Function at 0x498ec0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581428
mov eax, dword fs:[0]
push eax
mov eax, 0x8490
call fcn.00565240
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.00402270
mov dword [ebp - 0x825c], eax
lea eax, [ebp - 0x28]
push eax
push 0x2001f
push 0
push 0x597c70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x498f4b
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x8489], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x8489]
jmp 0x499286
mov dword [ebp - 0x20], 0
mov dx, word [0x597d48]
mov word [ebp - 0x8244], dx
push 0x206
push 0
lea eax, [ebp - 0x8242]
push eax
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x803c], 0
mov dword [ebp - 0x8248], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x8258], 0
mov dword [ebp - 0x8254], 0
mov dword [ebp - 0x8038], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x8264], 0x3fff
lea ecx, [ebp - 0x8250]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x8038]
push eax
lea ecx, [ebp - 0x8254]
push ecx
lea edx, [ebp - 0x8258]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8248]
push ecx
lea edx, [ebp - 0x803c]
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x8244]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x499048
mov byte [ebp - 0x848a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x848a]
jmp 0x499286
cmp dword [ebp - 0x8258], 0
je 0x499260
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
jmp 0x49906e
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x8258]
jae 0x499260
mov dword [ebp - 0x8264], 0x3fff
xor edx, edx
mov word [ebp - 0x8034], dx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8264]
push eax
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x49925b
xor ecx, ecx
mov word [ebp - 0x8464], cx
push 0x1fc
push 0
lea edx, [ebp - 0x8462]
push edx
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x846c], 0xff
lea eax, [ebp - 0x846c]
push eax
lea ecx, [ebp - 0x8464]
push ecx
push 0x61f6b0
push 0
lea edx, [ebp - 0x8034]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x8468], eax
cmp dword [ebp - 0x8468], 0
jne 0x49923d
lea ecx, [ebp - 0x8464]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
jne 0x49913e
mov dword [ebp - 0x8494], 0
jmp 0x4991a2
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x499163
mov dword [ebp - 0x8498], 0
jmp 0x499196
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x849c], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x849c]
push eax
call fcn.004022d0
mov dword [ebp - 0x8498], eax
mov ecx, dword [ebp - 0x8498]
mov dword [ebp - 0x8494], ecx
mov edx, dword [ebp - 0x8494]
push edx
lea ecx, [ebp - 0x8488]
call fcn.00405ef0
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x8488]
call fcn.004191e0
cmp eax, dword [0x60123c]
je 0x499230
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x8468], eax
cmp dword [ebp - 0x8468], 0
je 0x499218
mov byte [ebp - 0x848b], 0
lea ecx, [ebp - 0x8488]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x848b]
jmp 0x499286
mov eax, dword [ebp - 0x8258]
sub eax, 1
mov dword [ebp - 0x8258], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x8488]
call fcn.00405f70
jmp 0x49925b
mov byte [ebp - 0x848c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x848c]
jmp 0x499286
jmp 0x499065
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x848d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x848d]
lea esp, [ebp - 0x84a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret