Function at 0x42785e
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x59e232
call fcn.005693c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call fcn.0042acc4
test al, al
je 0x42789b
mov cl, 0xa2
xchg esp, eax
inc ecx
push ds
jl 0x4278f5
invalid
dec esp
test al, 0x28
call fcn.0042aa57
test al, al
je 0x4278bc
retf
push es
mov ah, dl
js 0x427898
sbb dword [edi + 0x3220e8f0], 0
add byte [eax + eax*8 + 0x6e3b1874], al
adc al, 0xb7
pop esp
call fcn.0042aae1
test al, al
je 0x4278dd
cmp ebp, dword [esi + 0x14]
mov bh, 0x5c
je 0x4278b4
clc
retf 0xf78c
xor eax, eax
mov dword [ebp - 0x14], 7
mov esi, 0x5a500c
mov word [ebp - 0x28], ax
xor ebx, ebx
push esi
mov dword [ebp - 0x18], ebx
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov esi, str.34E7B5C6_21C6_4A4B_AEFF_CD81A5A6EA57
mov dword [ebp - 4], ebx
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
mov esi, 0x5a505c
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
call fcn.0042ac7f
test al, al
je 0x42794f
push es
pop esp
invalid
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov edi, 0xf013f
push ecx
push edi
push ebx
push eax
push dword [ebp - 0x38]
call esi
test eax, eax
jne 0x427a8d
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push 0x5a512c
push dword [ebp - 0x34]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4279e9
lea eax, [ebp - 0x30]
push eax
push edi
push 0
mov edi, 0x5a0c30
push edi
push dword [ebp - 0x2c]
call esi
test eax, eax
jne 0x4279c6
push str.win32
push dword [ebp - 0x30]
call ebx
push str.win64
push dword [ebp - 0x30]
call ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp - 0x2c]
call ebx
push str.FLAGS
push dword [ebp - 0x2c]
call ebx
push str.HELPDIR
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ae1d
test al, al
je 0x427a0a
scasb al, byte es:[edi]
and eax, dword [eax + 0x5bc757b]
fstp dword gs:[ebx + 0x2b0f733]
pop ecx
mov edx, 0x881d8b17
add byte [edx], bl
push 0x5a512c
push dword [ebp - 0x34]
call ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ad4e
test al, al
je 0x427a41
bound edx, qword ss:[ecx]
sbb ecx, esp
div dword [ecx - 0x7eca85c4]
jg 0x427a75
push esi
mov dword [ebx - 0x38fbad07], esi
int1
hlt
call fcn.0042abb0
test al, al
je 0x427a5f
mov bl, 4
retf 0xdcc7
sbb byte [edx - 0x7f], cl
push cs
ror byte [edi], cl
jmp 0x25ec89d6
call fcn.0042ad09
test al, al
je 0x427a7a
nop
dec ecx
xlatb
int 0xe7
xor bl, byte [eax + 0x746d9ae9]
sbb bl, byte [ebx + 0x25a5f0a]
lodsb al, byte [esi]
or bl, byte [edi + 0x5a]
add ch, byte [ebx + eax*4 - 0x72f71383]
inc ebp
fmul dword [edi]
inc ebx
inc ebp
fcom dword [eax - 1]
jne 0x427a51
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call ebx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret 4