Function at 0x431c76
Capabilities:
Delete registry key
Delete registry value
Persist via .net dbgmanageddebugger registry key
Set registry value

Disassembly:
mov eax, 0x446dec
call fcn.00417a9e
sub esp, 0x420
mov eax, dword [0x44de1c]
push esi
mov esi, dword [ebp + 8]
push edi
push 4
mov dword [ebp - 0x10], eax
pop ecx
mov edi, 0x412458
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x431cd0
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x412448
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x431cd0
mov esi, dword [ebp + 8]
push 0x10
pop ecx
mov edi, 0x411de8
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x431cc8
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp + 8], eax
jmp 0x432022
push ebx
mov ebx, 0x104
lea esi, [ebp - 0x428]
call fcn.00431413
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x412458
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x431ec7
xor ebx, ebx
cmp byte [ebp - 0x428], bl
je 0x432021
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [0x44e4d0]
lea ecx, [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425de7
test eax, eax
jne 0x431eb6
test byte [ebp + 0xc], 2
je 0x431e17
push dword [0x44e4e4]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x238]
push 0x432074
push eax
call fcn.00430bfc
add esp, 0x10
test eax, eax
jl 0x431eb6
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [0x44e4d8]
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], 0x114
call fcn.0042b878
cmp eax, ebx
jne 0x431ddc
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004078ee
test eax, eax
pop ecx
pop ecx
je 0x431ddc
push 1
lea eax, [ebp - 0x124]
push eax
push dword [0x44e4e0]
lea ecx, [ebp + 8]
call fcn.00425e4f
lea eax, [ebp + 0xc]
push eax
push dword [0x44e4d4]
lea ecx, [ebp + 8]
call fcn.0042fadf
test eax, eax
jne 0x431ddc
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push dword [0x44e4dc]
call fcn.00425e35
push 1
lea eax, [ebp - 0x238]
push eax
push dword [0x44e4d8]
lea ecx, [ebp + 8]
call fcn.00425e4f
mov dword [ebp + 0xc], 2
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push ebx
push dword [0x44e4d4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431eb6
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x238]
push eax
push dword [0x44e4e0]
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], 0x114
call fcn.0042b878
test eax, eax
jne 0x431e8c
push 1
lea eax, [ebp - 0x238]
push eax
push dword [0x44e4d8]
lea ecx, [ebp + 8]
call fcn.00425e4f
lea eax, [ebp + 0xc]
push eax
push dword [0x44e4dc]
lea ecx, [ebp + 8]
call fcn.0042fadf
test eax, eax
jne 0x431e7b
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push dword [0x44e4d4]
call fcn.00425e35
jmp 0x431eb6
mov dword [ebp - 0x42c], ebx
lea eax, [ebp - 0x42c]
jmp 0x431dfd
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ebx
push dword [0x44e4d4]
mov dword [ebp + 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [0x44e4d8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004025d3
jmp 0x432021
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x412448
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x432021
mov edi, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x110]
push eax
push dword [0x44e508]
push dword [0x44e4f0]
push dword [0x44e4e8]
call edi
lea eax, [ebp - 0x428]
push eax
push dword [0x44e4f8]
lea eax, [ebp - 0x324]
push eax
call fcn.00430c14
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004078ee
mov ecx, dword [ebp + 0xc]
add esp, 0x14
neg eax
sbb al, al
shr ecx, 1
inc al
and ecx, 1
cmp al, cl
je 0x432021
call fcn.00415d8d
cmp eax, 4
sete byte [ebp + 0xb]
test byte [ebp + 0xc], 2
je 0x431fb5
cmp byte [ebp + 0xb], 0
je 0x431f70
push 0x43203c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea eax, [ebp - 0x324]
push eax
push dword [0x44e4f0]
push dword [0x44e4e8]
call esi
test eax, eax
je 0x432021
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004078ee
test eax, eax
pop ecx
pop ecx
je 0x432021
lea eax, [ebp - 0x110]
push eax
jmp 0x432013
push esi
lea eax, [ebp - 0x110]
push eax
push dword [0x44e508]
push dword [0x44e500]
push dword [0x44e4e8]
call edi
xor ebx, ebx
cmp byte [ebp - 0x110], bl
jne 0x431ff3
cmp byte [ebp + 0xb], bl
jne 0x431ff3
push dword [0x44e4f4]
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004113c0
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea eax, [ebp - 0x110]
push eax
push dword [0x44e4f0]
push dword [0x44e4e8]
call esi
test eax, eax
je 0x432021
push ebx
push dword [0x44e500]
push dword [0x44e4e8]
call esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.00417bd0
leave
ret 8