Function at 0x42dce0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1120
call fcn.004681d0
mov eax, dword [0x4b9b30]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esp + 0x1c], str..doc
mov dword [esp + 0x20], str..docx
mov dword [esp + 0x24], str..xls
mov dword [esp + 0x28], str..xlsx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov edi, edi
push 0x800
lea eax, [esp + 0x130]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.00466350
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + ecx*4 + 0x28]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push SysReAllocString
call edi
test eax, eax
jne 0x42e0cd
push str.Shell
lea edx, [esp + 0x130]
push edx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42de4a
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.00466350
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
jne 0x42e0cd
push str.Open
lea eax, [esp + 0x30]
push eax
call ebp
test eax, eax
je 0x42de63
push 0x20
push str.Open
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
lea ecx, [esp + 0x13c]
push ecx
push SysReAllocString
call fcn.0042d9a0
add esp, 0x18
test eax, eax
je 0x42e0cd
jmp 0x42de63
push 1
push 0
lea edx, [esp + 0x134]
push edx
push SysReAllocString
call fcn.0042dad0
add esp, 0x10
push str.Opencommand
lea eax, [esp + 0x130]
push eax
call ebx
cmp dword [esp + 0x1134], 0
je 0x42e02f
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x936]
push edx
mov word [esp + 0x938], cx
call fcn.00466350
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x930]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x13c]
push eax
push SysReAllocString
mov dword [esp + 0x28], 0x800
call edi
test eax, eax
jne 0x42e0cd
lea ecx, [esp + 0x92c]
push 0x49145c
push ecx
call fcn.00468cf9
add esp, 8
test eax, eax
je 0x42df80
push str..doc
xor edx, edx
push esi
mov word [eax], dx
call ebp
test eax, eax
je 0x42df34
push str..docx
push esi
call ebp
test eax, eax
je 0x42df34
push str..xls
push esi
call ebp
test eax, eax
je 0x42df25
push str..xlsx
push esi
call ebp
test eax, eax
jne 0x42df43
push str.___1_
lea eax, [esp + 0x930]
push eax
jmp 0x42df41
push str.__t__n___1_
lea ecx, [esp + 0x930]
push ecx
call ebx
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
call fcn.0042d9a0
add esp, 0x18
test eax, eax
je 0x42e0cd
push 0x800
lea eax, [esp + 0x930]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.00466350
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x930]
push edx
lea eax, [esp + 0x1c]
push eax
push str.command
lea ecx, [esp + 0x13c]
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x42e0cd
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push str.command
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
call fcn.0042d9a0
add esp, 0x18
test eax, eax
je 0x42e0cd
push str.command
lea eax, [esp + 0x130]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x42e0cd
jmp 0x42e061
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push SysReAllocString
call fcn.0042dad0
push 1
push str.command
lea edx, [esp + 0x144]
push edx
push SysReAllocString
call fcn.0042dad0
add esp, 0x20
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.0046700c
add esp, 8
test eax, eax
je 0x42e0cd
push str.ddeexec
lea edx, [esp + 0x130]
xor ecx, ecx
push edx
mov word [eax], cx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42e0b4
push 0
push 0
push 1
push 0
lea eax, [esp + 0x13c]
push eax
push SysReAllocString
call fcn.0042d9a0
add esp, 0x18
jmp 0x42e0cd
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push SysReAllocString
call fcn.0042dad0
add esp, 0x10
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jb 0x42dd40
mov ecx, dword [esp + 0x112c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00466fd0
add esp, 0x1120
ret 4