Function at 0x4bd548
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x2a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
xor r8d, r8d
mov rdx, qword [rcx + 8]
lea rcx, [rax - 0x238]
call fcn.004f4dd8
nop
mov rbx, qword [0x00862cb8]
xor edi, edi
cmp byte [rbx + 0x2f4f], dil
jne 0x4bd5b5
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd5b5
mov edx, 0xcf
call fcn.0040a51c
mov r12d, eax
jmp 0x4bd5bd
mov r12w, word [rbx + 0x2760]
cmp byte [rbx + 0x2f50], dil
jne 0x4bd5e1
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd5e1
mov edx, 0xd0
call fcn.0040a51c
mov r13d, eax
jmp 0x4bd5e9
mov r13w, word [rbx + 0x2764]
cmp byte [rbx + 0x2f51], dil
jne 0x4bd60d
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd60d
mov edx, 0xd1
call fcn.0040a51c
mov r14d, eax
jmp 0x4bd615
mov r14w, word [rbx + 0x2768]
cmp byte [rbx + 0x2f53], dil
jne 0x4bd638
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd638
mov edx, 0xd3
call fcn.0040a51c
mov ebp, eax
jmp 0x4bd63e
mov ebp, dword [rbx + 0x2770]
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x80]
call fcn.00471158
cmp rax, 1
jne 0x4bdd4d
mov rbx, qword [0x00862cb8]
lea r8, str.DCPlusPlus.xml
lea rdx, [0x0085e958]
lea rcx, [rsp + 0x28]
call fcn.00402658
nop
mov rdx, rax
mov rcx, rbx
call fcn.00608cd0
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x4bd6b6
cmp rcx, rdi
je 0x4bd6b6
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x4bd6b1
call fcn.006a4944
jmp 0x4bd6b6
call fcn.006a3610
cmp byte [rsi + 0xb60], dil
je 0x4bd711
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x2f4b], dil
jne 0x4bd6ea
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd6ea
mov edx, 0xcb
call fcn.004083bc
mov r11, rax
jmp 0x4bd6f1
lea r11, [rax + 0x26d0]
mov rax, qword [r11 + 0x28]
cmp rax, qword [r11 + 0x20]
je 0x4bd711
xor r9d, r9d
mov edx, 0x81f4
lea r8d, [r9 + 3]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [0x00862cb8]
cmp byte [rbx + 0x2f53], dil
jne 0x4bd739
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd739
mov edx, 0xd3
call fcn.0040a51c
jmp 0x4bd73f
mov eax, dword [rbx + 0x2770]
cmp eax, ebp
jne 0x4bd7e3
cmp byte [rbx + 0x2f4f], dil
jne 0x4bd76b
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd76b
mov edx, 0xcf
call fcn.0040a51c
mov r11d, eax
jmp 0x4bd772
mov r11d, dword [rbx + 0x2760]
movzx eax, r12w
cmp r11d, eax
jne 0x4bd7e3
cmp byte [rbx + 0x2f50], dil
jne 0x4bd79f
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd79f
mov edx, 0xd0
call fcn.0040a51c
mov r11d, eax
jmp 0x4bd7a6
mov r11d, dword [rbx + 0x2764]
movzx eax, r13w
cmp r11d, eax
jne 0x4bd7e3
cmp byte [rbx + 0x2f51], dil
jne 0x4bd7d3
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bd7d3
mov edx, 0xd1
call fcn.0040a51c
mov r11d, eax
jmp 0x4bd7da
mov r11d, dword [rbx + 0x2768]
movzx eax, r14w
cmp r11d, eax
je 0x4bd7eb
mov rcx, rsi
call fcn.004ba864
mov rcx, qword [0x00862ca0]
call fcn.00598b88
mov rbx, qword [0x0085e158]
cmp rbx, rdi
je 0x4bd82b
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x1619], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x81f4
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x4bd803
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x30b0], dil
jne 0x4bd853
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd853
mov edx, 0x230
call fcn.0041024c
jmp 0x4bd859
mov al, byte [rax + 0x2cd1]
cmp al, dil
je 0x4bd877
mov rbx, qword [0x008bb610]
mov rcx, rbx
call fcn.0061b2e8
mov rcx, rbx
call fcn.0061b24c
jmp 0x4bd883
mov rcx, qword [0x008bb610]
call fcn.0061b2e8
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x314e], dil
jne 0x4bd8ab
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd8ab
mov edx, 0x2ce
call fcn.0041024c
jmp 0x4bd8b1
mov al, byte [rax + 0x2d6f]
mov rbx, 0xffffffff80000000
cmp al, dil
je 0x4bd8d0
call fcn.00561b28
call fcn.005622e0
mov byte [0x008668f1], 1
jmp 0x4bd909
cmp byte [0x008668f1], dil
je 0x4bd909
call fcn.00562214
lea rdx, [0x0079eef0]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SoftwareClasses_adc
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [0x008668f1], dil
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x314f], dil
jne 0x4bd931
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd931
mov edx, 0x2cf
call fcn.0041024c
jmp 0x4bd937
mov al, byte [rax + 0x2d70]
cmp al, dil
je 0x4bd94a
call fcn.0056286c
mov byte [0x008668f2], 1
jmp 0x4bd97e
cmp byte [0x008668f2], dil
je 0x4bd97e
