Function at 0x489828
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3eaa
mov eax, dword fs:[0]
push eax
mov eax, 0x225c
call fcn.004a7aa0
mov eax, dword [0x4ea00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x222c], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2220], ecx
mov dword [ebp - 0x2224], ebx
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e41
push 0x7d
pop eax
cmp word [edi], ax
je 0x489e30
push str.Delete
push edi
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x4c23c0
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2230], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4898de
test esi, esi
je 0x489999
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x48999b
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x223c], esi
call fcn.00488e8b
test eax, eax
jne 0x489e2b
push edi
call fcn.004893ca
test eax, eax
je 0x489951
mov eax, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2244]
push edi
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], esi
call fcn.00488637
mov dword [ebp - 0x2244], esi
mov dword [ebp - 0x223c], esi
cmp dword [ebp - 0x2230], esi
je 0x489991
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.0048942e
mov esi, eax
test esi, esi
js 0x489e30
and dword [ebp - 0x2240], 0
jmp 0x489bc7
mov dword [ebp - 0x2240], esi
jmp 0x48999b
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4899c7
mov ecx, dword [ebp - 0x2228]
push edi
mov dword [ebp - 0x2234], esi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
push 0x4c23b8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x489b1e
mov ecx, dword [ebp - 0x2228]
lea eax, [ebp - 0x2218]
push eax
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
push 0x3d
pop eax
cmp word [edi], ax
jne 0x489e2b
cmp dword [ebp + 0x10], 0
je 0x489a83
mov eax, dword [ebp - 0x222c]
mov ecx, dword [ebp - 0x2228]
mov byte [ebp - 4], 1
and dword [ebp - 0x2258], 0
and dword [ebp - 0x2254], 0
mov dword [ebp - 0x225c], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x225c]
push eax
call fcn.00489053
mov esi, eax
xor eax, eax
mov dword [ebp - 0x225c], eax
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], eax
test esi, esi
js 0x489e30
mov byte [ebp - 4], al
mov dword [ebp - 0x2258], eax
jmp 0x489bc7
cmp dword [ebp + 0x14], 0
jne 0x489afd
cmp dword [ebp - 0x2234], 0
je 0x489afd
xor esi, esi
lea ecx, [ebp - 0x2250]
push 0x20006
push esi
push dword [ebp - 0x222c]
mov dword [ebp - 0x2250], esi
mov dword [ebp - 0x224c], esi
mov dword [ebp - 0x2248], esi
call fcn.00419790
test eax, eax
jne 0x489e06
mov ebx, dword [ebp - 0x2250]
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x489ae6
cmp eax, 2
jne 0x489df0
test ebx, ebx
je 0x489af7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2250], esi
mov dword [ebp - 0x224c], esi
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.0048942e
mov ebx, dword [ebp - 0x2224]
mov esi, eax
test esi, esi
js 0x489e36
jmp 0x489d08
push 0x5c
pop edx
mov ecx, edi
call fcn.00488e8b
test eax, eax
jne 0x489e2b
cmp dword [ebp + 0x10], eax
je 0x489c0f
mov ebx, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
mov esi, 0x2001f
push esi
push edi
push ebx
call fcn.00419790
test eax, eax
je 0x489b86
push 0x20019
push edi
push ebx
lea ecx, [ebp - 0x2224]
call fcn.00419790
test eax, eax
je 0x489b86
push ecx
push ecx
push esi
push ecx
push ecx
push edi
push ebx
lea ecx, [ebp - 0x2224]
call fcn.00422c1a
test eax, eax
jne 0x489e20
mov ebx, dword [ebp - 0x2228]
mov ecx, ebx
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
push 0x3d
pop eax
cmp word [edi], ax
jne 0x489bc1
push edi
push 0
lea eax, [ebp - 0x2224]
mov ecx, ebx
push eax
call fcn.00489053
mov esi, eax
test esi, esi
js 0x489e30
mov ebx, dword [ebp - 0x2224]
push 0x7b
pop eax
cmp word [edi], ax
jne 0x489d02
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 1
jne 0x489d02
push 0
push dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp - 0x2228]
mov ecx, ebx
push edi
call fcn.00489828
mov esi, eax
test esi, esi
js 0x489e30
push edi
mov ecx, ebx
call fcn.00488f1d
jmp 0x489b09
cmp dword [ebp + 0x14], 0
jne 0x489c34
push 0x20019
push edi
push dword [ebp - 0x222c]
lea ecx, [ebp - 0x2224]
call fcn.00419790
mov ebx, dword [ebp - 0x2224]
jmp 0x489c37
push 2
pop eax
xor ecx, ecx
mov dword [ebp - 0x2230], eax
push 0xffffffffffffffff
inc ecx
test eax, eax
push edi
cmove ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0x104
push eax
mov dword [ebp - 0x2238], ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push eax
call fcn.0040b69e
mov ecx, dword [ebp - 0x2228]
add esp, 0x14
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.0048942e
mov esi, eax
test esi, esi
js 0x489e30
push 0x7b
pop eax
cmp word [edi], ax
jne 0x489ce9
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 1
jne 0x489ce9
push dword [ebp - 0x2238]
mov ecx, dword [ebp - 0x2228]
push 0
push ebx
push edi
call fcn.00489828
mov esi, eax
test esi, esi
jns 0x489cd3
cmp dword [ebp - 0x2238], 0
je 0x489e30
mov ecx, dword [ebp - 0x2228]
push edi
call fcn.00488f1d
mov esi, eax
test esi, esi
js 0x489e30
mov eax, dword [ebp - 0x2230]
cmp eax, 2
je 0x489d02
test eax, eax
je 0x489d1f
cmp dword [ebp + 0x14], 0
je 0x489e20
mov ebx, dword [ebp - 0x2224]
push 0x7d
pop eax
cmp word [edi], ax
je 0x489e36
mov ebx, dword [ebp - 0x2224]
jmp 0x4898a5
cmp dword [ebp + 0x14], 0
je 0x489d5c
push ebx
call fcn.004893f9
test eax, eax
je 0x489d5c
lea eax, [ebp - 0x218]
push eax
call fcn.004893ca
test eax, eax
je 0x489d02
cmp dword [ebp - 0x2234], 0
je 0x489d02
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2224]
call fcn.00488637
jmp 0x489d02
push ebx
call fcn.004893f9
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x2230], ecx
test ebx, ebx
je 0x489d87
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2230]
xor ebx, ebx
mov dword [ebp - 0x2224], ebx
jmp 0x489d8d
mov ebx, dword [ebp - 0x2224]
and dword [ebp - 0x2220], 0
test eax, eax
jne 0x489de5
cmp dword [ebp - 0x2234], eax
je 0x489d08
test ecx, ecx
jne 0x489d08
mov eax, dword [ebp - 0x222c]
and dword [ebp - 0x2264], ecx
and dword [ebp - 0x2260], ecx
lea ecx, [ebp - 0x2268]
mov dword [ebp - 0x2268], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00488546
and dword [ebp - 0x2268], 0
test eax, eax
je 0x489d08
mov ecx, eax
call fcn.00488256
mov esi, eax
jmp 0x489e36
mov ecx, eax
call fcn.00488256
mov esi, eax
test ebx, ebx
je 0x489e30
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x489e30
mov ecx, eax
call fcn.00488256
cmp dword [ebp - 0x2250], 0
mov esi, eax
je 0x489e30
push dword [ebp - 0x2250]
jmp 0x489dfe
mov ecx, eax
call fcn.00488256
mov esi, eax
jmp 0x489e30
mov esi, 0x80020009
mov ebx, dword [ebp - 0x2224]
test ebx, ebx
je 0x489e41
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a439a
leave
ret 0x10