Function at 0x480bf0
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x220c]
mov eax, 0x220c
call fcn.004d4f20
push 0xffffffffffffffff
push 0x51344d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x569080]
xor eax, ebp
mov dword [ebp + 0x2208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x2218]
xor ebx, ebx
mov edi, dword [ebp + 0x2214]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x48162a
cmp word [edi], 0x7d
je 0x481627
nop dword [eax]
push str.Delete
push edi
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x537ac8
mov esi, eax
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x480ca0
test esi, esi
jne 0x480da1
mov ecx, dword [ebp - 0x18]
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
cmp dword [ebp + 0x221c], 0
je 0x480da1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov ecx, edi
movzx eax, word [edi]
test ax, ax
je 0x480d08
mov edx, eax
cmp dx, 0x5c
je 0x480d00
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x480ce5
jmp 0x480d08
test ecx, ecx
jne 0x4815ad
mov esi, 0x539324
nop dword [eax]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x480d5a
add esi, 4
cmp esi, str.RegDeleteKeyTransactedW
jl 0x480d10
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.00480770
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x10], 0
jne 0x480d96
mov ecx, dword [ebp - 0x18]
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x4815bf
mov ecx, dword [ebp - 0x18]
push edi
call fcn.004806f0
mov esi, eax
test esi, esi
js 0x4815bf
mov byte [ebp - 4], 0
mov dword [ebp - 0x30], 0
jmp 0x4811f1
mov byte [ebp - 4], 0
mov dword [ebp - 0x30], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x480dc7
mov ecx, dword [ebp - 0x18]
push edi
mov dword [ebp - 0x28], eax
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
push 0x537ac0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x480f29
mov ecx, dword [ebp - 0x18]
lea eax, [ebp]
push eax
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
mov ecx, dword [ebp - 0x18]
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
cmp word [edi], 0x3d
jne 0x4815b8
cmp dword [ebp + 0x221c], 0
je 0x480e84
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp]
push edi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0
push eax
mov dword [ebp - 0x38], 0
call fcn.004801a0
mov esi, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
test esi, esi
js 0x4815cc
mov byte [ebp - 4], 0
mov dword [ebp - 0x3c], 0
jmp 0x4811f1
cmp dword [ebp + 0x2220], 0
jne 0x480f11
cmp dword [ebp - 0x28], 0
je 0x480f11
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
push 0x20006
push ebx
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x480ecd
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x4815db
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x480ef4
cmp eax, 2
jne 0x4815d9
mov byte [ebp - 4], 0
test ebx, ebx
je 0x480f0a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x18]
push edi
call fcn.004806f0
mov esi, eax
test esi, esi
js 0x481627
jmp 0x48159b
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x480f58
mov edx, eax
cmp dx, 0x5c
je 0x480f50
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x480f35
jmp 0x480f58
test ecx, ecx
jne 0x481601
cmp dword [ebp + 0x221c], 0
je 0x48124d
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x480fe8
cmp dword [esi], 0
je 0x480fbe
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x480fde
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x480fde
mov eax, dword [ebp - 0x1c]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x14]
call dword [0x525578]
call esi
mov esi, dword [ebp - 0x1c]
jmp 0x480ffd
cmp dword [esi + 4], 0
je 0x480fde
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x1c]
jmp 0x480ffd
mov esi, dword [ebp - 0x1c]
mov eax, 1
jmp 0x480ffd
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48102f
test ebx, ebx
je 0x481013
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
test eax, eax
je 0x4811bc
mov dword [ebp - 0x10], 0
test esi, esi
je 0x4810af
cmp dword [esi], 0
je 0x481085
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4810a5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4810a5
mov eax, dword [ebp - 0x1c]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [0x525578]
call esi
mov esi, dword [ebp - 0x1c]
jmp 0x4810c4
cmp dword [esi + 4], 0
je 0x4810a5
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x1c]
jmp 0x4810c4
mov esi, dword [ebp - 0x1c]
mov eax, 1
jmp 0x4810c4
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4810f6
test ebx, ebx
je 0x4810da
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
test eax, eax
je 0x4811bc
mov dword [ebp - 0x10], 0
test esi, esi
je 0x481167
cmp dword [esi], 0
je 0x48115a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x48111c
mov eax, 1
jmp 0x481186
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x481160
mov eax, dword [ebp - 0x1c]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x14]
call dword [0x525578]
call esi
jmp 0x481186
cmp dword [esi + 4], 0
jne 0x481167
mov eax, 1
jmp 0x481186
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x48161e
test ebx, ebx
je 0x4811a0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
test eax, eax
jne 0x48161e
mov ecx, dword [ebp - 0x18]
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
cmp word [edi], 0x3d
jne 0x4811f1
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push edi
push 0
push eax
call fcn.004801a0
mov esi, eax
test esi, esi
js 0x481627
mov ebx, dword [ebp - 0x24]
cmp word [edi], 0x7b
jne 0x48159b
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481200
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x48159b
push 0
push dword [ebp + 0x221c]
push ebx
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
push edi
call fcn.00480bf0
mov esi, eax
test esi, esi
js 0x481627
push edi
mov ecx, ebx
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
jmp 0x48159b
mov esi, dword [ebp + 0x2220]
test esi, esi
jne 0x48132f
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x4812e7
cmp dword [ebx], esi
je 0x4812b5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4812da
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4812da
push 0
push dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [0x525578]
call esi
mov esi, dword [ebp + 0x2220]
mov ebx, eax
jmp 0x4812fe
cmp dword [ebx + 4], 0
je 0x4812da
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp + 0x2220]
mov ebx, eax
jmp 0x4812fe
mov esi, dword [ebp + 0x2220]
mov ebx, 1
jmp 0x4812fe
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x481334
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x481319
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
jmp 0x481334
mov ebx, 2
test ebx, ebx
mov eax, 1
push 0xffffffffffffffff
cmove eax, esi
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2000]
push 0x104
push eax
call fcn.004e8b61
push eax
call fcn.00404330
mov ecx, dword [ebp - 0x18]
add esp, 0x14
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
mov ecx, dword [ebp - 0x18]
push edi
call fcn.004806f0
mov esi, eax
test esi, esi
js 0x481627
cmp word [edi], 0x7b
jne 0x4813d8
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481390
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x4813d8
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
push 0
push dword [ebp - 0x24]
push edi
call fcn.00480bf0
mov esi, eax
test esi, esi
jns 0x4813c5
cmp dword [ebp - 0x10], 0
je 0x481627
mov ecx, dword [ebp - 0x18]
push edi
call fcn.00480a60
mov esi, eax
test esi, esi
js 0x481627
cmp ebx, 2
je 0x48159b
test ebx, ebx
je 0x4813f9
cmp dword [ebp + 0x2220], 0
jne 0x48159b
mov ecx, ebx
jmp 0x481620
cmp dword [ebp + 0x2220], 0
je 0x481480
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x481480
cmp eax, dword [ebp - 0x10]
sbb eax, eax
neg eax
je 0x481480
mov ebx, 0x539324
push dword [ebx]
lea eax, [ebp + 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48159b
add ebx, 4
cmp ebx, str.RegDeleteKeyTransactedW
jl 0x481440
cmp dword [ebp - 0x28], 0
je 0x48159b
lea eax, [ebp + 0x2000]
push eax
lea ecx, [ebp - 0x24]
call fcn.00480770
jmp 0x48159b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4814b0
xor ebx, ebx
jmp 0x4814b9
xor eax, eax
cmp eax, dword [ebp - 0x10]
sbb ebx, ebx
neg ebx
mov ecx, dword [ebp - 0x24]
xor eax, eax
test ecx, ecx
je 0x4814d0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
test eax, eax
jne 0x48161e
cmp dword [ebp - 0x28], eax
je 0x48159b
test ebx, ebx
jne 0x48159b
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
cmp byte [0x56c138], bl
jne 0x481552
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x481540
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov byte [0x56c138], 1
mov eax, dword [ebp - 0x14]
mov dword [0x56c134], ebx
jmp 0x481558
mov ebx, dword [0x56c134]
mov eax, dword [ebp - 0x14]
mov byte [0x56c138], 1
jmp 0x481558
mov ebx, dword [0x56c134]
lea ecx, [ebp + 0x2000]
test ebx, ebx
je 0x481574
push 0
push 0
push ecx
push eax
mov ecx, ebx
call dword [0x525578]
call ebx
jmp 0x48157c
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
test eax, eax
jne 0x481608
mov byte [ebp - 4], al
mov dword [ebp - 0x54], eax
cmp word [edi], 0x7d
je 0x481627
mov ebx, dword [ebp - 0x24]
jmp 0x480c70
mov byte [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov esi, 0x80020009
jmp 0x48162a
mov byte [ebp - 4], 0
mov dword [ebp - 0x30], 0
jmp 0x481627
mov byte [ebp - 4], 0
mov dword [ebp - 0x3c], 0
jmp 0x481627
mov ecx, eax
call fcn.00480a50
mov esi, eax
mov byte [ebp - 4], 0
test ebx, ebx
je 0x4815f8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
jmp 0x481627
mov esi, 0x80020009
jmp 0x481627
mov ecx, eax
call fcn.00480a50
mov esi, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x54], 0
jmp 0x481627
mov ecx, eax
call fcn.00480a50
mov esi, eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x481643
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov eax, esi
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2208]
xor ecx, ebp
call fcn.004d3ce9
lea esp, [ebp + 0x220c]
pop ebp
ret 0x10