Function at 0x42e140
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1320
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x62f76c]
test esi, esi
jne 0x42e1ae
push 0x120
call fcn.00572ada
mov esi, eax
add esp, 4
mov dword [ebp - 0x658], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004093b0
mov dword [ebp - 4], 0xffffffff
mov dword [esi], vtable.CConfigure.0
mov dword [0x62f76c], esi
sub esp, 0xc
mov ecx, esi
call fcn.0040c200
cmp eax, 1
jne 0x42e265
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x658]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x42e25e
lea eax, [ebp - 0x65c]
push eax
push 0xf003f
push 0
push 0x61e374
push dword [ebp - 0x658]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e256
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00578b50
push str.730e58f8
push str.ZnPY
lea eax, [ebp - 0x218]
push str._s_s
push eax
call fcn.00409380
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x65c]
call esi
push dword [ebp - 0x658]
call esi
xor eax, eax
jmp 0x42e4a8
push 0x61e77c
push 0
call fcn.00423900
add esp, 8
push 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x62f768]
test eax, eax
jne 0x42e2a7
push 0x104
call fcn.00572ada
add esp, 4
mov dword [ebp - 0x658], eax
mov ecx, eax
call fcn.0041e630
mov dword [0x62f768], eax
sub esp, 0xc
mov ecx, eax
call fcn.0041f460
push 0x400
lea eax, [ebp - 0x618]
push 0
push eax
call fcn.00578b50
add esp, 0xc
lea eax, [ebp - 0x618]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x618]
push 0x5c
push eax
call fcn.00577bd0
xor ecx, ecx
add esp, 8
mov word [eax + 2], cx
xor eax, eax
mov dword [ebp - 0x61c], 7
mov dword [ebp - 0x620], ecx
mov word [ebp - 0x630], ax
cmp word [ebp - 0x618], ax
je 0x42e32f
lea ecx, [ebp - 0x618]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e320
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x630]
call fcn.00404030
push 0xa
push str.Useful.exe
lea ecx, [ebp - 0x630]
mov dword [ebp - 4], 1
call fcn.0040c670
call fcn.00437e30
test al, al
je 0x42e37e
salc
push edi
jle 0x42e3a2
cmp ah, al
std
loopne 0x42e367
sbb edx, edx
stc
call 0xfc494d5d
ret
call fcn.00438140
test al, al
je 0x42e39d
and bh, al
rcl byte [eax], 0x86
sti
invalid
call fcn.00438060
test al, al
je 0x42e3be
int3
xor eax, 0x48aebfb4
and byte [eax], ah
invalid
call fcn.00437b90
test al, al
je 0x42e3e1
loopne 0x42e3aa
pop es
outsb dx, byte [esi]
ret
cmp dword [ebp - 0x61c], 8
jb 0x42e3f6
mov esi, dword [ebp - 0x630]
test esi, esi
je 0x42e460
jmp 0x42e3fc
lea esi, [ebp - 0x630]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x42e45a
lea eax, [ebp - 0x654]
mov dword [ebp - 0x634], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x654], xmm0
movups xmmword [ebp - 0x644], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
setne al
test al, al
je 0x42e45a
cmp dword [ebp - 0x61c], 8
lea ecx, [ebp - 0x630]
cmovae ecx, dword [ebp - 0x630]
sub esp, 0xc
call fcn.004278e0
add esp, 0xc
mov esi, dword [ebp - 0x630]
cmp dword [ebp - 0x61c], 8
lea eax, [ebp - 0x630]
push str.e59cec65
cmovae eax, esi
push eax
push 0x61e7bc
push 0
call fcn.00423900
mov eax, dword [ebp - 0x61c]
add esp, 0x10
cmp eax, 8
jb 0x42e4a3
inc eax
lea ecx, [ebp - 0x630]
push eax
push dword [ebp - 0x630]
call fcn.004043b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret