Function at 0x44f4d6
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x762386
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.007539b0
mov eax, dword [0x774fa4]
xor eax, esp
mov dword [esp + 0x2258], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774fa4]
xor eax, esp
push eax
lea eax, [esp + 0x2270]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2284]
mov edi, dword [esp + 0x2280]
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x228c]
mov dword [esp + 0x60], ecx
push edi
mov ecx, ebx
mov dword [esp + 0x227c], ebp
call fcn.0044dde0
mov esi, eax
cmp esi, ebp
jl 0x44f67f
cmp word [edi], 0x7d
je 0x44f67d
jmp 0x44f0f4
mov ebx, dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [esp + 0x38], 1
call esi
neg eax
push str.ForceRemove
sbb ebp, ebp
push edi
inc ebp
call esi
test eax, eax
je 0x44f123
test ebp, ebp
je 0x44f251
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
xor edx, edx
cmp dword [esp + 0x2288], edx
je 0x44f251
movzx ecx, word [edi]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov eax, edi
cmp cx, dx
je 0x44f17b
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x44f173
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x44f160
jmp 0x44f17b
test eax, eax
jne 0x44f64c
mov esi, 0x764a18
mov edx, dword [esi]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44f1c3
add esi, 4
cmp esi, 0x764a48
jl 0x44f180
mov eax, dword [esp + 0x14]
xor esi, esi
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.0044e100
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
jmp 0x44f1c5
xor esi, esi
cmp ebp, esi
je 0x44f24d
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f665
push edi
mov ecx, ebx
call fcn.0044dfe0
mov esi, eax
test esi, esi
js 0x44f665
mov dword [esp + 0x28], 0
cmp word [edi], 0x7b
jne 0x44f23e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x44f23e
mov ecx, dword [esp + 0x2288]
mov edx, dword [esp + 0x18]
push 0
push ecx
push edx
push edi
mov ecx, ebx
call fcn.0044f050
mov esi, eax
test esi, esi
js 0x44f66e
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
cmp word [edi], 0x7d
jne 0x44f0f0
jmp 0x44f66e
mov dword [esp + 0x28], esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44f277
push edi
mov ecx, ebx
mov dword [esp + 0x34], eax
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
push 0x7649e0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44f3a0
lea ecx, [esp + 0x26c]
push ecx
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
cmp word [edi], 0x3d
jne 0x44f655
xor ebp, ebp
cmp dword [esp + 0x2288], ebp
je 0x44f31f
mov edx, dword [esp + 0x14]
push edi
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebx
mov byte [esp + 0x2284], 1
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
call fcn.0044ed30
mov esi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
cmp esi, ebp
jl 0x44f6a9
mov byte [esp + 0x2278], 0
mov dword [esp + 0x3c], ebp
jmp 0x44f1f9
cmp dword [esp + 0x228c], ebp
jne 0x44f389
cmp dword [esp + 0x30], ebp
je 0x44f389
mov edx, dword [esp + 0x14]
push 0x20006
push ebp
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call fcn.0044da00
cmp eax, ebp
jne 0x44f6bd
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x26c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebp
je 0x44f376
cmp eax, 2
jne 0x44f6bd
cmp esi, ebp
je 0x44f385
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
push edi
mov ecx, ebx
call fcn.0044dfe0
mov esi, eax
cmp esi, ebp
jl 0x44f66e
jmp 0x44f23e
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x44f3cb
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x44f3c3
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x44f3b0
jmp 0x44f3cb
test eax, eax
jne 0x44f655
cmp dword [esp + 0x2288], 0
je 0x44f469
mov ecx, dword [esp + 0x14]
push 0x2001f
push edi
push ecx
lea ecx, [esp + 0x24]
call fcn.0044da00
test eax, eax
je 0x44f42f
mov edx, dword [esp + 0x14]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.0044da00
test eax, eax
je 0x44f42f
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push eax
lea ecx, [esp + 0x34]
call fcn.0044d950
mov esi, eax
test esi, esi
jne 0x44f6ce
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
cmp word [edi], 0x3d
jne 0x44f1f9
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.0044ed30
mov esi, eax
test esi, esi
js 0x44f66e
jmp 0x44f1f9
cmp dword [esp + 0x228c], 0
jne 0x44f4c8
mov edx, dword [esp + 0x14]
push 0x20019
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.0044da00
mov ebp, eax
mov dword [esp + 0x34], ebp
test ebp, ebp
je 0x44f49c
mov dword [esp + 0x228c], 1
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.0075406c
add esp, 0x10
cmp eax, 0x50
ja case.0x44f4c1.107
movzx ecx, byte [eax + 0x44f73c]
jmp dword [ecx*4 + 0x44f72c]
mov dword [esp + 0x34], 2
mov ebp, dword [esp + 0x34]
jmp 0x44f491
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
push edi
mov ecx, ebx
call fcn.0044dfe0
mov esi, eax
test esi, esi
js 0x44f66e
cmp word [edi], 0x7b
jne 0x44f547
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x44f547
mov ebp, dword [esp + 0x228c]
mov edx, dword [esp + 0x18]
push ebp
push 0
push edx
push edi
mov ecx, ebx
call fcn.0044f050
mov esi, eax
test esi, esi
jns 0x44f531
test ebp, ebp
je 0x44f66e
push edi
mov ecx, ebx
call fcn.0044dde0
mov esi, eax
test esi, esi
js 0x44f66e
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x228c], eax
cmp ebp, 2
je 0x44f23e
test ebp, ebp
je 0x44f577
test eax, eax
jne 0x44f23e
push ebp
call fcn.0044d6c0
add esp, 4
mov esi, eax
jmp 0x44f66e
test eax, eax
je 0x44f5bd
mov eax, dword [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0044df90
test eax, eax
je 0x44f5bd
lea ecx, [esp + 0x64]
push ecx
mov ecx, ebx
call fcn.0044df50
test eax, eax
je 0x44f23e
cmp dword [esp + 0x30], 0
je 0x44f23e
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x1c]
call fcn.0044e100
jmp 0x44f23e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x5c]
push eax
call fcn.0044df90
xor ebp, ebp
mov ebx, eax
cmp dword [esp + 0x18], ebp
je 0x44f5ea
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
test ebp, ebp
jne 0x44f6f6
cmp dword [esp + 0x30], ebp
je 0x44f23e
test ebx, ebx
jne 0x44f23e
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call fcn.0044d920
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
cmp eax, ebx
jne 0x44f70d
lea ecx, [esp + 0x50]
call fcn.0044e0e0
jmp 0x44f23e
lea ecx, [esp + 0x24]
call fcn.0044e0e0
lea ecx, [esp + 0x18]
call fcn.0044e0e0
mov eax, 0x80020009
jmp 0x44f67f
lea ecx, [esp + 0x24]
call fcn.0044e0e0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44f67d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x2270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2258]
xor ecx, esp
call fcn.0075399d
add esp, 0x2268
ret 0x10
lea ecx, [esp + 0x38]
call fcn.0044e0e0
lea ecx, [esp + 0x18]
call fcn.0044e0e0
jmp 0x44f67d
push eax
call fcn.0044d6c0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x44]
jmp 0x44f669
lea ecx, [esp + 0x18]
call fcn.0044e0e0
push esi
call fcn.0044d6c0
add esp, 4
jmp 0x44f67f
push 0x8007000e
call fcn.004445d0
push 0x80070057
call fcn.004445d0
lea ecx, [esp + 0x18]
call fcn.0044e0e0
push ebp
call fcn.0044d6c0
add esp, 4
jmp 0x44f67f
push eax
call fcn.0044d6c0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x50]
jmp 0x44f669
push 0x80004005
call fcn.004445d0
nop
salc
hlt