Function at 0x422ffe
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0xdc]
xor edi, edi
push eax
mov ebx, 0x2001f
mov dword [ebp - 0xd0], edi
push ebx
push edi
push 0x403130
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xdc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423294
push esi
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xd4], edi
push eax
push ebx
push edi
push 0x406438
push dword [ebp - 0xdc]
mov dword [ebp - 0xd8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423111
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
jmp 0x4230eb
lea eax, [ebp - 0xd8]
inc esi
push eax
push ebx
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4230d8
lea ecx, [ebp - 0xcc]
call fcn.0042891c
push 0x403eb0
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp - 0xd0]
mov dword [ebp - 0xd4], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42308f
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xd0]
push eax
push ebx
push edi
push 0x406450
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4231cc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
jmp 0x4231a6
lea eax, [ebp - 0xd8]
inc esi
push eax
push ebx
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423193
lea ecx, [ebp - 0xcc]
call fcn.0041f1ae
push 0x403eb0
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp - 0xd0]
mov dword [ebp - 0xd4], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42314a
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xd0]
push eax
push ebx
push edi
push 0x406464
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423287
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
mov esi, edi
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
jmp 0x423261
lea eax, [ebp - 0xd8]
inc esi
push eax
push ebx
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42324e
lea ecx, [ebp - 0xcc]
call fcn.0041f9ff
push 0x403eb0
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp - 0xd0]
mov dword [ebp - 0xd4], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x423205
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov edx, 0x406478
mov ecx, SysReAllocString
call fcn.00426285
push edi
push edi
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret