Function at 0x489247
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x61336a
call fcn.0060cc48
mov eax, 0x2250
call fcn.0060c2b0
mov eax, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, eax
push edi
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f2
push ebx
push 0x7d
pop eax
cmp word [edi], ax
je 0x4896f1
xor eax, eax
push str.Delete
inc eax
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x6960b0
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4892c1
test ebx, ebx
je 0x489364
mov ecx, dword [ebp - 0x10]
push edi
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x489366
push 0x5c
pop edx
mov ecx, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.00488a3e
test eax, eax
jne 0x4896e4
push edi
call fcn.00488f12
test eax, eax
je 0x489322
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.00488f41
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
test ebx, ebx
je 0x48935a
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896df
push edi
mov ecx, ebx
call fcn.00488ebf
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00415647
test esi, esi
js 0x4896f1
jmp 0x489690
lea ecx, [ebp - 0x20]
call fcn.00415647
jmp 0x489366
xor esi, esi
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x10]
test eax, eax
jne 0x48938e
push edi
mov ecx, ebx
mov dword [ebp + 8], esi
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
push 0x6960a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x489487
lea eax, [ebp - 0x225c]
mov ecx, ebx
push eax
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
push edi
mov ecx, ebx
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
push 0x3d
pop eax
cmp word [edi], ax
jne 0x4896ec
cmp dword [ebp + 0x10], 0
je 0x489425
xor eax, eax
mov ecx, ebx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x225c]
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00488b44
mov esi, eax
lea ecx, [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
test esi, esi
js 0x48971a
mov byte [ebp - 4], al
jmp 0x48968b
cmp dword [ebp + 0x14], 0
jne 0x48947a
cmp dword [ebp + 8], 0
je 0x48947a
xor eax, eax
lea ecx, [ebp - 0x54]
push 0x20006
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
call fcn.004155f0
test eax, eax
jne 0x48970e
lea eax, [ebp - 0x225c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x489472
cmp eax, 2
jne 0x48970e
lea ecx, [ebp - 0x54]
call fcn.00415647
push edi
mov ecx, ebx
call fcn.00488ebf
jmp 0x4896d4
push 0x5c
pop edx
mov ecx, edi
call fcn.00488a3e
test eax, eax
jne 0x4896ec
cmp dword [ebp + 0x10], eax
je 0x48950f
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
push 0x2001f
push edi
push esi
call fcn.004155f0
test eax, eax
je 0x4894dc
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.004155f0
test eax, eax
je 0x4894dc
sub esp, 0x14
lea ecx, [ebp - 0x2c]
push edi
push esi
call fcn.004177bb
test eax, eax
jne 0x4895dd
push edi
mov ecx, ebx
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
push 0x3d
pop eax
cmp word [edi], ax
jne 0x489690
push edi
push 0
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.00488b44
mov esi, eax
jmp 0x48934d
cmp dword [ebp + 0x14], 0
jne 0x489528
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.004155f0
jmp 0x48952b
push 2
pop eax
mov ecx, dword [ebp + 0x14]
test eax, eax
push 1
mov dword [ebp - 0x14], eax
pop eax
push 0xffffffffffffffff
cmovne ecx, eax
lea eax, [ebp - 0x25c]
push edi
push 0x104
push eax
mov dword [ebp - 0x30], ecx
call fcn.005f4afd
push eax
call fcn.00404ada
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
push edi
mov ecx, ebx
call fcn.00488ebf
mov esi, eax
test esi, esi
js 0x4896f1
push 0x7b
pop eax
cmp word [edi], ax
jne 0x4895c3
push edi
call fcn.005f0fb8
pop ecx
cmp eax, 1
jne 0x4895c3
push dword [ebp - 0x30]
mov ecx, ebx
push 0
push dword [ebp - 0x2c]
push edi
call fcn.00489247
mov esi, eax
test esi, esi
jns 0x4895b1
cmp dword [ebp - 0x30], 0
je 0x4896f1
push edi
mov ecx, ebx
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x489286
test eax, eax
je 0x4895eb
cmp dword [ebp + 0x14], 0
jne 0x489286
mov ecx, eax
call fcn.00489ed1
mov esi, eax
jmp 0x4896f1
cmp dword [ebp + 0x14], 0
je 0x48962f
push dword [ebp - 0x2c]
call fcn.00488fef
test eax, eax
je 0x48962f
lea eax, [ebp - 0x25c]
push eax
call fcn.00488f12
test eax, eax
je 0x489286
cmp dword [ebp + 8], 0
je 0x489286
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00488f41
jmp 0x489286
push dword [ebp - 0x2c]
call fcn.00488fef
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
call fcn.00415647
test eax, eax
jne 0x4895dd
cmp dword [ebp + 8], eax
je 0x489286
cmp dword [ebp - 0x14], eax
jne 0x489286
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00489078
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
test eax, eax
jne 0x489721
lea ecx, [ebp - 0x48]
call fcn.00415647
cmp dword [ebp + 0x10], 0
je 0x489286
push 0x7b
pop eax
cmp word [edi], ax
jne 0x489286
push edi
call fcn.005f0fb8
pop ecx
cmp eax, 1
jne 0x489286
push 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 0x2c]
push edi
call fcn.00489247
mov esi, eax
test esi, esi
js 0x4896f1
push edi
mov ecx, ebx
call fcn.004890f1
mov esi, eax
test esi, esi
js 0x4896f1
jmp 0x489286
lea ecx, [ebp - 0x20]
jmp 0x48971a
lea ecx, [ebp - 0x20]
call fcn.00415647
mov esi, 0x80020009
pop ebx
lea ecx, [ebp - 0x2c]
call fcn.00415647
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, eax
call fcn.00489ed1
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.00415647
jmp 0x4896f1
mov ecx, eax
call fcn.00489ed1
lea ecx, [ebp - 0x48]
jmp 0x489718