Function at 0x488443
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x6122a2
call fcn.0060bd28
mov eax, 0x2250
call fcn.0060b390
mov eax, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ee
push ebx
push 0x7d
pop eax
cmp word [edi], ax
je 0x4888ed
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x6950b0
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4884bd
test ebx, ebx
je 0x488560
mov ecx, dword [ebp - 0x10]
push edi
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x488562
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.00487c3a
test eax, eax
jne 0x4888e0
push edi
call fcn.0048810e
test eax, eax
je 0x48851e
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.0048813d
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
test ebx, ebx
je 0x488556
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888db
push edi
mov ecx, ebx
call fcn.004880bb
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004165ef
test esi, esi
js 0x4888ed
jmp 0x48888c
lea ecx, [ebp - 0x20]
call fcn.004165ef
jmp 0x488562
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x10]
test eax, eax
jne 0x48858a
push edi
mov ecx, ebx
mov dword [ebp + 8], esi
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
push 0x6950a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x488683
lea eax, [ebp - 0x225c]
mov ecx, ebx
push eax
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
push edi
mov ecx, ebx
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4888e8
cmp dword [ebp + 0x10], 0
je 0x488621
xor eax, eax
mov ecx, ebx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x225c]
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00487d40
mov esi, eax
lea ecx, [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
test esi, esi
js 0x488916
mov byte [ebp - 4], al
jmp 0x488887
cmp dword [ebp + 0x14], 0
jne 0x488676
cmp dword [ebp + 8], 0
je 0x488676
xor eax, eax
lea ecx, [ebp - 0x54]
push 0x20006
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
call fcn.00416598
test eax, eax
jne 0x48890a
lea eax, [ebp - 0x225c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x48866e
cmp eax, 2
jne 0x48890a
lea ecx, [ebp - 0x54]
call fcn.004165ef
push edi
mov ecx, ebx
call fcn.004880bb
jmp 0x4888d0
push 0x5c
pop edx
mov ecx, edi
call fcn.00487c3a
test eax, eax
jne 0x4888e8
cmp dword [ebp + 0x10], eax
je 0x48870b
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
push 0x2001f
push edi
push esi
call fcn.00416598
test eax, eax
je 0x4886d8
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.00416598
test eax, eax
je 0x4886d8
sub esp, 0x14
lea ecx, [ebp - 0x2c]
push edi
push esi
call fcn.0041660e
test eax, eax
jne 0x4887d9
push edi
mov ecx, ebx
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
push 0x3d
pop eax
cmp word [edi], ax
jne 0x48888c
push edi
push 0
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.00487d40
mov esi, eax
jmp 0x488549
cmp dword [ebp + 0x14], 0
jne 0x488724
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.00416598
jmp 0x488727
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x14], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x25c]
push edi
push 0x104
push eax
mov dword [ebp - 0x30], ecx
call fcn.005f3b9d
push eax
call fcn.00404ada
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
push edi
mov ecx, ebx
call fcn.004880bb
mov esi, eax
test esi, esi
js 0x4888ed
push 0x7b
pop eax
cmp word [edi], ax
jne 0x4887bf
push edi
call fcn.005f0038
pop ecx
cmp eax, 1
jne 0x4887bf
push dword [ebp - 0x30]
mov ecx, ebx
push 0
push dword [ebp - 0x2c]
push edi
call fcn.00488443
mov esi, eax
test esi, esi
jns 0x4887ad
cmp dword [ebp - 0x30], 0
je 0x4888ed
push edi
mov ecx, ebx
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x488482
test eax, eax
je 0x4887e7
cmp dword [ebp + 0x14], 0
jne 0x488482
mov ecx, eax
call fcn.004890ce
mov esi, eax
jmp 0x4888ed
cmp dword [ebp + 0x14], 0
je 0x48882b
push dword [ebp - 0x2c]
call fcn.004881eb
test eax, eax
je 0x48882b
lea eax, [ebp - 0x25c]
push eax
call fcn.0048810e
test eax, eax
je 0x488482
cmp dword [ebp + 8], 0
je 0x488482
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0048813d
jmp 0x488482
push dword [ebp - 0x2c]
call fcn.004881eb
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
call fcn.004165ef
test eax, eax
jne 0x4887d9
cmp dword [ebp + 8], eax
je 0x488482
cmp dword [ebp - 0x14], eax
jne 0x488482
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00488274
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
test eax, eax
jne 0x48891d
lea ecx, [ebp - 0x48]
call fcn.004165ef
cmp dword [ebp + 0x10], 0
je 0x488482
push 0x7b
pop eax
cmp word [edi], ax
jne 0x488482
push edi
call fcn.005f0038
pop ecx
cmp eax, 1
jne 0x488482
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2c]
push edi
call fcn.00488443
mov esi, eax
test esi, esi
js 0x4888ed
push edi
mov ecx, ebx
call fcn.004882ed
mov esi, eax
test esi, esi
js 0x4888ed
jmp 0x488482
lea ecx, [ebp - 0x20]
jmp 0x488916
lea ecx, [ebp - 0x20]
call fcn.004165ef
mov esi, 0x80020009
pop ebx
lea ecx, [ebp - 0x2c]
call fcn.004165ef
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, eax
call fcn.004890ce
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.004165ef
jmp 0x4888ed
mov ecx, eax
call fcn.004890ce
lea ecx, [ebp - 0x48]
jmp 0x488914