Function at 0x42ecf4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445ad6
mov eax, dword fs:[0]
push eax
mov eax, 0x2260
call fcn.00435d00
mov eax, dword [0x459e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x221c], ecx
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x2228], ebx
mov dword [ebp - 0x2224], ebx
mov dword [ebp - 0x2220], ebx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2244], edx
call fcn.0042d5d0
mov esi, eax
cmp esi, ebx
jl 0x42eef1
cmp word [edi], 0x7d
je 0x42eeef
mov edi, edi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push str.Delete
push edi
mov dword [ebp - 0x2240], 1
call esi
neg eax
push str.ForceRemove
sbb ebx, ebx
push edi
inc ebx
call esi
test eax, eax
je 0x42e8f1
test ebx, ebx
je 0x42ea3d
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
xor edx, edx
cmp dword [ebp + 0x10], edx
je 0x42ea3d
movzx ecx, word [edi]
mov dword [ebp - 0x223c], edx
mov dword [ebp - 0x2238], edx
mov dword [ebp - 0x2234], edx
mov eax, edi
cmp cx, dx
je 0x42e94f
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
je 0x42e947
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x42e934
jmp 0x42e94f
test eax, eax
jne 0x42eeb6
mov esi, 0x452178
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x42e9a5
add esi, 4
cmp esi, 0x4521a8
jl 0x42e954
mov ecx, dword [ebp - 0x2230]
xor esi, esi
mov dword [ebp - 0x223c], ecx
push edi
lea ecx, [ebp - 0x223c]
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
call fcn.0042d8a0
mov dword [ebp - 0x223c], esi
mov dword [ebp - 0x2238], esi
mov dword [ebp - 0x2234], esi
test ebx, ebx
je 0x42ea33
mov ebx, dword [ebp - 0x221c]
push edi
mov ecx, ebx
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eed3
push edi
mov ecx, ebx
call fcn.0042d7d0
mov esi, eax
test esi, esi
js 0x42eed3
mov dword [ebp - 0x2238], 0
cmp word [edi], 0x7b
jne 0x42ea24
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x42ea24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2228]
push 0
push eax
push ecx
push edi
mov ecx, ebx
call fcn.0042e840
mov esi, eax
test esi, esi
js 0x42eede
push edi
mov ecx, ebx
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
cmp word [edi], 0x7d
jne 0x42e8c0
jmp 0x42eede
mov dword [ebp - 0x2238], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x42ea69
mov ecx, dword [ebp - 0x221c]
push edi
mov dword [ebp - 0x2240], eax
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
push 0x452148
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x42ebb8
mov ecx, dword [ebp - 0x221c]
lea edx, [ebp - 0x2218]
push edx
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
cmp word [edi], 0x3d
jne 0x42eec1
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x42eb26
mov eax, dword [ebp - 0x2230]
push edi
lea ecx, [ebp - 0x2218]
push ecx
mov ecx, dword [ebp - 0x221c]
lea edx, [ebp - 0x2250]
push edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2250], eax
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
call fcn.0042e4c0
mov esi, eax
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2248], ebx
cmp esi, ebx
jl 0x42ef0f
mov byte [ebp - 4], bl
mov dword [ebp - 0x224c], ebx
mov ebx, dword [ebp - 0x221c]
jmp 0x42e9e1
cmp dword [ebp + 0x14], ebx
jne 0x42eb9d
cmp dword [ebp - 0x2240], ebx
je 0x42eb9d
mov eax, dword [ebp - 0x2230]
push 0x20006
push ebx
push eax
lea ecx, [ebp - 0x225c]
mov dword [ebp - 0x225c], ebx
mov dword [ebp - 0x2258], ebx
mov dword [ebp - 0x2254], ebx
call fcn.0042d190
cmp eax, ebx
jne 0x42ef27
mov esi, dword [ebp - 0x225c]
lea ecx, [ebp - 0x2218]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x42eb86
cmp eax, 2
jne 0x42ef27
cmp esi, ebx
je 0x42eb97
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x225c], ebx
mov dword [ebp - 0x2258], ebx
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d7d0
mov esi, eax
cmp esi, ebx
jl 0x42eede
jmp 0x42ea24
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x42ebe1
cmp cx, 0x5c
je 0x42ebd9
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x42ebc2
jmp 0x42ebe1
test eax, eax
jne 0x42eec1
cmp dword [ebp + 0x10], 0
je 0x42ec83
mov esi, dword [ebp - 0x2230]
push 0x2001f
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.0042d190
test eax, eax
je 0x42ec41
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.0042d190
test eax, eax
je 0x42ec41
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push esi
lea ecx, [ebp - 0x2228]
call fcn.0042d0f0
mov esi, eax
test esi, esi
jne 0x42ef3a
mov ebx, dword [ebp - 0x221c]
push edi
mov ecx, ebx
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
cmp word [edi], 0x3d
jne 0x42e9e1
push edi
push 0
lea edx, [ebp - 0x2228]
push edx
mov ecx, ebx
call fcn.0042e4c0
mov esi, eax
test esi, esi
js 0x42eede
jmp 0x42e9e1
cmp dword [ebp + 0x14], 0
jne 0x42ece2
mov eax, dword [ebp - 0x2230]
push 0x20019
push edi
push eax
lea ecx, [ebp - 0x2228]
call fcn.0042d190
mov ebx, eax
mov dword [ebp - 0x222c], ebx
test ebx, ebx
je 0x42ecb4
mov dword [ebp + 0x14], 1
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00434f53
add esp, 0x10
cmp eax, 0x50
ja case.0x42ecdb.1
movzx edx, byte [eax + 0x42efb0]
jmp dword [edx*4 + 0x42efa0]
mov dword [ebp - 0x222c], 2
mov ebx, dword [ebp - 0x222c]
jmp 0x42ecad
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d7d0
mov esi, eax
test esi, esi
js 0x42eede
cmp word [edi], 0x7b
jne 0x42ed75
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jne 0x42ed75
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x2228]
mov ecx, dword [ebp - 0x221c]
push ebx
push 0
push eax
push edi
call fcn.0042e840
mov esi, eax
test esi, esi
jns 0x42ed59
test ebx, ebx
je 0x42eede
mov ecx, dword [ebp - 0x221c]
push edi
call fcn.0042d5d0
mov esi, eax
test esi, esi
js 0x42eede
mov ebx, dword [ebp - 0x222c]
mov ecx, dword [ebp - 0x2244]
mov dword [ebp + 0x14], ecx
cmp ebx, 2
je 0x42ea24
test ebx, ebx
je 0x42eda3
test ecx, ecx
jne 0x42ea24
push ebx
call fcn.0042ce80
add esp, 4
mov esi, eax
jmp 0x42eede
mov ebx, dword [ebp - 0x2228]
test ecx, ecx
je 0x42edfb
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0042d780
test eax, eax
je 0x42edfb
mov ecx, dword [ebp - 0x221c]
lea edx, [ebp - 0x218]
push edx
call fcn.0042d740
test eax, eax
je 0x42ea24
cmp dword [ebp - 0x2240], 0
je 0x42ea24
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2228]
call fcn.0042d8a0
jmp 0x42ea24
mov ecx, dword [ebp - 0x221c]
push ebx
call fcn.0042d780
mov dword [ebp - 0x226c], eax
mov dword [ebp - 0x222c], 0
test ebx, ebx
je 0x42ee32
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2228], 0
mov ebx, dword [ebp - 0x222c]
mov dword [ebp - 0x2224], 0
test ebx, ebx
jne 0x42ef64
cmp dword [ebp - 0x2240], ebx
je 0x42ea24
cmp dword [ebp - 0x226c], ebx
jne 0x42ea24
mov ecx, dword [ebp - 0x2230]
lea edx, [ebp - 0x218]
mov dword [ebp - 0x2268], ecx
push edx
lea ecx, [ebp - 0x2268]
mov dword [ebp - 0x2264], ebx
mov dword [ebp - 0x2260], ebx
call fcn.0042d070
mov dword [ebp - 0x2268], ebx
mov dword [ebp - 0x2264], ebx
mov dword [ebp - 0x2260], ebx
cmp eax, ebx
jne 0x42ef7d
lea ecx, [ebp - 0x2268]
call fcn.0042d880
jmp 0x42ea24
lea ecx, [ebp - 0x223c]
call fcn.0042d880
lea ecx, [ebp - 0x2228]
call fcn.0042d880
mov eax, 0x80020009
jmp 0x42eef1
lea ecx, [ebp - 0x223c]
call fcn.0042d880
mov eax, dword [ebp - 0x2228]
test eax, eax
je 0x42eeef
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434758
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x2250]
call fcn.0042d880
lea ecx, [ebp - 0x2228]
call fcn.0042d880
jmp 0x42eeef
push eax
call fcn.0042ce80
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x225c]
jmp 0x42eed9
lea ecx, [ebp - 0x2228]
call fcn.0042d880
push esi
call fcn.0042ce80
add esp, 4
jmp 0x42eef1
push 0x8007000e
call fcn.0040acb0
push 0x80070057
call fcn.0040acb0
lea ecx, [ebp - 0x2228]
call fcn.0042d880
push ebx
call fcn.0042ce80
add esp, 4
jmp 0x42eef1
push eax
call fcn.0042ce80
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x2268]
jmp 0x42eed9
push 0x80004005
call fcn.0040acb0
lea ecx, [ecx]
hlt