Function at 0x42cd54
Capabilities:
Delete registry key
Delete registry value
Persist via .net dbgmanageddebugger registry key
Set registry value

Disassembly:
mov eax, 0x44358c
call fcn.004036d1
sub esp, 0x534
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
call dword [0x446f78]
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x40b1b0
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x42ce29
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x40b1a0
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x42ce29
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x40acbc
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x42d188
xor ebx, ebx
mov dword [ebp + 8], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
call fcn.0042ae38
test eax, eax
jl 0x42ce18
push ebx
push ebx
push 0x20006
push ebx
push ebx
push 0x42d1f0
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
call fcn.00420669
test eax, eax
jne 0x42ce0f
test byte [ebp + 0xc], 2
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ebx
push 0x42d1e4
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
jne 0x42ce09
mov dword [ebp + 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00420652
jmp 0x42d188
push 0x104
lea ebx, [ebp - 0x340]
call fcn.0042aecb
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x40b1b0
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x42d00d
xor ebx, ebx
cmp byte [ebp - 0x340], bl
je 0x42d188
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push dword [0x4485c4]
lea ecx, [ebp + 8]
push 0x80000002
call fcn.00420669
test eax, eax
jne 0x42ce18
test byte [ebp + 0xc], 2
je 0x42cf6c
push dword [0x4485d8]
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x23c]
push 0x42d1dc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
test eax, eax
je 0x42ce18
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [0x4485cc]
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], 0x114
call fcn.00426863
cmp eax, ebx
jne 0x42cf31
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0040eb1d
test eax, eax
pop ecx
pop ecx
je 0x42cf31
push 1
lea eax, [ebp - 0x128]
push eax
push dword [0x4485d4]
lea ecx, [ebp + 8]
call fcn.00420706
lea eax, [ebp + 0xc]
push eax
push dword [0x4485c8]
lea ecx, [ebp + 8]
call fcn.0042ac61
test eax, eax
jne 0x42cf31
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push dword [0x4485d0]
call fcn.004206ec
push 1
lea eax, [ebp - 0x23c]
push eax
push dword [0x4485cc]
lea ecx, [ebp + 8]
call fcn.00420706
mov dword [ebp + 0xc], 2
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push ebx
push dword [0x4485c8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x42ce18
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [0x4485d4]
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], 0x114
call fcn.00426863
test eax, eax
jne 0x42cfde
push 1
lea eax, [ebp - 0x128]
push eax
push dword [0x4485cc]
lea ecx, [ebp + 8]
call fcn.00420706
lea eax, [ebp + 0xc]
push eax
push dword [0x4485d0]
lea ecx, [ebp + 8]
call fcn.0042ac61
test eax, eax
jne 0x42cfd3
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push dword [0x4485c8]
call fcn.004206ec
jmp 0x42ce18
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
jmp 0x42cf52
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ebx
push dword [0x4485c8]
mov dword [ebp + 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [0x4485cc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x42ce18
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x40b1a0
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x42d188
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov edi, pe_nt_image_headers32
push edi
lea eax, [ebp - 0x114]
push eax
push dword [0x4485fc]
push dword [0x4485e4]
push dword [0x4485dc]
call esi
lea eax, [ebp - 0x340]
push eax
push dword [0x4485ec]
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x540]
push eax
call fcn.0040eb1d
mov ecx, dword [ebp + 0xc]
add esp, 0x14
neg eax
sbb al, al
shr ecx, 1
inc al
and ecx, 1
cmp al, cl
je 0x42d188
lea eax, [ebp - 0x1bc]
xor ebx, ebx
push eax
mov byte [ebp + 0xb], bl
mov dword [ebp - 0x1bc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x42d0ba
cmp dword [ebp - 0x1ac], 1
sete byte [ebp + 0xb]
test byte [ebp + 0xc], 2
je 0x42d11a
cmp byte [ebp + 0xb], bl
je 0x42d0d5
push 0x42d1a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea eax, [ebp - 0x540]
push eax
push dword [0x4485e4]
push dword [0x4485dc]
call esi
test eax, eax
je 0x42d188
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x540]
push eax
call fcn.0040eb1d
test eax, eax
pop ecx
pop ecx
je 0x42d188
lea eax, [ebp - 0x114]
push eax
jmp 0x42d17a
push edi
lea eax, [ebp - 0x114]
push eax
push dword [0x4485fc]
push dword [0x4485f4]
push dword [0x4485dc]
call esi
cmp byte [ebp - 0x114], bl
jne 0x42d15a
cmp byte [ebp + 0xb], bl
jne 0x42d15a
mov eax, dword [0x4485e8]
lea edx, [ebp - 0x114]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x42d150
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea eax, [ebp - 0x114]
push eax
push dword [0x4485e4]
push dword [0x4485dc]
call esi
test eax, eax
je 0x42d188
push ebx
push dword [0x4485f4]
push dword [0x4485dc]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.004037c0
leave
ret 8