Function at 0x4931b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, edx
push edi
lea eax, [ecx + esi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x493611
ja 0x493611
cmp byte [eax - 1], 0
jne 0x493611
push 0x2000
call fcn.004c8d06
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
je 0x493611
push ebx
xor ebx, ebx
lea eax, [edi + 0x1000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x4935ff
nop word [eax + eax]
mov cl, byte [esi]
test cl, cl
je 0x4935ff
mov al, cl
nop dword [eax]
cmp al, 0xd
je 0x493232
cmp al, 0xa
je 0x493232
cmp al, 0x20
je 0x493232
mov cl, al
cmp al, 9
jne 0x49323c
mov cl, byte [esi + 1]
inc esi
mov al, cl
test cl, cl
jne 0x493220
test cl, cl
je 0x4935ff
cmp cl, 0x5b
jne 0x4935ff
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x4932db
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
je 0x4932db
cmp dword [esi], 0x52434b48
je 0x4932d4
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
je 0x4932d4
cmp dword [esi], 0x55434b48
je 0x4932cd
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
je 0x4932cd
cmp dword [esi], 0x52535548
je 0x4932c6
push 0xa
push str.HKEY_USERS
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
jne 0x4935ff
mov ebx, VariantInit
jmp 0x4932e0
mov ebx, SysReAllocString
jmp 0x4932e0
mov ebx, SysReAllocString
jmp 0x4932e0
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push 0x5c
push esi
call fcn.0049f5a0
mov esi, eax
add esp, 8
test esi, esi
je 0x4935fc
inc esi
push 0x5d
push esi
call fcn.0049f5a0
mov edi, eax
add esp, 8
test edi, edi
je 0x4935f9
inc edi
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jg 0x4935f9
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [edi]
mov ecx, 0xd0a
cmp ax, cx
je 0x493350
mov ecx, 0xa0d
cmp ax, cx
je 0x493350
cmp al, 0xd
je 0x493349
cmp al, 0xa
jne 0x4935f9
mov eax, 1
jmp 0x493355
mov eax, 2
push 0
lea esi, [eax + edi]
mov edi, dword [ebp - 8]
push edi
push ebx
call fcn.004991f0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc], 0
je 0x4935fc
mov ebx, 1
mov ecx, 0xa0d
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x493484
movzx eax, word [esi]
cmp ax, cx
je 0x493484
mov ecx, 0x3d40
cmp ax, cx
jne 0x4933b1
push 0x5066b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4933f3
cmp al, 0x22
jne 0x49347f
inc esi
push 0x51530c
push esi
mov edi, esi
call fcn.0049f330
mov esi, eax
add esp, 8
test esi, esi
je 0x493484
mov ecx, esi
sub ecx, edi
lea edx, [ecx + 1]
cmp ecx, 0x1000
jge 0x49347f
push edx
push edi
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
mov ebx, esi
cmp byte [esi], 0x22
jne 0x493441
lea edi, [esi + 1]
push 0x22
push edi
call fcn.0049f5a0
mov esi, eax
add esp, 8
test esi, esi
je 0x49347f
sub eax, edi
lea ecx, [eax + 1]
cmp eax, 0x1000
jge 0x49347f
mov ebx, dword [ebp - 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call fcn.00499920
cmp eax, 1
jne 0x49347f
inc esi
jmp 0x49359a
push 6
push str.dword:
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
jne 0x4934ab
lea eax, [ebp - 0x18]
add esi, 6
push eax
push 0x5141a4
push esi
call fcn.004015fb
add esp, 0xc
push dword [ebp - 0x18]
push edi
push dword [ebp - 0xc]
call fcn.004998f0
cmp eax, 1
je 0x49359a
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
cmp esi, dword [ebp - 0x14]
jb 0x493210
push edi
call fcn.004c8ceb
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
push str.MultString
push esi
call fcn.004d0ef7
add esp, 0xc
test eax, eax
je 0x49359a
push 4
push str.hex_
push ebx
mov esi, ebx
call fcn.004d0ef7
add esp, 0xc
test eax, eax
je 0x49359a
push 4
push str.hex:
push ebx
call fcn.004d0ef7
add esp, 0xc
test eax, eax
jne 0x49357a
push 0xd
push ebx
lea edi, [ebx + 4]
call fcn.0049f5a0
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4935eb
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x2ee0
jge 0x4935eb
xor esi, esi
cmp edi, eax
jae 0x493557
cmp esi, 0x1000
ja 0x493552
lea eax, [ebp - 0x1c]
push eax
push str._02X
push edi
call fcn.004015fb
mov ecx, dword [ebp - 0x10]
add edi, 3
mov al, byte [ebp - 0x1c]
add esp, 0xc
mov byte [esi + ecx], al
inc esi
cmp edi, dword [ebp - 0x20]
jb 0x493524
jmp 0x493557
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [ebp - 8]
push esi
push dword [ebp - 0x10]
push edi
push dword [ebp - 0xc]
call fcn.00499890
mov esi, ebx
cmp eax, 1
je 0x49359a
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
jmp 0x493484
push 4
push str.dele
push ebx
call fcn.004d0ef7
add esp, 0xc
test eax, eax
jne 0x4935eb
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
push 0xd
push esi
call fcn.0049f5a0
add esp, 8
test eax, eax
jne 0x4935bc
push 0xa
push esi
call fcn.0049f5a0
add esp, 8
test eax, eax
je 0x49347f
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x4935ca
cmp cl, 0xa
jne 0x4935cb
inc eax
mov ebx, dword [ebp - 4]
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
je 0x493484
test ebx, ebx
jne 0x493384
jmp 0x493484
xor eax, eax
mov esi, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x493484
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push edi
call fcn.004c8ceb
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret