Function at 0x42faf0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1120
call fcn.0046a1a0
mov eax, dword [0x4bcb20]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esp + 0x1c], str..doc
mov dword [esp + 0x20], str..docx
mov dword [esp + 0x24], str..xls
mov dword [esp + 0x28], str..xlsx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov edi, edi
push 0x800
lea eax, [esp + 0x130]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004683b0
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + ecx*4 + 0x28]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push closesocket
call edi
test eax, eax
jne 0x42fedd
push str.Shell
lea edx, [esp + 0x130]
push edx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42fc5a
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.004683b0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
jne 0x42fedd
push str.Open
lea eax, [esp + 0x30]
push eax
call ebp
test eax, eax
je 0x42fc73
push 0x20
push str.Open
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call fcn.0042f8b0
add esp, 0x18
test eax, eax
je 0x42fedd
jmp 0x42fc73
push 1
push 0
lea edx, [esp + 0x134]
push edx
push closesocket
call fcn.0042f9e0
add esp, 0x10
push str.Opencommand
lea eax, [esp + 0x130]
push eax
call ebx
cmp dword [esp + 0x1134], 0
je 0x42fe3f
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x936]
push edx
mov word [esp + 0x938], cx
call fcn.004683b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x930]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
mov dword [esp + 0x28], 0x800
call edi
test eax, eax
jne 0x42fedd
lea ecx, [esp + 0x92c]
push 0x492b7c
push ecx
call fcn.0046acc9
add esp, 8
test eax, eax
je 0x42fd90
push str..doc
xor edx, edx
push esi
mov word [eax], dx
call ebp
test eax, eax
je 0x42fd44
push str..docx
push esi
call ebp
test eax, eax
je 0x42fd44
push str..xls
push esi
call ebp
test eax, eax
je 0x42fd35
push str..xlsx
push esi
call ebp
test eax, eax
jne 0x42fd53
push str.___1_
lea eax, [esp + 0x930]
push eax
jmp 0x42fd51
push str.__t__n___1_
lea ecx, [esp + 0x930]
push ecx
call ebx
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042f8b0
add esp, 0x18
test eax, eax
je 0x42fedd
push 0x800
lea eax, [esp + 0x930]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004683b0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x930]
push edx
lea eax, [esp + 0x1c]
push eax
push str.command
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x42fedd
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push str.command
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042f8b0
add esp, 0x18
test eax, eax
je 0x42fedd
push str.command
lea eax, [esp + 0x130]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x42fedd
jmp 0x42fe71
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042f9e0
push 1
push str.command
lea edx, [esp + 0x144]
push edx
push closesocket
call fcn.0042f9e0
add esp, 0x20
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.0046906c
add esp, 8
test eax, eax
je 0x42fedd
push str.ddeexec
lea edx, [esp + 0x130]
xor ecx, ecx
push edx
mov word [eax], cx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42fec4
push 0
push 0
push 1
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
call fcn.0042f8b0
add esp, 0x18
jmp 0x42fedd
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042f9e0
add esp, 0x10
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jb 0x42fb50
mov ecx, dword [esp + 0x112c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00469030
add esp, 0x1120
ret 4