Function at 0x4ea7e0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x730
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x72c], eax
push ebx
push esi
mov esi, dword [esp + 0x73c]
push edi
xor ebx, ebx
push 0x207
lea eax, [esp + 0x21]
push ebx
push eax
mov byte [esp + 0x28], bl
call fcn.005dfd60
push 0x207
lea ecx, [esp + 0x541]
push ebx
push ecx
mov byte [esp + 0x548], bl
call fcn.005dfd60
push 0x207
lea edx, [esp + 0x345]
push ebx
push edx
mov byte [esp + 0x34c], bl
call fcn.005dfd60
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x24
push esi
lea eax, [esp + 0x534]
push eax
mov dword [esp + 0x18], ebx
call edi
push esi
lea ecx, [esp + 0x32c]
push ecx
call edi
lea edx, [esp + 0x328]
push 0x5c
push edx
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x4ea894
mov byte [eax], 0x2f
inc eax
push 0x5c
push eax
call fcn.005e0940
add esp, 8
cmp eax, ebx
jne 0x4ea881
push ebp
lea eax, [esp + 0x32c]
push eax
lea ecx, [esp + 0x24]
push 0x6487dc
push ecx
call fcn.005dfb23
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call edi
cmp esi, ebx
jne 0x4ea993
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x748], ebx
je 0x4ea993
cmp byte [esp + 0x20], bl
je 0x4ea993
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x20]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4ea993
cmp dword [0x68fed4], 0xffffffff
jne 0x4ea93f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x68fed4
call fcn.004d9f10
add esp, 0x2c
cmp dword [0x68fed4], ebx
jne 0x4ea965
lea edx, [esp + 0x20]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
cmp esi, 2
jne 0x4ea990
lea eax, [esp + 0x20]
push eax
jmp 0x4ea984
push ebx
lea ecx, [esp + 0x24]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e1ff0
mov esi, eax
add esp, 0xc
cmp esi, 2
jne 0x4ea990
lea edx, [esp + 0x20]
push edx
call fcn.004e5120
cmp eax, 1
jne 0x4ea990
xor esi, esi
push esi
call edi
lea eax, [esp + 0x20]
push 0x6487a4
push eax
call fcn.005dfb23
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
lea edx, [esp + 0x2c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov esi, eax
push esi
call edi
pop ebp
cmp esi, ebx
jne 0x4eaa86
push 0x103
lea eax, [esp + 0x229]
push ebx
push eax
mov byte [esp + 0x230], bl
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x228]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ebx
lea ecx, [esp + 0x540]
push ecx
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4eaa5d
lea esi, [eax + 1]
cmp dword [esp + 0x744], ebx
je 0x4eaa61
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x530]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x72c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x730
ret
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x72c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x730
ret
mov ecx, dword [esp + 0x738]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x730
ret