Function at 0x4e11d0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59c486
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov edx, dword [ebp + 0x14]
mov eax, esi
mov dword [esp + 0x450], ebx
mov dword [esp + 0x24], edx
call fcn.004e1080
mov edi, eax
cmp edi, ebx
jl 0x4e183d
cmp word [esi], 0x7d
je 0x4e183b
lea ecx, [ecx]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push esi
mov dword [esp + 0x18], 1
call edi
mov ebx, eax
neg ebx
push str.ForceRemove
sbb ebx, ebx
push esi
add ebx, 1
call edi
test eax, eax
je 0x4e1283
test ebx, ebx
je 0x4e1396
mov ecx, dword [esp + 0x1c]
mov eax, esi
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
cmp dword [ebp + 0x10], 0
je 0x4e1396
movzx ecx, word [esi]
test cx, cx
mov dword [esp + 0x18], 0
mov eax, esi
je 0x4e12d8
mov edi, dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, cx
cmp cx, 0x5c
je 0x4e12d0
push eax
call edi
movzx ecx, word [eax]
test cx, cx
jne 0x4e12bd
jmp 0x4e12d8
test eax, eax
jne 0x4e17c5
mov edi, 0x5f5034
lea ecx, [ecx]
mov eax, dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4e1313
add edi, 4
cmp edi, str.CSystemTray
jl 0x4e12e0
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.004e1e70
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x4e1396
mov ebx, dword [esp + 0x1c]
mov eax, esi
mov ecx, ebx
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e17de
mov edi, esi
mov ecx, ebx
call fcn.004e1dc0
mov edi, eax
test edi, edi
jl 0x4e17de
cmp word [esi], 0x7b
jne 0x4e1387
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4e1387
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push 0
push edx
push eax
push esi
mov ecx, ebx
call fcn.004e11d0
mov edi, eax
test edi, edi
jl 0x4e182c
mov eax, esi
mov ecx, ebx
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
cmp word [esi], 0x7d
jne 0x4e1250
jmp 0x4e182c
push str.NoRemove
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e13bf
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, esi
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
push 0x5f5008
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e14c7
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x234]
mov ecx, ebx
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
mov eax, esi
mov ecx, ebx
call fcn.004e1080
mov edi, eax
xor eax, eax
cmp edi, eax
jl 0x4e182c
cmp word [esi], 0x3d
jne 0x4e17ce
cmp dword [ebp + 0x10], eax
je 0x4e1458
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x454], 1
mov dword [esp + 0x14], edx
push ecx
mov ecx, esi
mov edx, ebx
call fcn.004e1870
mov edi, eax
test edi, edi
mov dword [esp + 0x10], 0
jl 0x4e17e4
mov byte [esp + 0x450], 0
jmp 0x4e1341
cmp dword [ebp + 0x14], eax
jne 0x4e14b9
cmp dword [esp + 0x10], eax
je 0x4e14b9
lea edx, [esp + 0x18]
push edx
push 0x20006
push eax
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e181c
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x234]
push ecx
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4e14ae
cmp eax, 2
jne 0x4e181c
test edi, edi
je 0x4e14b9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, esi
mov ecx, ebx
call fcn.004e1dc0
jmp 0x4e137d
movzx ecx, word [esi]
xor edi, edi
cmp cx, di
mov eax, esi
je 0x4e14f5
movzx ecx, cx
cmp cx, 0x5c
je 0x4e14ed
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
cmp cx, di
jne 0x4e14d6
jmp 0x4e14f5
cmp eax, edi
jne 0x4e17ce
cmp dword [ebp + 0x10], edi
je 0x4e1608
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 0x2001f
push edi
push esi
mov dword [esp + 0x20], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call edi
xor ebx, ebx
cmp eax, ebx
jne 0x4e1542
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x4e1532
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x4e15c8
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push esi
push eax
mov dword [esp + 0x24], ebx
call edi
cmp eax, ebx
jne 0x4e157a
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
je 0x4e156e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x4e15c8
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push esi
push ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x4e17f8
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4e15b6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov edx, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0x14], edx
jne 0x4e17f8
mov ecx, dword [esp + 0x1c]
mov eax, esi
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
cmp word [esi], 0x3d
jne 0x4e1341
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004e1870
mov edi, eax
test edi, edi
jl 0x4e182c
jmp 0x4e1341
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
jne 0x4e1710
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push edi
push esi
push edx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4e164b
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, edi
je 0x4e1643
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x4e1658
mov ebx, 1
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x34]
push 0x104
push edx
call fcn.00579a0d
push eax
call fcn.00402660
mov ecx, dword [esp + 0x30]
add esp, 0x14
mov eax, esi
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
mov ecx, dword [esp + 0x1c]
mov edi, esi
call fcn.004e1dc0
mov edi, eax
test edi, edi
jl 0x4e182c
cmp word [esi], 0x7b
jne 0x4e16e4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x4e16e4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push ebx
push 0
push eax
push esi
call fcn.004e11d0
mov edi, eax
test edi, edi
jge 0x4e16cf
test ebx, ebx
je 0x4e182c
mov ecx, dword [esp + 0x1c]
mov eax, esi
call fcn.004e1080
mov edi, eax
test edi, edi
jl 0x4e182c
mov eax, dword [esp + 0x18]
cmp eax, 2
mov ecx, dword [esp + 0x24]
mov dword [ebp + 0x14], ecx
je 0x4e1387
test eax, eax
je 0x4e171d
test ecx, ecx
jne 0x4e1387
call fcn.004e2040
mov edi, eax
jmp 0x4e182c
mov dword [esp + 0x18], 2
jmp 0x4e1653
test ecx, ecx
mov ebx, dword [esp + 0x14]
je 0x4e175d
mov ecx, ebx
call fcn.004e1fc0
test eax, eax
je 0x4e175d
lea ebx, [esp + 0x2c]
call fcn.004e1e30
test eax, eax
je 0x4e1387
cmp dword [esp + 0x10], 0
je 0x4e1387
mov edx, ebx
push edx
lea ecx, [esp + 0x18]
call fcn.004e1e70
jmp 0x4e1387
mov ecx, ebx
call fcn.004e1fc0
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x4e1785
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], 0
jne 0x4e180a
cmp dword [esp + 0x10], 0
je 0x4e1387
cmp dword [esp + 0x18], 0
jne 0x4e1387
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov dword [esp + 0x10], 0
jne 0x4e181c
lea ecx, [esp + 0x10]
call fcn.004e2020
jmp 0x4e1387
lea ecx, [esp + 0x18]
call fcn.004e2020
lea ecx, [esp + 0x14]
call fcn.004e2020
mov eax, 0x80020009
jmp 0x4e183d
lea ecx, [esp + 0x18]
jmp 0x4e1827
lea ecx, [esp + 0x10]
call fcn.004e2020
lea ecx, [esp + 0x14]
call fcn.004e2020
jmp 0x4e183b
lea ecx, [esp + 0x14]
call fcn.004e2020
mov eax, edi
call fcn.004e2040
jmp 0x4e183d
lea ecx, [esp + 0x14]
call fcn.004e2020
mov eax, ebx
call fcn.004e2040
jmp 0x4e183d
call fcn.004e2040
mov edi, eax
lea ecx, [esp + 0x10]
call fcn.004e2020
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4e183b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00577139
mov esp, ebp
pop ebp
ret 0x10