Function at 0x42ad70
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a054b
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x4c448c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x814]
push eax
mov edi, ecx
mov ebx, edx
mov byte [ebp - 0x815], 0
call fcn.00402ba0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x814]
mov eax, dword [ecx - 0xc]
test eax, eax
jns 0x42adce
or eax, 0xffffffff
jmp 0x42adef
push 0x4ae8fc
push ecx
call fcn.00474087
mov ecx, dword [ebp - 0x814]
add esp, 8
test eax, eax
jne 0x42adeb
or eax, 0xffffffff
jmp 0x42adef
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x42ae3c
mov edx, dword [ecx - 0xc]
mov esi, eax
inc eax
js 0x42ae24
cmp eax, edx
jg 0x42ae24
lea ecx, [ecx + eax*2]
push 0x4ae8fc
push ecx
call fcn.00474087
mov ecx, dword [ebp - 0x814]
add esp, 8
test eax, eax
je 0x42ae24
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x42adf4
cmp esi, 0xffffffff
je 0x42ae3c
mov eax, dword [ecx - 0xc]
lea edx, [ebp - 0x814]
sub eax, esi
push edx
mov ecx, esi
call fcn.004153f0
lea ecx, [ebp - 0x834]
push ecx
xor eax, eax
cmp byte [ebp + 8], al
lea edx, [ebp - 0x81c]
push edx
push 0
push 0x2001f
push 0
setne al
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42aea4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ae9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x42b159
mov ecx, dword [ebp - 0x81c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
push ecx
call esi
test eax, eax
je 0x42b11d
mov eax, dword [ebp - 0x814]
cmp dword [eax - 4], 1
jle 0x42aede
mov edx, dword [eax - 0xc]
push edx
lea eax, [ebp - 0x814]
push eax
call fcn.00401ff0
mov eax, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x81c]
push eax
push ecx
call esi
test eax, eax
je 0x42b11d
test ebx, ebx
je 0x42b11d
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42af00
sub eax, edx
sar eax, 1
je 0x42b11d
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047125f
mov edi, eax
mov edx, edi
add esp, 4
mov dword [ebp - 0x830], edi
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x42af40
push edi
call fcn.00473d7d
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42af60
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047125f
mov esi, eax
add esp, 4
xor eax, eax
mov word [esi], ax
mov eax, ebx
mov dword [ebp - 0x82c], esi
lea edx, [eax + 2]
jmp 0x42afa0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42afa0
sub eax, edx
sar eax, 1
dec eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x42afe1
mov ecx, ebx
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x42afc2
sub ecx, edi
sar ecx, 1
dec ecx
cmp eax, ecx
ja 0x42afe1
push esi
call fcn.00473d7d
add esp, 4
jmp 0x42afe6
xor ecx, ecx
mov word [esi], cx
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x820]
push ecx
mov ecx, dword [ebp - 0x81c]
xor esi, esi
push esi
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x810]
push eax
push esi
mov ebx, 0x200
push ecx
mov dword [ebp - 0x824], 0x1ff
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x820], 1
call edi
test eax, eax
jne 0x42b102
cmp dword [ebp - 0x820], 1
jne 0x42b0b0
lea eax, [ebp - 0x410]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x12], dx
call fcn.00473d4c
mov ecx, dword [ebp - 0x830]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.00474087
add esp, 0x10
test eax, eax
jne 0x42b093
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.00474087
add esp, 8
test eax, eax
je 0x42b0b0
mov eax, dword [ebp - 0x81c]
lea edx, [ebp - 0x810]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
sete byte [ebp - 0x815]
lea ecx, [ebp - 0x828]
push ecx
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x820]
push eax
mov eax, dword [ebp - 0x81c]
push 0
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x810]
push edx
inc esi
push esi
push eax
mov dword [ebp - 0x824], 0x1ff
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x820], 1
call edi
test eax, eax
je 0x42b043
mov ecx, dword [ebp - 0x830]
push ecx
call fcn.00472958
mov edx, dword [ebp - 0x82c]
push edx
call fcn.00472958
add esp, 8
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b153
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 0x815]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474985
mov esp, ebp
pop ebp
ret