Function at 0x48fd16
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x4c0b78
call fcn.004bf97c
sub esp, 0x218
and dword [ebp - 0x10], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jge 0x48fd4e
jmp 0x4900aa
cmp byte [ebx], 0x7d
push edi
je 0x4900a7
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.Delete
push ebx
mov dword [ebp - 0x18], 1
call esi
mov edi, eax
neg edi
push str.ForceRemove
sbb edi, edi
push ebx
inc edi
call esi
test eax, eax
je 0x48fd84
test edi, edi
je 0x48fdf0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
cmp dword [ebp + 0x10], 0
je 0x48fdf0
push 0x5c
mov eax, ebx
call fcn.0048f5de
test eax, eax
pop ecx
jne 0x490175
push ebx
call fcn.0048fa51
test eax, eax
je 0x48fdc9
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.0046c590
test edi, edi
je 0x48fdf0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0048fab2
jmp 0x48ffcd
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x48fe17
and dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
push 0x4cae30
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x48ff3c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x224]
call fcn.0048f633
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x490098
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
cmp esi, edi
jl 0x490098
cmp byte [ebx], 0x3d
jne 0x490138
cmp dword [ebp + 0x10], edi
je 0x48fee1
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp + 8], eax
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
call fcn.0048f715
mov esi, eax
cmp esi, edi
jl 0x49013d
mov byte [ebp - 4], 0
cmp byte [ebx], 0x7b
jne 0x48fed3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jne 0x48fed3
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ebx
call fcn.0048fd16
mov esi, eax
test esi, esi
jl 0x490098
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
cmp byte [ebx], 0x7d
jne 0x48fd58
jmp 0x490098
cmp dword [ebp + 0x14], edi
jne 0x48ff30
cmp dword [ebp - 0x18], edi
je 0x48ff30
push 0x20006
push edi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.00401221
cmp eax, edi
jne 0x490157
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48ff25
cmp eax, 2
jne 0x490145
test edi, edi
je 0x48ff30
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0048fab2
jmp 0x48fec9
push 0x5c
mov eax, ebx
call fcn.0048f5de
test eax, eax
pop ecx
jne 0x490175
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x48ffdc
push 0x2001f
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.00401221
test eax, eax
je 0x48ffa1
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.00401221
test eax, eax
je 0x48ffa1
push esi
push 0x2001f
push esi
push esi
push ebx
push dword [ebp + 0xc]
xor edi, edi
lea eax, [ebp - 0x10]
call fcn.0046c4ce
cmp eax, esi
jne 0x490091
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
cmp byte [ebx], 0x3d
jne 0x48fe93
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.0048f715
mov esi, eax
test esi, esi
jl 0x490098
jmp 0x48fe93
cmp dword [ebp + 0x14], esi
jne 0x48fff7
push 0x20019
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
call fcn.00401221
mov dword [ebp + 8], eax
jmp 0x48fffe
mov dword [ebp + 8], 2
cmp dword [ebp + 8], esi
je 0x49000a
mov dword [ebp + 0x14], 1
push 0x104
push ebx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
mov ecx, dword [ebp - 0x14]
mov edi, ebx
call fcn.0048fab2
mov esi, eax
test esi, esi
jl 0x490098
cmp byte [ebx], 0x7b
jne 0x49006f
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
push ebx
call fcn.0048fd16
mov esi, eax
test esi, esi
jge 0x49005f
cmp dword [ebp + 0x14], 0
je 0x490098
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0048f633
mov esi, eax
test esi, esi
jl 0x490098
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x14], eax
je 0x48fed3
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
je 0x4900ba
cmp dword [ebp - 0x1c], edi
jne 0x48fed3
call fcn.0048e9e2
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x4900a7
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
cmp dword [ebp - 0x1c], edi
je 0x4900fd
push dword [ebp - 0x10]
call fcn.0048fa7d
test eax, eax
je 0x4900fd
lea eax, [ebp - 0x120]
push eax
call fcn.0048fa51
test eax, eax
je 0x48fed3
cmp dword [ebp - 0x18], 0
je 0x48fed3
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x10]
call fcn.0046c590
jmp 0x48fed3
cmp dword [ebp - 0x10], edi
je 0x490112
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov dword [ebp - 0x10], edi
jne 0x49018e
cmp dword [ebp - 0x18], edi
je 0x48fed3
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x490091
jmp 0x48fed3
cmp dword [ebp - 0x10], edi
jmp 0x490179
cmp dword [ebp - 0x10], edi
jmp 0x49009c
call fcn.0048e9e2
test edi, edi
mov esi, eax
je 0x490098
push edi
jmp 0x49016a
call fcn.0048e9e2
cmp dword [ebp + 8], edi
mov esi, eax
je 0x490098
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x490098
cmp dword [ebp - 0x10], 0
je 0x490184
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4900a9
call fcn.0048e9e2
jmp 0x4900a9