Function at 0x468f20
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x18], edx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x18]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov edx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 6
mov dword [ebp - 0x10], esi
test ecx, ecx
je 0x469027
cmp si, word [ecx]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x469027
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push ecx
push edi
push 3
call edx
test eax, eax
jne 0x468f8b
call esi
mov esi, eax
xor ecx, ecx
jmp 0x468f92
mov ecx, eax
xor esi, esi
mov dword [ebp - 0x10], ecx
test esi, esi
jne 0x469175
lea edx, [ecx + 8]
cmp ecx, edx
sbb eax, eax
test edx, eax
je 0x469060
cmp ecx, edx
sbb eax, eax
and eax, edx
cmp eax, 0x400
ja 0x468fd3
cmp ecx, edx
sbb eax, eax
and eax, edx
call fcn.00491390
mov ebx, esp
test ebx, ebx
je 0x469060
mov dword [ebx], 0xcccc
jmp 0x468fee
cmp ecx, edx
sbb eax, eax
and eax, edx
push eax
call fcn.004a3e8e
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x469060
mov dword [ebx], 0xdddd
add ebx, 8
test ebx, ebx
je 0x469060
mov esi, dword [ebp - 0x10]
push esi
push 0
push ebx
call fcn.00496490
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push ebx
push edx
push 3
call fcn.00406110
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x469145
mov eax, dword [ebp - 0xc]
mov edx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x469103
xor esi, esi
cmp si, word [ecx]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x469103
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 3
call edx
test eax, eax
jne 0x46906a
call esi
mov esi, eax
xor edx, edx
jmp 0x469071
mov esi, 0xe
jmp 0x469175
mov edx, eax
xor esi, esi
mov dword [ebp - 0x14], edx
test esi, esi
jne 0x469145
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x46919f
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x4690b2
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00491390
mov edi, esp
test edi, edi
je 0x4691a1
mov dword [edi], 0xcccc
jmp 0x4690d1
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.004a3e8e
mov edi, eax
add esp, 4
test edi, edi
je 0x4691a1
mov dword [edi], 0xdddd
add edi, 8
test edi, edi
je 0x4691a1
mov edx, dword [ebp - 0x14]
push edx
push 0
push edi
call fcn.00496490
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
push 3
call fcn.00406110
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x469145
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], 6
je 0x46911b
test eax, eax
je 0x469114
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 6
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x469145
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test ebx, ebx
je 0x46915d
add ebx, 0xfffffff8
cmp dword [ebx], 0xdddd
jne 0x46915d
push ebx
call fcn.004a2e5c
add esp, 4
test edi, edi
je 0x469175
add edi, 0xfffffff8
cmp dword [edi], 0xdddd
jne 0x469175
push edi
call fcn.004a2e5c
add esp, 4
cmp dword [ebp - 8], 6
je 0x469189
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x469189
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
xor edi, edi
mov esi, 0xe
jmp 0x469145