Function at 0x4d8b90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2238
call fcn.0064e0b0
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.00650600
add esp, 0xc
mov ecx, esi
push ebx
call fcn.0068c3c0
mov dword [ebp - 0x223c], eax
test eax, eax
js 0x4d9718
mov dword [ebp - 0x2238], esi
cmp word [ebx], 0x7d
je 0x4d9718
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push ebx
mov esi, ecx
call ecx
mov edi, eax
push 0x7455e8
push ebx
call esi
test eax, eax
je 0x4d8e72
test edi, edi
je 0x4d8e72
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.NoRemove
push ebx
mov esi, ecx
call ecx
mov edi, eax
test eax, eax
je 0x4d8ed5
mov dword [ebp - 0x2240], edi
test edi, edi
mov edi, ebx
setne bl
push 0x7455e0
push edi
call esi
test eax, eax
je 0x4d8eee
test edi, edi
mov ebx, edi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x4d8c8a
mov eax, ebx
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x4d8c82
test ecx, ecx
je 0x4d8c8a
push eax
call esi
jmp 0x4d8c71
test eax, eax
jne 0x4d9704
cmp dword [ebp + 0x10], 0
jne 0x4d8d09
mov edx, 2
cmp dword [ebp + 0x14], 0
jne 0x4d9067
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
jne 0x4d8d7c
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
test eax, eax
jne 0x4d9067
mov eax, dword [ebp - 0x2224]
xor edx, edx
test eax, eax
je 0x4d8cee
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x4d9067
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x4d8d2c
cmp dword [edi], 0
jne 0x4d8d99
cmp dword [edi + 4], 0
je 0x4d8dbc
lea eax, [ebp - 0x2218]
push eax
push 0x2001f
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d8dbc
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4d8e0d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
jne 0x4d8dbc
jmp 0x4d8f95
cmp dword [edi], 0
jne 0x4d903e
cmp dword [edi + 4], 0
mov edx, 1
jne 0x4d8cb7
jmp 0x4d9067
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d8dbc
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4d9347
mov dword [ebp - 0x2218], 0
mov edi, dword [ebp - 0x221c]
test edi, edi
je 0x4d8ddf
cmp dword [edi], 0
jne 0x4d8e28
cmp dword [edi + 4], 0
je 0x4d8f61
lea eax, [ebp - 0x2218]
push eax
push 0x20019
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d8f61
mov eax, dword [ebp - 0x2224]
test eax, eax
jne 0x4d8f40
mov eax, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x2220], 0
jmp 0x4d8f95
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d8f61
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d8f61
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x4d8df7
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c3c0
mov esi, eax
test eax, eax
js 0x4d9712
cmp dword [ebp + 0x10], 0
je 0x4d8c2c
mov dword [ebp - 0x2234], esi
xor eax, eax
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x2210], eax
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_CharNextW]
je 0x4d9383
mov eax, ebx
movzx ecx, word [eax]
test ecx, ecx
je 0x4d9383
cmp ecx, 0x5c
je 0x4d936d
push eax
call esi
jmp 0x4d8ebc
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c3c0
test eax, eax
jns 0x4d8c46
jmp 0x4d9710
push 0x2000
push 0xff
lea esi, [ebp - 0x2218]
push esi
call fcn.00650600
add esp, 0xc
mov ecx, dword [ebp - 0x2238]
push esi
call fcn.0068c3c0
mov edx, 3
test eax, eax
jns 0x4d954a
mov esi, eax
mov ebx, edi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test edx, edx
je 0x4d953b
cmp edx, 2
je 0x4d953b
jmp 0x4d975b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2218]
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], 0
test eax, eax
je 0x4d8f95
sub esp, 0x1c
movaps xmm0, xmmword [0x74a520]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 0x18], 0
lea ecx, [ebp - 0x2224]
call fcn.004d9e80
test eax, eax
jne 0x4d974a
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c3c0
mov esi, eax
test eax, eax
js 0x4d9712
movzx eax, word [ebx]
cmp ax, 0x3d
jne 0x4d8fde
mov ecx, dword [ebp - 0x2238]
push ebx
push 0
lea eax, [ebp - 0x2224]
push eax
call fcn.004d99e0
mov esi, eax
test eax, eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
js 0x4d9712
movzx eax, word [ebx]
jmp 0x4d8fe4
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp ax, 0x7b
jne 0x4d953b
push ebx
call fcn.0066b526
add esp, 4
cmp eax, 1
jne 0x4d9535
mov edi, dword [ebp - 0x2238]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x2224]
push ebx
call fcn.004d8b90
test eax, eax
js 0x4d9710
mov ecx, edi
push ebx
call fcn.0068c3c0
mov esi, eax
test eax, eax
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jns 0x4d953b
jmp 0x4d9712
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
inc edx
test eax, eax
je 0x4d9067
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
inc edx
test eax, eax
jne 0x4d94b0
mov dword [ebp - 0x2234], edx
test edx, edx
mov edi, 1
cmove edi, dword [ebp + 0x14]
push 0xffffffffffffffff
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0066bf07
add esp, 0x10
mov esi, ebx
cmp eax, 0x15
jle 0x4d90a0
cmp eax, 0x50
je 0x4d90a8
jmp 0x4d978c
test eax, eax
jne 0x4d97a0
mov ebx, dword [ebp - 0x2238]
mov ecx, ebx
push esi
call fcn.0068c3c0
test eax, eax
js 0x4d9710
mov dword [ebp - 0x2244], edi
mov ecx, ebx
push esi
call fcn.0068c5a0
mov edi, eax
test eax, eax
js 0x4d9746
mov ebx, esi
cmp word [esi], 0x7b
jne 0x4d913a
push ebx
call fcn.0066b526
add esp, 4
cmp eax, 1
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edi
mov edi, dword [ebp - 0x2244]
jne 0x4d9142
mov ecx, dword [ebp - 0x2238]
push edi
push 0
push dword [ebp - 0x2224]
push ebx
call fcn.004d8b90
test eax, eax
jns 0x4d911d
mov esi, eax
test edi, edi
je 0x4d9712
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c3c0
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
test eax, eax
jns 0x4d9142
jmp 0x4d9712
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edi
mov eax, dword [ebp - 0x2234]
cmp eax, 2
je 0x4d953b
test eax, eax
je 0x4d9164
cmp dword [ebp + 0x14], 0
jne 0x4d953b
jmp 0x4d9762
cmp dword [ebp + 0x14], 0
je 0x4d92c1
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4d92c1
cmp dword [ebp - 0x2218], 0
je 0x4d92c1
mov dword [ebp - 0x2234], esi
push str.AppID
lea esi, [ebp - 0x218]
push esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call edi
test eax, eax
je 0x4d94a3
push str.CLSID
push esi
call edi
test eax, eax
je 0x4d94a3
push str.Component_Categories
push esi
call edi
test eax, eax
je 0x4d94a3
push str.FileType
push esi
call edi
test eax, eax
je 0x4d94a3
push str.Interface
push esi
call edi
test eax, eax
je 0x4d94a3
push str.Hardware
push esi
call edi
test eax, eax
je 0x4d94a3
push str.Mime
push esi
call edi
test eax, eax
je 0x4d94a3
push 0x7456a4
push esi
call edi
test eax, eax
je 0x4d94a3
push str.SECURITY
push esi
call edi
test eax, eax
je 0x4d94a3
push str.SYSTEM
push esi
call edi
test eax, eax
je 0x4d92b6
push str.Software
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4d92b6
push str.TypeLib
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4d92b6
cmp dword [ebp - 0x2240], 0
je 0x4d92b6
lea ecx, [ebp - 0x2224]
lea eax, [ebp - 0x218]
push eax
call fcn.004d98a0
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x4d94a5
mov edi, ebx
mov eax, dword [ebp - 0x2224]
xor ecx, ecx
mov dword [ebp - 0x2218], ecx
sub esp, 0x30
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
lea edx, [ebp - 0x2218]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor ecx, ecx
test eax, eax
sete bl
cmp dword [ebp - 0x2218], ecx
setne bh
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4d94d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x2224], ecx
mov dword [ebp - 0x2220], ecx
test eax, eax
je 0x4d94e0
jmp 0x4d974a
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x2001f
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x4d8d44
test eax, eax
je 0x4d9383
mov dword [ebp - 0x223c], 0x80020009
xor edx, edx
inc edx
jmp 0x4d946c
push str.AppID
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
test eax, eax
je 0x4d9462
push str.CLSID
push ebx
call esi
test eax, eax
je 0x4d9462
push str.Component_Categories
push ebx
call esi
test eax, eax
je 0x4d9462
push str.FileType
push ebx
call esi
test eax, eax
je 0x4d9462
push str.Interface
push ebx
call esi
test eax, eax
je 0x4d9462
push str.Hardware
push ebx
call esi
test eax, eax
je 0x4d9462
push str.Mime
push ebx
call esi
test eax, eax
je 0x4d9462
push 0x7456a4
push ebx
call esi
test eax, eax
je 0x4d9462
push str.SECURITY
push ebx
call esi
test eax, eax
je 0x4d9462
push str.SYSTEM
push ebx
call esi
test eax, eax
je 0x4d9462
push str.Software
push ebx
call esi
test eax, eax
je 0x4d9462
push str.TypeLib
push ebx
call esi
test eax, eax
je 0x4d9462
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
xor esi, esi
mov dword [ebp - 0x2214], esi
mov dword [ebp - 0x2210], esi
lea ecx, [ebp - 0x2218]
push ebx
call fcn.004d98a0
mov dword [ebp - 0x2218], esi
mov dword [ebp - 0x2214], esi
mov dword [ebp - 0x2210], esi
xor edx, edx
test edi, edi
je 0x4d95c4
mov esi, dword [ebp - 0x2234]
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x4d9487
push eax
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
cmp edx, 4
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x4d8fd9
test edx, edx
je 0x4d8c32
jmp 0x4d8f2a
mov ecx, edi
mov esi, dword [ebp - 0x2234]
jmp 0x4d953b
mov ecx, eax
mov edi, dword [edi]
call dword [section..00cfg]
xor eax, eax
push eax
push edi
lea edx, [ebp - 0x2218]
push edx
push 0x20019
push eax
push ebx
push dword [ebp + 0xc]
call ecx
jmp 0x4d8ccf
mov dword [ebp - 0x2220], 0
and bl, bh
cmp dword [ebp - 0x2240], 0
sete al
or al, bl
jne 0x4d9533
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2218], eax
mov dword [ebp - 0x2214], ecx
mov dword [ebp - 0x2210], ecx
xor ebx, ebx
lea ecx, [ebp - 0x2218]
lea eax, [ebp - 0x218]
push eax
call fcn.004d9f90
mov dword [ebp - 0x2218], ebx
mov dword [ebp - 0x2214], ebx
mov dword [ebp - 0x2210], ebx
test eax, eax
jne 0x4d976a
mov ebx, edi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp word [ebx], 0x7d
jne 0x4d8c08
jmp 0x4d9712
mov ecx, dword [ebp - 0x2238]
mov esi, edi
push edi
call fcn.0068c3c0
mov edx, eax
test eax, eax
js 0x4d95e4
cmp word [esi], 0x3d
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jne 0x4d95f8
cmp dword [ebp + 0x10], 0
je 0x4d9610
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2230], eax
xor eax, eax
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x2238]
mov ebx, edi
push edi
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x2230]
push eax
call fcn.004d99e0
mov esi, eax
test eax, eax
js 0x4d96a1
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x4d8fd9
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c3c0
test eax, eax
jns 0x4d96af
mov esi, eax
mov edx, 3
jmp 0x4d9472
mov ebx, esi
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edx
mov edx, 3
jmp 0x4d8f2a
mov dword [ebp - 0x223c], 0x80020009
xor eax, eax
inc eax
mov ebx, edi
mov esi, edx
mov edx, eax
jmp 0x4d8f2a
cmp dword [ebp + 0x14], 0
sete al
and al, bl
cmp al, 1
jne 0x4d96ca
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x2230], ebx
lea eax, [ebp - 0x2230]
push eax
push 0x20006
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d964c
mov ebx, dword [ebp - 0x2230]
jne 0x4d96ed
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x4d96ed
xor edx, edx
mov al, 1
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test ebx, ebx
je 0x4d9696
push ebx
mov ebx, edx
mov dword [ebp - 0x2240], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2240]
mov edx, ebx
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test al, al
jne 0x4d96ca
mov ebx, edi
jmp 0x4d8f2a
mov dword [ebp - 0x223c], esi
xor edx, edx
inc edx
jmp 0x4d8f24
mov ecx, dword [ebp - 0x2238]
push ebx
call fcn.0068c5a0
mov esi, eax
mov edx, eax
sar edx, 0x1f
add edx, 4
jmp 0x4d9472
mov ecx, dword [ebp - 0x2238]
mov ebx, edi
push edi
call fcn.0068c5a0
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
mov edx, eax
shr edx, 0x1f
or edx, 2
jmp 0x4d8f2a
push eax
call fcn.0068c660
mov edx, 3
add esp, 4
mov esi, eax
xor eax, eax
jmp 0x4d966f
mov dword [ebp - 0x223c], 0x80020009
jmp 0x4d9718
mov esi, eax
mov dword [ebp - 0x223c], esi
mov eax, dword [ebp - 0x2224]
test eax, eax
je 0x4d9729
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, dword [ebp - 0x223c]
add esp, 0x2238
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, edi
jmp 0x4d9712
push eax
call fcn.0068c660
add esp, 4
mov dword [ebp - 0x223c], eax
jmp 0x4d9718
cmp edx, 3
je 0x4d9712
jmp 0x4d9718
push dword [ebp - 0x2234]
jmp 0x4d974b
push eax
call fcn.0068c660
add esp, 4
mov dword [ebp - 0x223c], eax
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x4d9718
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d9718
cmp eax, 0x16
je 0x4d9796
cmp eax, 0x22
jne 0x4d97af
push 0x80070057
call fcn.006a9890
cmp eax, 0xc
jne 0x4d97af
push 0x8007000e
call fcn.006a9890
push 0x80004005
call fcn.006a9890
int3