + 0x20], ecx
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], ebx
call fcn.00479380
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
cmp ebp, ebx
je 0x47ab43
mov ebp, dword [esp + 0x10]
push edi
mov ecx, ebp
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47afd1
push edi
mov ecx, ebp
call fcn.00479280
mov esi, eax
cmp esi, ebx
jl 0x47afd1
mov byte [esp + 0x225c], bl
mov dword [esp + 0x24], ebx
cmp word [edi], 0x7b
jne 0x47ab34
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x47ab34
mov edx, dword [esp + 0x226c]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
push ebx
push edx
push eax
push edi
mov ecx, ebp
call fcn.0047a990
mov esi, eax
cmp esi, ebx
jl 0x47b033
push edi
mov ecx, ebp
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
cmp word [edi], 0x7d
jne 0x47a9f4
jmp 0x47b033
mov byte [esp + 0x225c], bl
mov dword [esp + 0x24], ebx
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47ab76
mov ecx, dword [esp + 0x10]
push edi
mov dword [esp + 0x2c], ebx
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
push 0x4bedb8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47aca3
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x254]
push edx
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
cmp word [edi], 0x3d
jne 0x47afbe
cmp dword [esp + 0x226c], ebx
je 0x47ac1c
mov eax, dword [esp + 0x2268]
push edi
lea ecx, [esp + 0x258]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x2268], 2
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
call fcn.0047a600
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
jl 0x47afd7
mov byte [esp + 0x225c], bl
mov dword [esp + 0x3c], ebx
jmp 0x47aaec
cmp dword [esp + 0x2270], ebx
jne 0x47ac94
cmp dword [esp + 0x28], ebx
je 0x47ac94
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x2268]
push 0x20006
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2268], 3
call fcn.00478c40
cmp eax, ebx
jne 0x47afeb
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x254]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x47ac7a
cmp eax, 2
jne 0x47afeb
mov byte [esp + 0x225c], bl
cmp esi, ebx
je 0x47ac90
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479280
jmp 0x47ab2a
movzx ecx, word [edi]
mov eax, edi
cmp cx, bx
je 0x47acd1
mov esi, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x47acc9
push eax
call esi
movzx ecx, word [eax]
cmp cx, bx
jne 0x47acb6
jmp 0x47acd1
cmp eax, ebx
jne 0x47afbe
cmp dword [esp + 0x226c], ebx
je 0x47add0
mov eax, dword [esp + 0x2268]
lea edx, [esp + 0x1c]
push edx
push 0x2001f
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x47ad21
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x47ad11
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
cmp eax, ebx
je 0x47ad93
mov edx, dword [esp + 0x2268]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x20]
call fcn.00478c40
cmp eax, ebx
je 0x47ad93
mov edx, dword [esp + 0x2268]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push edx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x47aff7
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x47ad7d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov esi, eax
mov dword [esp + 0x14], ecx
cmp eax, ebx
jne 0x47aff7
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
cmp word [edi], 0x3d
jne 0x47aaec
mov ecx, dword [esp + 0x10]
push edi
push ebx
lea edx, [esp + 0x1c]
push edx
call fcn.0047a600
mov esi, eax
cmp esi, ebx
jl 0x47b033
jmp 0x47aaec
cmp dword [esp + 0x2270], ebx
jne 0x47aecc
mov eax, dword [esp + 0x2268]
push 0x20019
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.00478c40
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, ebx
je 0x47ae09
mov dword [esp + 0x2270], 1
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x54]
push 0x104
push ecx
call fcn.004465e3
push eax
call fcn.00407130
mov ecx, dword [esp + 0x24]
add esp, 0x14
push edi
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479280
mov esi, eax
cmp esi, ebx
jl 0x47b033
cmp word [edi], 0x7b
jne 0x47ae9c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x47ae9c
mov ebp, dword [esp + 0x2270]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push edx
push edi
call fcn.0047a990
mov esi, eax
cmp esi, ebx
jge 0x47ae84
cmp ebp, ebx
je 0x47b033
mov ecx, dword [esp + 0x10]
push edi
call fcn.00479080
mov esi, eax
cmp esi, ebx
jl 0x47b033
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2270], eax
cmp ebp, 2
je 0x47ab34
cmp ebp, ebx
je 0x47aedd
cmp eax, ebx
jne 0x47ab34
push ebp
call fcn.00478b30
add esp, 4
mov esi, eax
jmp 0x47b033
mov dword [esp + 0x1c], 2
mov ebp, dword [esp + 0x1c]
jmp 0x47adfe
cmp eax, ebx
je 0x47af26
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00479230
test eax, eax
je 0x47af26
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
call fcn.004791f0
test eax, eax
je 0x47ab34
cmp dword [esp + 0x28], ebx
je 0x47ab34
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x18]
call fcn.00479380
jmp 0x47ab34
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.00479230
xor ebp, ebp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x14], ebx
je 0x47af51
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp ebp, ebx
jne 0x47b00b
cmp dword [esp + 0x28], ebx
je 0x47ab34
cmp dword [esp + 0x1c], ebx
jne 0x47ab34
mov eax, dword [esp + 0x2268]
lea ecx, [esp + 0x4c]
push ecx
push eax
mov byte [esp + 0x2264], 4
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
cmp eax, ebx
jne 0x47b01f
lea ecx, [esp + 0x40]
mov byte [esp + 0x225c], bl
call fcn.00479360
jmp 0x47ab34
lea ecx, [esp + 0x20]
call fcn.00479360
lea ecx, [esp + 0x14]
call fcn.00479360
mov eax, 0x80020009
jmp 0x47b04f
lea ecx, [esp + 0x20]
jmp 0x47b02e
lea ecx, [esp + 0x38]
call fcn.00479360
lea ecx, [esp + 0x14]
call fcn.00479360
jmp 0x47b04d
push eax
call fcn.00478b30
lea ecx, [esp + 0x30]
jmp 0x47b029
lea ecx, [esp + 0x14]
call fcn.00479360
push esi
call fcn.00478b30
add esp, 4
jmp 0x47b04f
lea ecx, [esp + 0x14]
call fcn.00479360
push ebp
call fcn.00478b30
add esp, 4
jmp 0x47b04f
push eax
call fcn.00478b30
lea ecx, [esp + 0x44]
add esp, 4
mov esi, eax
call fcn.00479360
mov eax, dword [esp + 0x14]
mov dword [esp + 0x225c], 0xffffffff
cmp eax, ebx
je 0x47b04d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x2250]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2250
ret 0x10