Function at 0x464c90
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1154
call fcn.004ab980
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x114c], eax
mov eax, dword [esp + 0x115c]
push ebx
mov ebx, dword [esp + 0x115c]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1170]
push edi
mov dword [esp + 0x24], eax
xor edi, edi
push ebx
mov eax, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x50], ecx
call fcn.00464200
mov ebp, eax
cmp ebp, edi
jl 0x4652e8
cmp byte [ebx], 0x7d
je 0x4652e6
jmp 0x464d04
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebx
mov dword [esp + 0x28], 1
call ebp
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call ebp
test eax, eax
je 0x464d35
test edi, edi
je 0x464e49
push ebx
mov eax, esi
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x4652d7
xor ebp, ebp
cmp dword [esp + 0x1170], ebp
je 0x464e45
mov cl, byte [ebx]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov eax, ebx
test cl, cl
je 0x464d88
mov esi, dword [sym.imp.USER32.dll_CharNextA]
lea esp, [esp]
cmp cl, 0x5c
je 0x464d80
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x464d70
jmp 0x464d88
cmp eax, ebp
jne 0x465277
push ebx
call fcn.00464790
test eax, eax
je 0x464db0
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], ebp
call fcn.00463250
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov esi, dword [esp + 0x14]
cmp edi, ebp
je 0x464e3f
push ebx
mov eax, esi
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x465290
mov edi, ebx
mov ecx, esi
call fcn.00464810
mov ebp, eax
test ebp, ebp
jl 0x465290
mov dword [esp + 0x2c], 0
cmp byte [ebx], 0x7b
jne 0x464e31
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x464e31
mov edx, dword [esp + 0x1170]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push edx
push eax
push ebx
call fcn.00464c90
mov ebp, eax
test ebp, ebp
jl 0x4652d7
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x4652d7
cmp byte [ebx], 0x7d
jne 0x464d00
jmp 0x4652d7
mov dword [esp + 0x2c], ebp
jmp 0x464e49
mov esi, dword [esp + 0x14]
push str.NoRemove
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464e75
push ebx
mov eax, esi
mov dword [esp + 0x24], edi
call fcn.00464200
mov ebp, eax
cmp ebp, edi
jl 0x4652d7
mov esi, dword [esp + 0x14]
push 0x4ce2a0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464f85
lea eax, [esp + 0x158]
push eax
mov eax, esi
call fcn.00464200
mov ebp, eax
cmp ebp, edi
jl 0x4652d7
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x4652d7
cmp byte [ebx], 0x3d
jne 0x465280
xor esi, esi
cmp dword [esp + 0x1170], esi
je 0x464f07
mov ecx, dword [esp + 0x24]
push ebx
lea edx, [esp + 0x40]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x18]
push edx
lea edx, [esp + 0x160]
mov dword [esp + 0x48], esi
call fcn.00464340
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
jl 0x465296
mov dword [esp + 0x40], esi
jmp 0x464de9
cmp dword [esp + 0x1174], esi
jne 0x464f71
cmp dword [esp + 0x20], esi
je 0x464f71
mov edx, dword [esp + 0x24]
xor edi, edi
push 0x20006
xor ecx, ecx
lea esi, [esp + 0x38]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.004631b0
cmp eax, edi
jne 0x4652aa
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x158]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, edi
je 0x464f5c
cmp eax, 2
jne 0x4652aa
cmp esi, edi
je 0x464f6b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
xor esi, esi
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00464810
mov ebp, eax
cmp ebp, esi
jmp 0x464e2b
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x464fac
lea ecx, [ecx]
cmp cl, 0x5c
je 0x464fa4
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x464f90
jmp 0x464fac
cmp eax, edi
jne 0x465280
cmp dword [esp + 0x1170], edi
je 0x465092
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0x2001f
push edi
push ebx
push edx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x464ffb
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x464fe9
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x465055
xor edi, edi
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push 0x20019
push edi
push ebx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x46503b
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x46502b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x465055
mov edx, dword [esp + 0x24]
push edx
mov edx, ebx
lea esi, [esp + 0x1c]
call fcn.00463150
mov edi, eax
test edi, edi
jne 0x4652b5
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x4652d7
cmp byte [ebx], 0x3d
jne 0x464de9
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x1c]
push eax
xor edx, edx
call fcn.00464340
mov ebp, eax
test ebp, ebp
jl 0x4652d7
jmp 0x464de9
cmp dword [esp + 0x1174], edi
jne 0x4651ae
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push edi
push ebx
push edx
mov dword [esp + 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4650db
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
je 0x4650cf
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], eax
cmp eax, edi
je 0x4650ee
mov dword [esp + 0x1174], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x58]
push 0x104
push edx
call fcn.004a0369
push eax
call fcn.00462b00
add esp, 0x14
push ebx
mov eax, esi
call fcn.00464200
mov ebp, eax
cmp ebp, edi
jl 0x4652d7
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00464810
mov ebp, eax
test ebp, ebp
jl 0x4652d7
cmp byte [ebx], 0x7b
jne 0x46517c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x46517c
mov edi, dword [esp + 0x1174]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edi
push 0
push eax
push ebx
call fcn.00464c90
mov ebp, eax
test ebp, ebp
jge 0x465168
test edi, edi
je 0x4652d7
mov eax, dword [esp + 0x14]
push ebx
call fcn.00464200
mov ebp, eax
test ebp, ebp
jl 0x4652d7
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1174], eax
cmp ecx, 2
je 0x464e31
test ecx, ecx
je 0x4651bb
test eax, eax
jne 0x464e31
mov eax, ecx
call fcn.00462be0
mov ebp, eax
jmp 0x4652d7
mov dword [esp + 0x30], 2
jmp 0x4650e3
test eax, eax
je 0x4651fc
mov ecx, dword [esp + 0x18]
call fcn.004647d0
test eax, eax
je 0x4651fc
lea ecx, [esp + 0x50]
push ecx
call fcn.00464790
test eax, eax
je 0x464e31
cmp dword [esp + 0x20], 0
je 0x464e31
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x1c]
call fcn.00463250
jmp 0x464e31
mov ecx, dword [esp + 0x18]
call fcn.004647d0
xor edi, edi
mov esi, eax
cmp dword [esp + 0x18], edi
je 0x465224
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
test edi, edi
jne 0x4652b5
cmp dword [esp + 0x20], edi
je 0x464e31
test esi, esi
jne 0x464e31
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x48], esi
lea edi, [esp + 0x50]
lea esi, [esp + 0x44]
mov dword [esp + 0x44], ecx
call fcn.004630f0
xor ecx, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
cmp eax, ecx
jne 0x4652c7
call fcn.004630d0
jmp 0x464e31
lea esi, [esp + 0x28]
call fcn.004630d0
lea esi, [esp + 0x18]
call fcn.004630d0
mov eax, 0x80020009
jmp 0x4652e8
lea esi, [esp + 0x28]
jmp 0x4652d2
lea esi, [esp + 0x3c]
call fcn.004630d0
lea esi, [esp + 0x18]
call fcn.004630d0
jmp 0x4652e6
call fcn.00462be0
lea esi, [esp + 0x34]
jmp 0x4652d0
lea esi, [esp + 0x18]
call fcn.004630d0
mov eax, edi
call fcn.00462be0
jmp 0x4652e8
call fcn.00462be0
lea esi, [esp + 0x44]
mov ebp, eax
call fcn.004630d0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4652e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x115c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ca20
add esp, 0x1154
ret 0x10