Function at 0x42b044
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f9651
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x26c
push ebx
push esi
push edi
lea edi, [ebp - 0x27c]
mov ecx, 0x9b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x782e08]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x240]
call fcn.00406cc0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42aed6
call fcn.0045bcb0
cmp eax, 1
jne 0x42aed6
lea ecx, [ebp - 0x240]
push ecx
push str.SoftwareClasses_
lea edx, [ebp - 0x254]
push edx
call fcn.0041f290
add esp, 0xc
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x240]
call fcn.004079d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.00406500
mov dword [ebp + 8], SysReAllocString
cmp dword [ebp + 0x10], 0
je 0x42af0a
lea edx, [ebp - 0x230]
push edx
push 0x2001f
push 0
lea ecx, [ebp - 0x240]
call fcn.00406050
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004257a0
mov dword [ebp - 0x26c], eax
jmp 0x42af3d
mov esi, esp
lea ecx, [ebp - 0x230]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x240]
call fcn.00406050
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x42b0e0
mov esi, esp
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push 0
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x42b05b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00406d80
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.0042ae10
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
je 0x42afeb
mov dword [ebp - 0x278], 1
jmp 0x42aff5
mov dword [ebp - 0x278], 0
mov dl, byte [ebp - 0x278]
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.00406500
movzx eax, byte [ebp - 0x255]
test eax, eax
je 0x42b021
mov byte [ebp - 4], 0
jmp 0x42b05b
jmp 0x42b044
mov dword [ebp - 4], 0
jmp 0x42b056
jmp 0x42af56
cmp dword [ebp - 0x238], 0x103
je 0x42b073
cmp dword [ebp - 0x238], 0x3f2
jne 0x42b0ca
cmp dword [ebp + 0x10], 0
je 0x42b099
lea ecx, [ebp - 0x240]
call fcn.00406050
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0042b330
mov dword [ebp - 0x27c], eax
jmp 0x42b0be
lea ecx, [ebp - 0x240]
call fcn.00406050
mov esi, esp
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x238], eax
mov esi, esp
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.006c7eb0
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00406500
mov eax, dword [ebp - 0x260]
push edx
mov ecx, ebp
push eax
lea edx, [0x42b140]
call fcn.006c7e50
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006c31f0
add esp, 0x27c
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 0xc