Function at 0x491ab0
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1aab
mov eax, dword fs:[0]
push eax
mov eax, 0x2244
call fcn.004a8e60
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0
push ebx
mov dword [ebp - 4], 0
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49246e
cmp word [ebx], 0x7d
je 0x49245b
jmp 0x491b40
push str.Delete
push ebx
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4e8648
sbb edi, edi
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x491b73
test edi, edi
je 0x491c75
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
cmp dword [ebp + 0x10], 0
je 0x491c75
movzx eax, word [ebx]
mov edx, ebx
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test ax, ax
je 0x491bd4
cmp ax, 0x5c
je 0x491bcc
push edx
call dword [sym.imp.USER32.dll_CharNextW]
mov edx, eax
movzx ecx, word [edx]
mov eax, ecx
test cx, cx
jne 0x491bb1
jmp 0x491bd4
test edx, edx
jne 0x492444
mov esi, 0x4e8f70
lea esp, [esp]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x491c2e
add esi, 4
cmp esi, 0x4e8fa0
jl 0x491be0
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2244]
push ebx
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], 0
call fcn.00491580
mov dword [ebp - 0x2244], 0
mov dword [ebp - 0x223c], 0
test edi, edi
je 0x491c6b
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
push ebx
mov ecx, edi
call fcn.00492490
mov esi, eax
test esi, esi
js 0x49245b
mov dword [ebp - 0x2240], 0
jmp 0x492095
mov dword [ebp - 0x2240], 0
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x491ca5
mov ecx, dword [ebp - 0x2224]
xor edi, edi
push ebx
mov dword [ebp - 0x2234], edi
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
jmp 0x491cab
mov edi, dword [ebp - 0x2234]
push 0x4e8640
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x491dfb
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
cmp word [ebx], 0x3d
jne 0x492444
cmp dword [ebp + 0x10], 0
je 0x491d7c
mov eax, dword [ebp - 0x2220]
mov edi, dword [ebp - 0x2224]
mov ecx, edi
mov dword [ebp - 0x2250], eax
lea eax, [ebp - 0x2218]
push ebx
push eax
lea eax, [ebp - 0x2250]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
call fcn.004906e0
mov esi, eax
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
test esi, esi
js 0x49245b
mov byte [ebp - 4], 0
mov dword [ebp - 0x224c], 0
jmp 0x492095
cmp dword [ebp + 0x14], 0
jne 0x491de0
test edi, edi
je 0x491de0
lea eax, [ebp - 0x2234]
mov dword [ebp - 0x2234], 0
push eax
push 0x20006
push 0
push 0
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x492450
mov edi, dword [ebp - 0x2234]
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x491dd5
cmp eax, 2
jne 0x49242c
test edi, edi
je 0x491de0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00492490
mov esi, eax
test esi, esi
js 0x49245b
jmp 0x492420
movzx ecx, word [ebx]
mov eax, ebx
test cx, cx
je 0x491e28
mov edx, ecx
cmp dx, 0x5c
je 0x491e20
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x491e07
jmp 0x491e28
test eax, eax
jne 0x492444
cmp dword [ebp + 0x10], 0
je 0x4920f0
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x491e98
cmp dword [esi], 0
je 0x491e8b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x491ee8
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x491e91
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x491eb3
cmp dword [esi + 4], 0
jne 0x491e98
mov eax, 1
jmp 0x491eb3
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x491ee8
mov ecx, dword [ebp - 0x2230]
test ecx, ecx
je 0x491ec8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
je 0x49205c
jmp 0x491eee
mov edi, dword [ebp - 0x2230]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x491f4e
cmp dword [esi], 0
je 0x491f41
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x491f96
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x491f47
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x491f69
cmp dword [esi + 4], 0
jne 0x491f4e
mov eax, 1
jmp 0x491f69
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x491f96
test edi, edi
je 0x491f78
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
je 0x49205c
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x492003
cmp dword [esi], 0
je 0x491ff6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49244b
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x491ffc
push 0
push dword [esi]
lea ecx, [ebp - 0x2238]
push ecx
lea ecx, [ebp - 0x221c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x49202b
cmp dword [esi + 4], 0
jne 0x492003
mov eax, 1
jmp 0x49202b
lea eax, [ebp - 0x2238]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x492450
test edi, edi
je 0x49203e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], edi
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x492450
mov edi, dword [ebp - 0x2224]
mov ecx, edi
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
cmp word [ebx], 0x3d
jne 0x492095
push ebx
push 0
lea eax, [ebp - 0x2230]
mov ecx, edi
push eax
call fcn.004906e0
mov esi, eax
test esi, esi
js 0x49245b
cmp word [ebx], 0x7b
jne 0x492420
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4920a4
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x492420
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x2230]
push ebx
call fcn.00491ab0
mov esi, eax
test esi, esi
js 0x49245b
push ebx
mov ecx, edi
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
jmp 0x492420
cmp dword [ebp + 0x14], 0
jne 0x4921bd
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x492164
cmp dword [esi], 0
je 0x492157
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49212a
lea edi, [eax + 1]
jmp 0x4921ae
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49215d
push 0
push dword [esi]
lea ecx, [ebp - 0x221c]
push ecx
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call eax
jmp 0x49217f
cmp dword [esi + 4], 0
jne 0x492164
mov edi, 1
jmp 0x492181
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4921ae
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x492198
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x221c], eax
test edi, edi
je 0x4921cc
jmp 0x4921c2
mov edi, 2
mov dword [ebp - 0x221c], 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004bd735
push eax
call fcn.00476340
mov ecx, dword [ebp - 0x2224]
add esp, 0x14
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00492490
mov esi, eax
test esi, esi
js 0x49245b
cmp word [ebx], 0x7b
jne 0x492277
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492220
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x492277
push dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2224]
push 0
push dword [ebp - 0x2230]
push ebx
call fcn.00491ab0
mov esi, eax
test esi, esi
jns 0x492261
cmp dword [ebp - 0x221c], 0
je 0x49245b
mov ecx, dword [ebp - 0x2224]
push ebx
call fcn.00490fe0
mov esi, eax
test esi, esi
js 0x49245b
cmp edi, 2
je 0x492420
test edi, edi
je 0x492294
cmp dword [ebp + 0x14], 0
jne 0x492420
push edi
jmp 0x492451
cmp dword [ebp + 0x14], 0
je 0x492326
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x492326
cmp dword [ebp - 0x221c], eax
jbe 0x492326
mov edi, 0x4e8f70
push dword [edi]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x492420
add edi, 4
cmp edi, 0x4e8fa0
jl 0x4922e0
cmp dword [ebp - 0x2234], 0
je 0x492420
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.00491580
jmp 0x492420
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x2230]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x49235f
xor edi, edi
jmp 0x49236b
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb edi, edi
neg edi
mov ecx, dword [ebp - 0x2230]
xor eax, eax
test ecx, ecx
je 0x492386
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x492450
cmp dword [ebp - 0x2234], eax
je 0x492420
test edi, edi
jne 0x492420
cmp byte [0x5286d0], al
jne 0x4923eb
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4923dd
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5286cc], eax
mov byte [0x5286d0], 1
jmp 0x4923f0
mov eax, dword [0x5286cc]
mov byte [0x5286d0], 1
jmp 0x4923f0
mov eax, dword [0x5286cc]
test eax, eax
je 0x492409
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x2220]
call eax
jmp 0x49241c
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x492450
cmp word [ebx], 0x7d
jne 0x491b40
jmp 0x49245b
push eax
call fcn.00480350
add esp, 4
mov esi, eax
test edi, edi
je 0x49245b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49245b
mov esi, 0x80020009
jmp 0x49245b
mov eax, 1
push eax
call fcn.00480350
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x49246c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret 0x10