Function at 0x449240
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
push edi
lea eax, [ecx + esi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x4496a1
ja 0x4496a1
cmp byte [eax - 1], 0
jne 0x4496a1
push 0x2000
call fcn.0048b928
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
je 0x4496a1
xor ebx, ebx
lea eax, [edi + 0x1000]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x44968f
nop word [eax + eax]
mov cl, byte [esi]
test cl, cl
je 0x44968f
mov al, cl
nop dword [eax]
cmp al, 0xd
je 0x4492c2
cmp al, 0xa
je 0x4492c2
cmp al, 0x20
je 0x4492c2
mov cl, al
cmp al, 9
jne 0x4492cc
mov cl, byte [esi + 1]
inc esi
mov al, cl
test cl, cl
jne 0x4492b0
test cl, cl
je 0x44968f
cmp cl, 0x5b
jne 0x44968f
inc esi
cmp dword [esi], 0x4d4c4b48
je 0x44936b
push 0x12
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
je 0x44936b
cmp dword [esi], 0x52434b48
je 0x449364
push 0x11
push str.HKEY_CLASSES_ROOT
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
je 0x449364
cmp dword [esi], 0x55434b48
je 0x44935d
push 0x11
push str.HKEY_CURRENT_USER
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
je 0x44935d
cmp dword [esi], 0x52535548
je 0x449356
push 0xa
push str.HKEY_USERS
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x44968f
mov ebx, reloc.WS2_32.dll_closesocket
jmp 0x449370
mov ebx, closesocket
jmp 0x449370
mov ebx, closesocket
jmp 0x449370
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push 0x5c
push esi
call fcn.00463610
mov esi, eax
add esp, 8
test esi, esi
je 0x44968c
inc esi
push 0x5d
push esi
call fcn.00463610
mov edi, eax
add esp, 8
test edi, edi
je 0x449689
inc edi
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jg 0x449689
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movzx eax, word [edi]
mov ecx, 0xd0a
cmp ax, cx
je 0x4493e0
mov ecx, 0xa0d
cmp ax, cx
je 0x4493e0
cmp al, 0xd
je 0x4493d9
cmp al, 0xa
jne 0x449689
mov eax, 1
jmp 0x4493e5
mov eax, 2
push 0
lea esi, [eax + edi]
mov edi, dword [ebp - 8]
push edi
push ebx
call fcn.0045e090
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc], 0
je 0x44968c
mov ebx, 1
mov ecx, 0xa0d
mov dword [ebp - 4], ebx
cmp esi, dword [ebp - 0x14]
jae 0x449514
movzx eax, word [esi]
cmp ax, cx
je 0x449514
mov ecx, 0x3d40
cmp ax, cx
jne 0x449441
push 0x4c1e27
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x449483
cmp al, 0x22
jne 0x44950f
inc esi
push 0x4c97d4
push esi
mov edi, esi
call fcn.00463f60
mov esi, eax
add esp, 8
test esi, esi
je 0x449514
mov ecx, esi
sub ecx, edi
lea edx, [ecx + 1]
cmp ecx, 0x1000
jge 0x44950f
push edx
push edi
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esi, 2
mov ebx, esi
cmp byte [esi], 0x22
jne 0x4494d1
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00463610
mov esi, eax
add esp, 8
test esi, esi
je 0x44950f
sub eax, edi
lea ecx, [eax + 1]
cmp eax, 0x1000
jge 0x44950f
mov ebx, dword [ebp - 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call fcn.0045e7c0
cmp eax, 1
jne 0x44950f
inc esi
jmp 0x44962a
push 6
push str.dword:
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x44953b
lea eax, [ebp - 0x18]
add esi, 6
push eax
push 0x4c8df8
push esi
call fcn.00401d30
add esp, 0xc
push dword [ebp - 0x18]
push edi
push dword [ebp - 0xc]
call fcn.0045e790
cmp eax, 1
je 0x44962a
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
cmp esi, dword [ebp - 0x14]
jb 0x4492a0
push edi
call fcn.0048b923
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 8
push str.MultString
push esi
call fcn.0048e4b1
add esp, 0xc
test eax, eax
je 0x44962a
push 4
push str.hex_
push ebx
mov esi, ebx
call fcn.0048e4b1
add esp, 0xc
test eax, eax
je 0x44962a
push 4
push str.hex:
push ebx
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x44960a
push 0xd
push ebx
lea edi, [ebx + 4]
call fcn.00463610
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x44967b
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x2ee0
jge 0x44967b
xor esi, esi
cmp edi, eax
jae 0x4495e7
cmp esi, 0x1000
ja 0x4495e2
lea eax, [ebp - 0x1c]
push eax
push str._02X
push edi
call fcn.00401d30
mov ecx, dword [ebp - 0x10]
add edi, 3
mov al, byte [ebp - 0x1c]
add esp, 0xc
mov byte [esi + ecx], al
inc esi
cmp edi, dword [ebp - 0x20]
jb 0x4495b4
jmp 0x4495e7
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [ebp - 8]
push esi
push dword [ebp - 0x10]
push edi
push dword [ebp - 0xc]
call fcn.0045e730
mov esi, ebx
cmp eax, 1
je 0x44962a
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
jmp 0x449514
push 4
push str.dele
push ebx
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x44967b
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, ebx
push 0xd
push esi
call fcn.00463610
add esp, 8
test eax, eax
jne 0x44964c
push 0xa
push esi
call fcn.00463610
add esp, 8
test eax, eax
je 0x44950f
mov cl, byte [eax + 1]
inc eax
cmp cl, 0xd
je 0x44965a
cmp cl, 0xa
jne 0x44965b
inc eax
mov ebx, dword [ebp - 4]
mov ecx, 0xa0d
mov esi, eax
cmp word [eax], cx
je 0x449514
test ebx, ebx
jne 0x449414
jmp 0x449514
xor eax, eax
mov esi, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x449514
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push edi
call fcn.0048b923
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret