Function at 0x4cf260
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549a55
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x2f
push str.HKLMSYSTEMCurrentControlSet_servicesmfencbdc
push dword [edi + 0x2c]
mov dword [ebp - 0x50], edi
push ecx
lea ecx, [edi + 0x1c]
call fcn.004859a0
test eax, eax
je 0x4cf5a7
push 0x2e
push str.HKLMSYSTEMCurrentControlSet_servicesmfencrk
push dword [edi + 0x2c]
push ecx
lea ecx, [edi + 0x1c]
call fcn.004859a0
test eax, eax
je 0x4cf5a7
push 0x2e
push str.HKLMSYSTEMCurrentControlSet_servicesmfehidk
push dword [edi + 0x2c]
push ecx
lea ecx, [edi + 0x1c]
call fcn.004859a0
test eax, eax
je 0x4cf5a7
xor eax, eax
mov dword [ebp - 0x4c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 7
push eax
lea edx, [ebp - 0x4c]
lea ecx, [edi + 0x1c]
call fcn.004f6500
mov esi, eax
add esp, 4
mov dword [ebp - 0x48], esi
test esi, esi
jne 0x4cf45e
push 6
push ecx
call fcn.004a0950
add esp, 4
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cf414
sub esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe8]
call fcn.0047b550
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe8]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x1fc
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Deleting_Registry_Key
mov ecx, eax
call fcn.0047f130
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a0d80
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.0047ac60
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 0x10
jb 0x4cf3e0
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp - 0x2c]
call fcn.0047ac60
lea ecx, [ebp - 0xe8]
call fcn.004790d0
jmp 0x4cf40d
mov dword [ebp - 4], 7
lea ecx, [edi + 0x4c]
mov edx, str.false
call fcn.004a0050
test al, al
mov eax, dword [ebp - 0x44]
je 0x4cf43f
cmp dword [ebp - 0x30], 8
jae 0x4cf431
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
jmp 0x4cf45b
cmp dword [ebp - 0x30], 8
jae 0x4cf448
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea esi, [eax - 5]
neg esi
sbb esi, esi
and esi, eax
mov dword [ebp - 0x48], esi
call fcn.004a0950
mov ecx, dword [0x596f88]
test byte [ecx + 0x1c], 2
je 0x4cf479
cmp byte [ecx + 0x19], 6
jb 0x4cf479
mov cl, 1
jmp 0x4cf47b
xor cl, cl
cmp byte [eax], 0
jne 0x4cf48e
cmp byte [eax + 1], 0
jne 0x4cf48e
test cl, cl
je 0x4cf58a
sub esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe8]
call fcn.0047b550
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe8]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x231
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Deleted_RegKey
mov ecx, eax
call fcn.0047f130
lea edx, [edi + 0x1c]
mov ecx, eax
call fcn.004a0d80
mov edx, str.._status_is
mov ecx, eax
call fcn.0047f130
push esi
mov ecx, eax
call fcn.0047b350
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.0047ac60
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b6a0
mov edi, eax
mov byte [ebp - 4], 0x10
cmp dword [edi + 0x14], 0x10
jb 0x4cf540
mov edi, dword [edi]
call fcn.004a0950
push edi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp - 0x2c]
call fcn.0047ac60
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xd
call fcn.0047b620
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4cf58a
cmp dword [ebp - 0x30], 8
jb 0x4cf5a0
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4cf5a0
push eax
call fcn.005074d4
add esp, 4
mov eax, esi
jmp 0x4cf730
mov eax, dword [0x59e598]
test al, 1
jne 0x4cf5d8
or eax, 1
mov dword [0x59e598], eax
mov dword [ebp - 4], 0
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4cf5ed
cmp byte [eax + 0x19], 6
jb 0x4cf5ed
mov al, 1
jmp 0x4cf5ef
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4cf609
cmp byte [0x59e5a9], 0
jne 0x4cf609
test al, al
je 0x4cf72e
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xe8]
call fcn.0047b550
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe8]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x1f3
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Deliberately_NOT_deleting_Registry_Key
mov ecx, eax
call fcn.0047f130
lea edx, [edi + 0x1c]
mov ecx, eax
call fcn.004a0d80
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x4cf69b
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4cf69b
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x4cf6b8
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x4cf6e3
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 5
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 4
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp - 0x18], 0x10
jb 0x4cf706
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4cf706
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.0047b620
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00506c7d
mov esp, ebp
pop ebp
ret