Function at 0x427361
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x59e232
call fcn.005693c7
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x38], ebx
mov esi, 0x5a500c
mov dword [ebp - 0x34], edi
push esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov esi, str.7A3B0D6F_8BB3_4007_B032_BD7782EEAD56
mov dword [ebp - 4], edi
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
mov esi, 0x5a505c
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
mov esi, 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push ebx
call edi
test eax, eax
jne 0x427507
lea eax, [ebp - 0x2c]
push eax
push esi
push 0
push 0x5a512c
push dword [ebp - 0x34]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x427471
lea eax, [ebp - 0x30]
push eax
push 0xf013f
push 0
push 0x5a0c30
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x42744e
push str.win32
push dword [ebp - 0x30]
call ebx
push str.win64
push dword [ebp - 0x30]
call ebx
push dword [ebp - 0x30]
call esi
push 0x5a0c30
push dword [ebp - 0x2c]
call ebx
push str.FLAGS
push dword [ebp - 0x2c]
call ebx
push str.HELPDIR
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call esi
call fcn.0042ac3a
test al, al
je 0x42748e
mov esp, 0x394644d0
or dword [ebp + edi*8 + 0x74], esi
pop ss
jle 0x4274d8
xchg ebp, eax
xchg byte [eax + 0x39be33ae], dh
cld
call fcn.0042aa57
test al, al
je 0x4274b5
salc
pop edi
and ch, cl
lahf
sub eax, 0x24398761
xor dword [esi], edx
insd dword es:[edi], dx
das
mov fs, word [ecx]
jl 0x427478
mov ch, 0xb1
mov dword [0x273c472e], eax
bound eax, qword [ebx - 0x17a5529e]
insb byte es:[edi], dx
call fcn.0042ab26
add byte ss:[eax], al
test al, al
je 0x4274dd
jp 0x42751d
imul ebx, dword [esi - 0x24], 0xdecebd46
bound ebp, qword [ecx + 0x13]
sub byte [ecx + 0x1e], bh
sbb byte [esi - 0x6cb93f22], 0x33
int1
call 0x333433c5
mov dword [0x358b01e1], eax
int1
xor ah, byte [ebx + 0x358b01e1]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x5a512c
push dword [ebp - 0x34]
mov byte [eax], al
pop edx
add byte [eax + 0x2c], ch
push ecx
pop edx
add bh, bh
jne 0x4274b7
call esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call esi
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret 4
mov eax, 0x59f035
call fcn.005693c7
and dword [ebp - 0x2c], 0
call fcn.0042ae62
test al, al
je 0x427553
mov ch, 0x86
dec esi
xchg edi, eax
invalid
call fcn.0042a8fe
test al, al
je 0x427575
sub eax, 0x3832fdb8
fucompi st(0)
sbb eax, 0x44b49b87
mov dl, 0x50
mov eax, dword [0xc1bdce23]
mov dword [0xc298b195], eax
sub eax, 0x36
add byte ss:[eax], al
call fcn.0042abb0
test al, al
je 0x42759a
int1
xchg edi, eax
sub byte [ecx + 0x6c998803], dl
jp 0x4275d0
sub ch, byte [ebp + esi + 0x2e795dd9]
or edx, ecx
invalid
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0xf013f
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x427635
mov esi, 0x5a5208
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov esi, str.OverlayIconWanNengWB
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ae62
test al, al
je 0x42764f
xor byte [edi + ebp*8 + 0x2a], dh
jp 0x4276c1
adc byte [ebp + 0x5fd58e98], al
lcall 0x17e8, 0x4a53713c
xor eax, 0xc0840000
call fcn.0042ab6b
test al, al
je 0x427677
ljmp 0xc0f7:0xc3afe650
call fcn.0042a988
test al, al
je 0x427696
sub ah, byte [edi + 0x58]
xchg ecx, eax
mov esp, ds
loope 0x4276a5
fbstp tbyte [edx + 0xe]
xlatb
movsd dword es:[edi], dword [esi]
and dword [edx - 0x71], ecx
ret
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
adc al, 0
ret
add byte [ebx + 0x5600e865], al
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
and dword [ebp - 4], 0
mov esi, str.C3F37BD9_8872_46FF_85CE_DC58B69FDB53
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
call fcn.0042ad4e
test al, al
je 0x427723
cwde
aad 0x47
inc edi
mov bl, 0x8c
arpl word [edi], di
retf 0x4ba6
call fcn.0042abb0
test al, al
je 0x427741
xchg edi, eax
sbb dword [ebx], eax
jmp 0x1b35fec0
call fcn.0042ad09
test al, al
je 0x42775c
push ebp
stosd dword es:[edi], eax
das
loop 0x42770a
int3
mov esi, 0x5a505c
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42784a
call fcn.0042a8b9
test al, al
je 0x4277b1
mov edi, 0x5a62dfa0
inc ebp
jno 0x42780d
push 0x13
mov dl, 0x89
ret 0xd469
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.InprocServer32
push dword [ebp - 0x2c]
call ebx
push str.Programmable
push dword [ebp - 0x2c]
call ebx
push str.TypeLib
push dword [ebp - 0x2c]
shr dword [eax - 0x68], cl
push eax
pop edx
add bh, bh
jne 0x4277a7
call ebx
push 0x5a5314
push dword [ebp - 0x2c]
call ebx
call fcn.0042ad4e
test al, al
je 0x427805
mov dl, 0x4b
arpl word [ebp + 0x33c06843], cx
int1
cmp eax, 0x155b5565
js 0x4277ca
sbb dword [eax + 0x51fdfaa8], ebx
fadd dword [ebx - 0x5d]
jp 0x427802
xor al, 0xe8
pop eax
add byte ss:[eax], al
call fcn.0042ae62
test al, al
je 0x42782c
push ds
in al, 0x87
imul eax, dword [edx + 0x5421203d], 0x71
xor edi, dword [ecx + edx*2 - 0x554d880a]
cmc
fmul dword [ebx - 0x165ac672]
out 0x25, eax
std
wait
loop 0x4277f9
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret 4