Function at 0x4a1c4a
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x4ef0aa
call fcn.004ebd20
sub esp, 0x42c
mov eax, dword [0x517ad4]
and dword [ebp - 0x424], 0
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x430], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [ebp - 0x438], eax
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jge 0x4a1c9e
jmp 0x4a209c
cmp word [ebx], 0x7d
push edi
je 0x4a2099
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov dword [ebp - 0x42c], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x4a1cd8
test edi, edi
je 0x4a1d56
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
cmp dword [ebp + 0x10], 0
je 0x4a1d56
push 0x5c
mov eax, ebx
call fcn.004a149e
test eax, eax
pop ecx
jne 0x4a219c
push ebx
call fcn.004a1924
test eax, eax
je 0x4a1d29
mov eax, dword [ebp - 0x430]
push ebx
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x434], eax
call fcn.0047aa91
test edi, edi
je 0x4a1d56
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
mov ecx, dword [ebp - 0x428]
mov edi, ebx
call fcn.004a1985
jmp 0x4a1f8a
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a1d83
and dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
push 0x4fa728
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a1ede
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x420]
call fcn.004a14fe
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x4a2084
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
cmp esi, edi
jl 0x4a2084
cmp word [ebx], 0x3d
jne 0x4a2153
cmp dword [ebp + 0x10], edi
je 0x4a1e6e
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x428]
mov byte [ebp - 4], 1
mov dword [ebp - 0x42c], eax
push ebx
lea eax, [ebp - 0x420]
push eax
lea edx, [ebp - 0x42c]
call fcn.004a15fb
mov esi, eax
cmp esi, edi
jl 0x4a215b
mov byte [ebp - 4], 0
cmp word [ebx], 0x7b
jne 0x4a1e5f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4a1e5f
mov ecx, dword [ebp - 0x428]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x424]
push ebx
call fcn.004a1c4a
mov esi, eax
test esi, esi
jl 0x4a2084
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
cmp word [ebx], 0x7d
jne 0x4a1ca9
jmp 0x4a2084
cmp dword [ebp + 0x14], edi
jne 0x4a1ecc
cmp dword [ebp - 0x42c], edi
je 0x4a1ecc
push 0x20006
push edi
push dword [ebp - 0x430]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], edi
call fcn.0040124f
cmp eax, edi
jne 0x4a2178
mov edi, dword [ebp - 0x42c]
lea eax, [ebp - 0x420]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4a1ec1
cmp eax, 2
jne 0x4a2166
test edi, edi
je 0x4a1ecc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x428]
mov edi, ebx
call fcn.004a1985
jmp 0x4a1e55
push 0x5c
mov eax, ebx
call fcn.004a149e
test eax, eax
pop ecx
jne 0x4a219c
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4a1f99
push 0x2001f
push ebx
push dword [ebp - 0x430]
lea eax, [ebp - 0x424]
call fcn.0040124f
test eax, eax
je 0x4a1f55
push 0x20019
push ebx
push dword [ebp - 0x430]
lea eax, [ebp - 0x424]
call fcn.0040124f
test eax, eax
je 0x4a1f55
push esi
push 0x2001f
push esi
push esi
push ebx
push dword [ebp - 0x430]
xor edi, edi
lea eax, [ebp - 0x424]
call fcn.0047a9cc
cmp eax, esi
jne 0x4a207d
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
cmp word [ebx], 0x3d
jne 0x4a1e15
mov ecx, dword [ebp - 0x428]
push ebx
push 0
lea edx, [ebp - 0x424]
call fcn.004a15fb
mov esi, eax
test esi, esi
jl 0x4a2084
jmp 0x4a1e15
cmp dword [ebp + 0x14], esi
jne 0x4a1fbd
push 0x20019
push ebx
push dword [ebp - 0x430]
lea eax, [ebp - 0x424]
call fcn.0040124f
mov dword [ebp - 0x434], eax
jmp 0x4a1fc7
mov dword [ebp - 0x434], 2
cmp dword [ebp - 0x434], esi
je 0x4a1fd6
mov dword [ebp + 0x14], 1
push 0x104
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
mov ecx, dword [ebp - 0x428]
mov edi, ebx
call fcn.004a1985
mov esi, eax
test esi, esi
jl 0x4a2084
cmp word [ebx], 0x7b
jne 0x4a204f
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x428]
push 0
push dword [ebp - 0x424]
push ebx
call fcn.004a1c4a
mov esi, eax
test esi, esi
jge 0x4a203c
cmp dword [ebp + 0x14], 0
je 0x4a2084
mov ecx, dword [ebp - 0x428]
mov eax, ebx
call fcn.004a14fe
mov esi, eax
test esi, esi
jl 0x4a2084
cmp dword [ebp - 0x434], 2
mov eax, dword [ebp - 0x438]
mov dword [ebp + 0x14], eax
je 0x4a1e5f
mov eax, dword [ebp - 0x434]
xor edi, edi
cmp eax, edi
je 0x4a20b6
cmp dword [ebp - 0x438], edi
jne 0x4a1e5f
call fcn.004a0bae
mov esi, eax
cmp dword [ebp - 0x424], 0
je 0x4a2099
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ebd70
leave
ret 0x10
cmp dword [ebp - 0x438], edi
je 0x4a2105
push dword [ebp - 0x424]
call fcn.004a1950
test eax, eax
je 0x4a2105
lea eax, [ebp - 0x218]
push eax
call fcn.004a1924
test eax, eax
je 0x4a1e5f
cmp dword [ebp - 0x42c], 0
je 0x4a1e5f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.0047aa91
jmp 0x4a1e5f
cmp dword [ebp - 0x424], edi
je 0x4a2127
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [ebp - 0x424], edi
jne 0x4a21bb
cmp dword [ebp - 0x42c], edi
je 0x4a1e5f
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4a207d
jmp 0x4a1e5f
cmp dword [ebp - 0x424], edi
jmp 0x4a21a3
cmp dword [ebp - 0x424], edi
jmp 0x4a208b
call fcn.004a0bae
test edi, edi
mov esi, eax
je 0x4a2084
push edi
jmp 0x4a2191
call fcn.004a0bae
cmp dword [ebp - 0x42c], edi
mov esi, eax
je 0x4a2084
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a2084
cmp dword [ebp - 0x424], 0
je 0x4a21b1
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4a209b
call fcn.004a0bae
jmp 0x4a209b