Function at 0x42d900
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete registry value
Get common file path
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4679c8
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push esi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [edi + 0x6c], bl
je 0x42da22
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea esi, [esp + 0x14]
mov dword [esp + 0x458], ebx
call fcn.00432630
lea eax, [edi + 0x16e]
push eax
mov ecx, esi
call dword [0x46831c]
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push 0x1fe
lea ecx, [esp + 0x52]
push ebx
push ecx
mov word [esp + 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push str._system32_
lea ecx, [esp + 0x18]
call dword [0x46831c]
lea ecx, [edi + 0xee]
push ecx
lea ecx, [esp + 0x18]
call dword [0x46831c]
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call esi
lea edx, [esp + 0xc]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42da19
mov ecx, dword [esp + 0xc]
lea eax, [edi + 0x6e]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
jmp 0x42db08
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea esi, [esp + 0x30]
mov dword [esp + 0x458], 1
call fcn.00432630
push str.AmCore.dll
mov ecx, esi
call dword [0x46831c]
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push 0x1fe
lea eax, [esp + 0x252]
push ebx
push eax
mov word [esp + 0x258], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [esp + 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x24c]
push edx
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push str._system32_
lea ecx, [esp + 0x34]
call dword [0x46831c]
push str.winsevr.dat
lea ecx, [esp + 0x34]
call dword [0x46831c]
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call esi
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42db04
mov ecx, dword [esp + 0x10]
push str.ProgramData
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
mov dword [esp + 0x458], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 0x2d
mov cl, 0x37
push 0x124
mov byte [esp + 0x1c], al
mov byte [esp + 0x22], al
mov byte [esp + 0x28], al
mov dl, 0x57
mov byte [esp + 0x21], cl
mov byte [esp + 0x24], cl
mov cl, 0x30
lea eax, [esp + 0x54]
push ebx
push eax
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], 0x4d
mov byte [esp + 0x22], 0x54
mov byte [esp + 0x23], 0x45
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x38
mov byte [esp + 0x27], 0x34
mov byte [esp + 0x28], 0x36
mov byte [esp + 0x2b], 0x5a
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], 0x54
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x31], 0x53
mov byte [esp + 0x32], 0x50
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x31
mov byte [esp + 0x36], bl
mov dword [esp + 0x58], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x50]
lea ecx, [esp + 0x18]
call fcn.004277d0
test al, al
jne 0x42dbd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xe6c
push str.RegByWan::ReBuildRegInfo__:__CRT:_d_Error_Code:_d_r_n
lea esi, [edi + 0x1f0]
call fcn.00432380
add esp, 0xc
xor al, al
jmp 0x42dbd8
mov al, 1
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.0043ad38
add esp, 0x450
ret