Function at 0x42edd0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [esp + 0x10]
call fcn.0042f080
cmp eax, 0xf
ja case.default.0x42ede9
jmp dword [eax*4 + 0x42f038]
push 7
mov eax, 0x4b5b9c
test edi, edi
mov edx, 0x4b34dc
mov ecx, esi
cmove edx, eax
call fcn.0042f280
add esp, 4
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x18
jmp 0x42edf2
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ee37
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
jmp 0x42efc1
push 0x4b5ba0
push 0x80000001
jmp 0x42efc1
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ee65
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
push 0x80000001
jmp 0x42efc1
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
jmp 0x42efc1
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ee8e
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
jmp 0x42efbc
push 0x4b5ba0
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eeb2
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
jmp 0x42efbc
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eed6
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx_
jmp 0x42efbc
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eefa
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices_
jmp 0x42efbc
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ef1e
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce_
jmp 0x42efbc
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ef3f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun_
jmp 0x42efbc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ef5d
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce_
jmp 0x42efbc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ef7b
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx_
jmp 0x42efbc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ef99
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices_
jmp 0x42efbc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
jmp 0x42efbc
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42efb7
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce_
jmp 0x42efbc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ee0b
push esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
test edi, edi
mov eax, str.run_
mov ecx, 0x4b6044
cmove ecx, eax
call fcn.0042f380
mov eax, 1
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
test edi, edi
mov eax, str.load_
mov ecx, str.load
cmove ecx, eax
call fcn.0042f380
mov eax, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret