Function at 0x10004b90
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x100326a8
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1003d300]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d300]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
push 0xb
mov esi, 0xf
xor ebp, ebp
push str.auditConfig
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], 0
call fcn.10006850
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0xd4], ebp
call fcn.10002800
add esp, 4
mov bl, 2
mov edi, 0x10
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x68], edi
jb 0x10004c2b
mov ecx, dword [esp + 0x54]
push ecx
call fcn.1001aa0a
add esp, 4
push 0xe
push str.localCacheDays
lea ecx, [esp + 0x2c]
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], 0
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebp
mov byte [esp + 0x30], 0
call fcn.10006850
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x90]
push eax
mov byte [esp + 0xd8], 3
call fcn.10002480
add esp, 8
mov byte [esp + 0xd0], bl
mov esi, eax
cmp dword [esp + 0x3c], edi
jb 0x10004c8e
mov ecx, dword [esp + 0x28]
push ecx
call fcn.1001aa0a
add esp, 4
cmp esi, 7
je 0x10004ca1
push esi
push str.local_audit_cache_days:__d
call fcn.10016510
add esp, 8
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, esi
imul eax, eax, 0xfffeae80
push ebp
cdq
push 0x989680
push edx
push eax
call fcn.10027f30
add dword [esp + 0x14], eax
lea eax, [esp + 0x14]
adc dword [esp + 0x18], edx
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [esp + 0x46]
movzx edx, word [esp + 0x42]
movzx eax, word [esp + 0x40]
push ecx
push edx
push eax
push str._04d__02d__02d
lea esi, [esp + 0xb8]
call fcn.100187a6
add esp, 0x10
lea ecx, [esp + 0x6c]
mov byte [esp + 0xd0], 4
call fcn.10018b63
mov byte [esp + 0xd0], 5
mov eax, dword [esp + 0x84]
mov ecx, dword [eax]
mov esi, dword [esp + 0x6c]
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], esi
cmp esi, ebp
je 0x10004d52
cmp esi, dword [esp + 0x1c]
je 0x10004d57
call fcn.1001afea
cmp ebx, dword [esp + 0x20]
je 0x10004e68
cmp esi, ebp
jne 0x10004dcb
call fcn.1001afea
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x10004d76
call fcn.1001afea
cmp dword [esp + 0xc0], 8
mov eax, dword [esp + 0xac]
lea ebp, [ebx + 0xc]
jae 0x10004d91
lea eax, [esp + 0xac]
mov edi, dword [esp + 0xbc]
push eax
mov eax, dword [ebp + 0x14]
mov ecx, ebp
call fcn.100088e0
test eax, eax
jge 0x10004e50
test esi, esi
jne 0x10004dcf
call fcn.1001afea
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x10004dc0
call fcn.1001afea
cmp dword [ebp + 0x18], 8
jb 0x10004dd3
mov eax, dword [ebp + 4]
jmp 0x10004dd6
mov eax, dword [esi]
jmp 0x10004d6c
mov eax, dword [esi]
jmp 0x10004db6
lea eax, [ebp + 4]
push eax
push 0x10035bcc
call fcn.10016669
add esp, 8
test esi, esi
jne 0x10004e13
call fcn.1001afea
cmp ebx, dword [esi + 0x18]
jne 0x10004df7
call fcn.1001afea
push ebp
lea edi, [esp + 0x28]
call fcn.100086a0
mov esi, 8
add esp, 4
cmp dword [eax + 0x18], esi
jb 0x10004e17
mov eax, dword [eax + 4]
jmp 0x10004e1a
mov esi, dword [esi]
jmp 0x10004ded
add eax, 4
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x3c], esi
jb 0x10004e39
mov ecx, dword [esp + 0x28]
push ecx
call fcn.1001aa0a
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], dx
lea esi, [esp + 0x14]
call fcn.10006220
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
xor ebp, ebp
jmp 0x10004d48
lea esi, [esp + 0x6c]
mov byte [esp + 0xd0], 6
call fcn.100061e0
mov eax, dword [esp + 0x6c]
push eax
call fcn.1001aa0a
add esp, 4
cmp dword [esp + 0xc0], 8
jb 0x10004ea0
mov ecx, dword [esp + 0xac]
push ecx
call fcn.1001aa0a
add esp, 4
xor edx, edx
lea esi, [esp + 0x8c]
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], ebp
mov word [esp + 0xac], dx
mov dword [esp + 0xd0], 0xffffffff
call fcn.1000cb2c
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.1001a9d1
add esp, 0xc0
ret