Function at 0x42d9b0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1120
call fcn.00467ec0
mov eax, dword [0x4b9b20]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esp + 0x1c], str..doc
mov dword [esp + 0x20], str..docx
mov dword [esp + 0x24], str..xls
mov dword [esp + 0x28], str..xlsx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov edi, edi
push 0x800
lea eax, [esp + 0x130]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004660d0
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + ecx*4 + 0x28]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push closesocket
call edi
test eax, eax
jne 0x42dd9d
push str.Shell
lea edx, [esp + 0x130]
push edx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42db1a
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.004660d0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
jne 0x42dd9d
push str.Open
lea eax, [esp + 0x30]
push eax
call ebp
test eax, eax
je 0x42db33
push 0x20
push str.Open
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call fcn.0042d670
add esp, 0x18
test eax, eax
je 0x42dd9d
jmp 0x42db33
push 1
push 0
lea edx, [esp + 0x134]
push edx
push closesocket
call fcn.0042d7a0
add esp, 0x10
push str.Opencommand
lea eax, [esp + 0x130]
push eax
call ebx
cmp dword [esp + 0x1134], 0
je 0x42dcff
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x936]
push edx
mov word [esp + 0x938], cx
call fcn.004660d0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x930]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
mov dword [esp + 0x28], 0x800
call edi
test eax, eax
jne 0x42dd9d
lea ecx, [esp + 0x92c]
push 0x490390
push ecx
call fcn.004689e9
add esp, 8
test eax, eax
je 0x42dc50
push str..doc
xor edx, edx
push esi
mov word [eax], dx
call ebp
test eax, eax
je 0x42dc04
push str..docx
push esi
call ebp
test eax, eax
je 0x42dc04
push str..xls
push esi
call ebp
test eax, eax
je 0x42dbf5
push str..xlsx
push esi
call ebp
test eax, eax
jne 0x42dc13
push str.___1_
lea eax, [esp + 0x930]
push eax
jmp 0x42dc11
push str.__t__n___1_
lea ecx, [esp + 0x930]
push ecx
call ebx
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042d670
add esp, 0x18
test eax, eax
je 0x42dd9d
push 0x800
lea eax, [esp + 0x930]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004660d0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x930]
push edx
lea eax, [esp + 0x1c]
push eax
push str.command
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x42dd9d
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push str.command
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042d670
add esp, 0x18
test eax, eax
je 0x42dd9d
push str.command
lea eax, [esp + 0x130]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x42dd9d
jmp 0x42dd31
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042d7a0
push 1
push str.command
lea edx, [esp + 0x144]
push edx
push closesocket
call fcn.0042d7a0
add esp, 0x20
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.00466d8c
add esp, 8
test eax, eax
je 0x42dd9d
push str.ddeexec
lea edx, [esp + 0x130]
xor ecx, ecx
push edx
mov word [eax], cx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42dd84
push 0
push 0
push 1
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
call fcn.0042d670
add esp, 0x18
jmp 0x42dd9d
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042d7a0
add esp, 0x10
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jb 0x42da10
mov ecx, dword [esp + 0x112c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00466d50
add esp, 0x1120
ret 4