Function at 0x42ea90
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [esp + 0x10]
call fcn.0042ed40
cmp eax, 0xf
ja case.default.0x42eaa9
jmp dword [eax*4 + 0x42ecf8]
push 7
mov eax, 0x4af95c
test edi, edi
mov edx, 0x4ad29c
mov ecx, esi
cmove edx, eax
call fcn.0042ef40
add esp, 4
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x18
jmp 0x42eab2
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eaf7
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
jmp 0x42ec81
push 0x4af960
push 0x80000001
jmp 0x42ec81
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eb25
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
push 0x80000001
jmp 0x42ec81
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
jmp 0x42ec81
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eb4e
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
jmp 0x42ec7c
push 0x4af960
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eb72
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
jmp 0x42ec7c
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42eb96
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx_
jmp 0x42ec7c
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ebba
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices_
jmp 0x42ec7c
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf013f
push 0
test edi, edi
jne 0x42ebde
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce_
jmp 0x42ec7c
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ebff
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun_
jmp 0x42ec7c
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ec1d
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce_
jmp 0x42ec7c
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ec3b
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx_
jmp 0x42ec7c
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ec59
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices_
jmp 0x42ec7c
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServices
jmp 0x42ec7c
lea eax, [esp + 8]
push eax
push 0xf023f
push 0
test edi, edi
jne 0x42ec77
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce_
jmp 0x42ec7c
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42eacb
push esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
test edi, edi
mov eax, str.run_
mov ecx, 0x4afe04
cmove ecx, eax
call fcn.0042f040
mov eax, 1
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
test edi, edi
mov eax, str.load_
mov ecx, str.load
cmove ecx, eax
call fcn.0042f040
mov eax, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret