Function at 0x4b6d9b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b7d1
mov eax, dword fs:[0]
push eax
mov eax, 0x1158
call fcn.004ec330
mov eax, dword [0x559540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1120], ecx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x1138]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x111c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1130], eax
mov dword [ebp - 4], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x1164], eax
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
cmp byte [ebx], 0x7d
je 0x4b73a0
xor eax, eax
inc eax
push str.Delete
push ebx
mov dword [ebp - 0x113c], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
push str.ForceRemove
sbb esi, esi
inc esi
push ebx
mov dword [ebp - 0x1118], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4b6e5d
test esi, esi
je 0x4b6f3a
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x4b6f3c
xor eax, eax
lea edi, [ebp - 0x112c]
stosd dword es:[edi], eax
push 0x5c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x112c], esi
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x1124], esi
call fcn.004b7883
pop ecx
pop ecx
test eax, eax
jne 0x4b7390
mov edi, dword [ebp - 0x1120]
mov ecx, edi
push ebx
call fcn.004b4c15
test eax, eax
je 0x4b6ef1
mov eax, dword [ebp - 0x111c]
lea ecx, [ebp - 0x112c]
push ebx
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x1124], esi
call fcn.004b67dc
mov dword [ebp - 0x112c], esi
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x1124], esi
cmp dword [ebp - 0x1118], esi
je 0x4b6f2d
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b7388
push ebx
mov ecx, edi
call fcn.004b77fb
lea ecx, [ebp - 0x112c]
mov esi, eax
call fcn.004b4ef2
test esi, esi
js 0x4b73a0
jmp 0x4b7333
lea ecx, [ebp - 0x112c]
call fcn.004b4ef2
jmp 0x4b6f3c
xor esi, esi
push str.NoRemove
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4b6f64
push ebx
mov ecx, edi
mov dword [ebp - 0x113c], esi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
push 0x5104f0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4b70b4
lea eax, [ebp - 0x1114]
mov ecx, edi
push eax
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
cmp byte [ebx], 0x3d
jne 0x4b739b
cmp dword [ebp + 0x10], 0
je 0x4b7029
xor eax, eax
lea edi, [ebp - 0x1154]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1120]
xor eax, eax
and dword [ebp - 0x1150], 0
inc eax
and dword [ebp - 0x114c], 0
mov ecx, edi
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x1154], eax
lea eax, [ebp - 0x1114]
push ebx
push eax
lea eax, [ebp - 0x1154]
push eax
call fcn.004b42d1
mov esi, eax
lea ecx, [ebp - 0x1154]
xor eax, eax
mov dword [ebp - 0x1154], eax
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], eax
test esi, esi
js 0x4b73da
mov byte [ebp - 4], al
call fcn.004b4ef2
jmp 0x4b7333
cmp dword [ebp + 0x14], 0
jne 0x4b70a7
cmp dword [ebp - 0x113c], 0
je 0x4b70a7
xor eax, eax
lea edi, [ebp - 0x1160]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1160]
push 0x20006
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push dword [ebp - 0x111c]
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x115c], eax
mov dword [ebp - 0x1158], eax
call fcn.004b63ca
test eax, eax
jne 0x4b73cb
lea eax, [ebp - 0x1114]
push eax
push dword [ebp - 0x1160]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4b7096
cmp eax, 2
jne 0x4b73cb
lea ecx, [ebp - 0x1160]
call fcn.004b4ef2
mov edi, dword [ebp - 0x1120]
push ebx
mov ecx, edi
call fcn.004b77fb
jmp 0x4b7374
push 0x5c
push ebx
call fcn.004b7883
pop ecx
pop ecx
test eax, eax
jne 0x4b739b
cmp dword [ebp + 0x10], eax
je 0x4b7154
mov esi, dword [ebp - 0x111c]
lea ecx, [ebp - 0x1138]
push 0x2001f
push ebx
push esi
call fcn.004b63ca
test eax, eax
je 0x4b7121
push 0x20019
push ebx
push esi
lea ecx, [ebp - 0x1138]
call fcn.004b63ca
test eax, eax
je 0x4b7121
xor eax, eax
lea ecx, [ebp - 0x1138]
push eax
push eax
push 0x2001f
push eax
push eax
push ebx
push esi
call fcn.004b4f0c
test eax, eax
jne 0x4b723c
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
cmp byte [ebx], 0x3d
jne 0x4b7333
push ebx
push 0
lea eax, [ebp - 0x1138]
mov ecx, edi
push eax
call fcn.004b42d1
mov esi, eax
jmp 0x4b6f20
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x4b7174
push 0x20019
push ebx
push dword [ebp - 0x111c]
lea ecx, [ebp - 0x1138]
call fcn.004b63ca
jmp 0x4b7177
push 2
pop eax
push 1
test eax, eax
mov dword [ebp - 0x1118], eax
pop eax
push 0xffffffffffffffff
cmovne esi, eax
lea eax, [ebp - 0x114]
push ebx
push 0x104
push eax
mov dword [ebp + 0x14], esi
call fcn.004ebb92
push eax
call fcn.004b4a42
add esp, 0x14
mov ecx, edi
push ebx
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
push ebx
mov ecx, edi
call fcn.004b77fb
mov esi, eax
test esi, esi
js 0x4b73a0
cmp byte [ebx], 0x7b
jne 0x4b7218
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b71d3
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x4b7218
push dword [ebp + 0x14]
mov ecx, edi
push 0
push dword [ebp - 0x1138]
push ebx
call fcn.004b6d9b
mov esi, eax
test esi, esi
jns 0x4b7206
cmp dword [ebp + 0x14], 0
je 0x4b73a0
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1164]
mov dword [ebp + 0x14], ecx
cmp eax, 2
je 0x4b737a
test eax, eax
je 0x4b724a
test ecx, ecx
jne 0x4b737a
push eax
call fcn.004b4ab2
pop ecx
mov esi, eax
jmp 0x4b73a0
test ecx, ecx
je 0x4b7299
push dword [ebp - 0x1138]
mov ecx, edi
call fcn.004b5bdc
test eax, eax
je 0x4b7299
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call fcn.004b4c15
test eax, eax
je 0x4b737a
cmp dword [ebp - 0x113c], 0
je 0x4b737a
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1138]
call fcn.004b67dc
jmp 0x4b737a
push dword [ebp - 0x1138]
mov ecx, edi
call fcn.004b5bdc
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x1118], eax
call fcn.004b4ef2
test eax, eax
jne 0x4b723c
cmp dword [ebp - 0x113c], eax
je 0x4b737a
cmp dword [ebp - 0x1118], eax
jne 0x4b737a
lea edi, [ebp - 0x1148]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1148]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x111c]
xor edi, edi
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x1144], edi
mov dword [ebp - 0x1140], edi
call fcn.004b5212
mov dword [ebp - 0x1148], edi
mov dword [ebp - 0x1144], edi
mov dword [ebp - 0x1140], edi
test eax, eax
jne 0x4b73e1
lea ecx, [ebp - 0x1148]
call fcn.004b4ef2
mov edi, dword [ebp - 0x1120]
cmp dword [ebp + 0x10], 0
je 0x4b737a
cmp byte [ebx], 0x7b
jne 0x4b737a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b7343
xor eax, eax
sub ecx, edx
inc eax
cmp ecx, eax
jne 0x4b737d
push 0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x1138]
push ebx
call fcn.004b6d9b
mov esi, eax
test esi, esi
js 0x4b73a0
push ebx
mov ecx, edi
call fcn.004b62b9
mov esi, eax
test esi, esi
js 0x4b73a0
xor eax, eax
inc eax
cmp byte [ebx], 0x7d
jne 0x4b6e28
jmp 0x4b73a0
lea ecx, [ebp - 0x112c]
jmp 0x4b73da
lea ecx, [ebp - 0x112c]
call fcn.004b4ef2
mov esi, 0x80020009
lea ecx, [ebp - 0x1138]
call fcn.004b4ef2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ebd2c
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.004b4ab2
pop ecx
lea ecx, [ebp - 0x1160]
mov esi, eax
call fcn.004b4ef2
jmp 0x4b73a0
push eax
call fcn.004b4ab2
pop ecx
lea ecx, [ebp - 0x1148]
jmp 0x4b73d8