lea rdx, [0x0079f088]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, [0x0079f088]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [0x008668f2], dil
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x3150], dil
jne 0x4bd9a6
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd9a6
mov edx, 0x2d0
call fcn.0041024c
jmp 0x4bd9ac
mov al, byte [rax + 0x2d71]
cmp al, dil
je 0x4bd9bf
call fcn.00561164
mov byte [0x008668f3], 1
jmp 0x4bd9d4
cmp byte [0x008668f3], dil
je 0x4bd9d4
call fcn.00561a5c
mov byte [0x008668f3], dil
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x311a], dil
jne 0x4bd9fc
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bd9fc
mov edx, 0x29a
call fcn.0041024c
jmp 0x4bda02
mov al, byte [rax + 0x2d3b]
mov rcx, qword [0x008668d8]
movzx r9d, al
mov ebx, 0x402
mov r8d, 0x8b1
mov edx, ebx
mov rcx, qword [rcx + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [0x00862cb8]
cmp byte [r11 + 0x3127], dil
jne 0x4bda4f
mov rcx, qword [r11 + 0xb8]
cmp rcx, rdi
je 0x4bda4f
mov edx, 0x2a7
call fcn.0041024c
jmp 0x4bda56
mov al, byte [r11 + 0x2d48]
mov r9, rdi
cmp al, dil
sete r9b
mov r8d, 0x5d8
mov edx, ebx
mov rcx, qword [rsi + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x008669f3], dil
je 0x4bda9b
mov r9d, 1
mov r8d, 0x404
mov edx, ebx
mov rcx, qword [rsi + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4bdab3
xor r9d, r9d
mov r8d, 0x404
mov edx, ebx
mov rcx, qword [rsi + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x008668e0], dil
je 0x4bdad9
mov r9d, 1
mov r8d, 0x458
mov edx, ebx
mov rcx, qword [rsi + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4bdaf1
xor r9d, r9d
mov r8d, 0x458
mov edx, ebx
mov rcx, qword [rsi + 0x840]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x313c], dil
jne 0x4bdb19
mov rcx, qword [rax + 0xb8]
cmp rcx, rdi
je 0x4bdb19
mov edx, 0x2bc
call fcn.0041024c
jmp 0x4bdb1f
mov al, byte [rax + 0x2d5d]
mov dl, al
mov rcx, rsi
call fcn.004be9c4
mov rbx, qword [0x00862cb8]
mov ebp, 0x321
cmp byte [rbx + 0x31a1], dil
jne 0x4bdb53
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdb53
mov edx, ebp
call fcn.0041024c
jmp 0x4bdb59
mov al, byte [rbx + 0x2dc2]
cmp byte [rsi + 0xa58], al
je 0x4bdb9f
cmp byte [rbx + 0x31a1], dil
jne 0x4bdb7f
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdb7f
mov edx, ebp
call fcn.0041024c
jmp 0x4bdb85
mov al, byte [rbx + 0x2dc2]
mov byte [rsi + 0xa58], al
mov edx, 1
mov rcx, rsi
call fcn.004bfbb8
mov rbx, qword [0x00862cb8]
mov r12d, reloc.WS2_32.dll_recvfrom
cmp byte [rbx + 0x2e91], dil
jne 0x4bdbc4
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdbc4
mov edx, r12d
call fcn.004083bc
jmp 0x4bdbcb
lea rax, [rbx + 0x3f0]
lea rbp, [rsi + 0x8e0]
mov r8, qword [rbp + 0x20]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
sub rcx, rdx
mov rax, r8
sub rax, qword [rbp + 0x28]
mov r13d, 0x233
cmp rax, rcx
jne 0x4bdc34
mov rcx, qword [rbp + 0x28]
sub r8, rcx
call fcn.006b9320
cmp eax, edi
jne 0x4bdc34
cmp byte [rbx + 0x30b3], dil
jne 0x4bdc22
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdc22
mov edx, r13d
call fcn.0041024c
jmp 0x4bdc28
mov al, byte [rbx + 0x2cd4]
cmp byte [rsi + 0x910], al
je 0x4bdcff
cmp byte [rbx + 0x2e91], dil
jne 0x4bdc53
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdc53
mov edx, r12d
call fcn.004083bc
jmp 0x4bdc5a
lea rax, [rbx + 0x3f0]
cmp rax, rbp
je 0x4bdc76
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov rcx, rbp
call fcn.0040289c
mov rbx, qword [0x00862cb8]
cmp byte [rbx + 0x30b3], dil
jne 0x4bdc95
mov rcx, qword [rbx + 0xb8]
cmp rcx, rdi
je 0x4bdc95
mov edx, r13d
call fcn.0041024c
jmp 0x4bdc9b
mov al, byte [rbx + 0x2cd4]
mov byte [rsi + 0x910], al
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.00401f00
nop
lea rcx, [rsi + 0x850]
mov r8b, byte [rsi + 0x910]
mov rdx, qword [rax + 0x48]
call fcn.004b0e80
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x4bdcff
cmp rcx, rdi
je 0x4bdcff
mov rax, qword [rsp + 0x28]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x4bdcfa
call fcn.006a4944
jmp 0x4bdcff
call fcn.006a3610
mov rcx, rsi
call fcn.004c4bec
mov r11, qword [0x00862cb8]
cmp byte [r11 + 0x2fb2], dil
jne 0x4bdd32
mov rcx, qword [r11 + 0xb8]
cmp rcx, rdi
je 0x4bdd32
mov edx, 0x132
call fcn.0040a51c
mov r11d, eax
jmp 0x4bdd39
mov r11d, dword [r11 + 0x28ec]
movzx eax, byte [0x008655fc]
cmp r11d, edi
cmove edi, eax
mov byte [0x00865600], dil
lea rcx, [rsp + 0x80]
call fcn.004f5788
xor eax, eax
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret