Function at 0x483c22
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2260
call fcn.004915a0
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x2210], ecx
mov dword [ebp - 0x2224], eax
mov dword [ebp - 0x221c], ebx
mov dword [ebp - 0x2218], ebx
mov dword [ebp - 0x2214], ebx
mov dword [ebp - 0x2238], edx
call fcn.004824d0
mov esi, eax
cmp esi, ebx
jl 0x483e30
cmp word [edi], 0x7d
je 0x483e2e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Delete
push edi
mov dword [ebp - 0x2234], 1
call esi
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x483824
test ebx, ebx
je 0x483970
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
xor edx, edx
cmp dword [ebp + 0x10], edx
je 0x483970
movzx ecx, word [edi]
mov dword [ebp - 0x2230], edx
mov dword [ebp - 0x222c], edx
mov dword [ebp - 0x2228], edx
mov eax, edi
cmp cx, dx
je 0x483882
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x48387a
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x483867
jmp 0x483882
test eax, eax
jne 0x483de4
mov esi, 0x4e2280
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4838d8
add esi, 4
cmp esi, 0x4e22b0
jl 0x483887
mov ecx, dword [ebp - 0x2224]
xor esi, esi
mov dword [ebp - 0x2230], ecx
push edi
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
call fcn.00482780
mov dword [ebp - 0x2230], esi
mov dword [ebp - 0x222c], esi
mov dword [ebp - 0x2228], esi
test ebx, ebx
je 0x483966
mov ebx, dword [ebp - 0x2210]
push edi
mov ecx, ebx
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e12
push edi
mov ecx, ebx
call fcn.004826d0
mov esi, eax
test esi, esi
js 0x483e12
mov dword [ebp - 0x222c], 0
cmp word [edi], 0x7b
jne 0x483957
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x483957
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x221c]
push 0
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00483790
mov esi, eax
test esi, esi
js 0x483e1d
push edi
mov ecx, ebx
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
cmp word [edi], 0x7d
jne 0x4837f3
jmp 0x483e1d
mov dword [ebp - 0x222c], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48399c
mov ecx, dword [ebp - 0x2210]
push edi
mov dword [ebp - 0x2234], eax
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
push 0x4e2250
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x483ae4
mov ecx, dword [ebp - 0x2210]
lea edx, [ebp - 0x220c]
push edx
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
cmp word [edi], 0x3d
jne 0x483def
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x483a52
mov eax, dword [ebp - 0x2224]
push edi
lea ecx, [ebp - 0x220c]
push ecx
mov ecx, dword [ebp - 0x2210]
lea edx, [ebp - 0x2244]
push edx
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
call fcn.00483440
mov esi, eax
mov dword [ebp - 0x2244], ebx
mov dword [ebp - 0x2240], ebx
mov dword [ebp - 0x223c], ebx
cmp esi, ebx
jl 0x483e43
mov dword [ebp - 0x2240], ebx
mov ebx, dword [ebp - 0x2210]
jmp 0x483914
cmp dword [ebp + 0x14], ebx
jne 0x483ac9
cmp dword [ebp - 0x2234], ebx
je 0x483ac9
mov eax, dword [ebp - 0x2224]
push 0x20006
push ebx
push eax
lea ecx, [ebp - 0x2250]
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
call fcn.00420780
cmp eax, ebx
jne 0x483e5b
mov esi, dword [ebp - 0x2250]
lea ecx, [ebp - 0x220c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x483ab2
cmp eax, 2
jne 0x483e5b
cmp esi, ebx
je 0x483ac3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004826d0
mov esi, eax
cmp esi, ebx
jl 0x483e1d
jmp 0x483957
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x483b0f
mov edi, edi
cmp cx, 0x5c
je 0x483b07
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x483af0
jmp 0x483b0f
test eax, eax
jne 0x483def
cmp dword [ebp + 0x10], 0
je 0x483bb1
mov esi, dword [ebp - 0x2224]
push 0x2001f
push edi
push esi
lea ecx, [ebp - 0x221c]
call fcn.00420780
test eax, eax
je 0x483b6f
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x221c]
call fcn.00420780
test eax, eax
je 0x483b6f
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push esi
lea ecx, [ebp - 0x221c]
call fcn.004820b0
mov esi, eax
test esi, esi
jne 0x483e6e
mov ebx, dword [ebp - 0x2210]
push edi
mov ecx, ebx
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
cmp word [edi], 0x3d
jne 0x483914
push edi
push 0
lea edx, [ebp - 0x221c]
push edx
mov ecx, ebx
call fcn.00483440
mov esi, eax
test esi, esi
js 0x483e1d
jmp 0x483914
cmp dword [ebp + 0x14], 0
jne 0x483c10
mov eax, dword [ebp - 0x2224]
push 0x20019
push edi
push eax
lea ecx, [ebp - 0x221c]
call fcn.00420780
mov ebx, eax
mov dword [ebp - 0x2220], ebx
test ebx, ebx
je 0x483be2
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.004914c9
add esp, 0x10
cmp eax, 0x50
ja case.0x483c09.1
movzx edx, byte [eax + 0x483f00]
jmp dword [edx*4 + 0x483ef0]
mov dword [ebp - 0x2220], 2
mov ebx, dword [ebp - 0x2220]
jmp 0x483bdb
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004826d0
mov esi, eax
test esi, esi
js 0x483e1d
cmp word [edi], 0x7b
jne 0x483ca3
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x483ca3
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x221c]
mov ecx, dword [ebp - 0x2210]
push ebx
push 0
push eax
push edi
call fcn.00483790
mov esi, eax
test esi, esi
jns 0x483c87
test ebx, ebx
je 0x483e1d
mov ecx, dword [ebp - 0x2210]
push edi
call fcn.004824d0
mov esi, eax
test esi, esi
js 0x483e1d
mov ebx, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x2238]
mov dword [ebp + 0x14], ecx
cmp ebx, 2
je 0x483957
test ebx, ebx
je 0x483cd1
test ecx, ecx
jne 0x483957
push ebx
call fcn.00481e80
add esp, 4
mov esi, eax
jmp 0x483e1d
mov ebx, dword [ebp - 0x221c]
test ecx, ecx
je 0x483d29
mov ecx, dword [ebp - 0x2210]
push ebx
call fcn.00482680
test eax, eax
je 0x483d29
mov ecx, dword [ebp - 0x2210]
lea edx, [ebp - 0x20c]
push edx
call fcn.00482640
test eax, eax
je 0x483957
cmp dword [ebp - 0x2234], 0
je 0x483957
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x221c]
call fcn.00482780
jmp 0x483957
mov ecx, dword [ebp - 0x2210]
push ebx
call fcn.00482680
mov dword [ebp - 0x2260], eax
mov dword [ebp - 0x2220], 0
test ebx, ebx
je 0x483d60
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2220], eax
mov dword [ebp - 0x221c], 0
mov ebx, dword [ebp - 0x2220]
mov dword [ebp - 0x2218], 0
test ebx, ebx
jne 0x483ea9
cmp dword [ebp - 0x2234], ebx
je 0x483957
cmp dword [ebp - 0x2260], ebx
jne 0x483957
mov ecx, dword [ebp - 0x2224]
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x225c], ecx
push edx
lea ecx, [ebp - 0x225c]
mov dword [ebp - 0x2258], ebx
mov dword [ebp - 0x2254], ebx
call fcn.00482080
mov dword [ebp - 0x225c], ebx
mov dword [ebp - 0x2258], ebx
mov dword [ebp - 0x2254], ebx
cmp eax, ebx
jne 0x483ed0
lea ecx, [ebp - 0x225c]
call fcn.00420830
jmp 0x483957
lea ecx, [ebp - 0x2230]
call fcn.00420830
lea ecx, [ebp - 0x221c]
call fcn.00420830
pop edi
pop esi
mov eax, 0x80020009
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x2230]
call fcn.00420830
mov eax, dword [ebp - 0x221c]
test eax, eax
je 0x483e2e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x2244]
call fcn.00420830
lea ecx, [ebp - 0x221c]
call fcn.00420830
jmp 0x483e2e
push eax
call fcn.00481e80
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x2250]
jmp 0x483e18
lea ecx, [ebp - 0x221c]
call fcn.00420830
push esi
call fcn.00481e80
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00436e50
push 0x80070057
call fcn.00436e50
lea ecx, [ebp - 0x221c]
call fcn.00420830
push ebx
call fcn.00481e80
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004911d1
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.00481e80
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x225c]
jmp 0x483e18
push 0x80004005
call fcn.00436e50
and bh, byte [eax + ecx*2]
add byte [ebp - 1627371458], dl
dec eax
add dh, ah
dec eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3