Function at 0x428790
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x17f]
rep stosd dword es:[edi], eax
mov ecx, dword [str.HVBJ]
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x3c], ecx
mov ecx, dword [str.SoftwareAMDInstall]
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x180], ecx
mov ecx, dword [0x47abb4]
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov dword [ebp - 0x178], ecx
mov ecx, dword [0x47abbc]
xor edx, edx
mov byte [ebp - 0x3d], al
mov al, byte [0x47abc8]
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 0x38], al
mov eax, dword [0x47abb0]
push 0xf003f
push edx
mov dword [ebp - 0x17c], eax
mov eax, dword [0x47abb8]
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x5c], dl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x180]
mov dword [ebp - 0x174], eax
mov al, byte [0x47abc0]
push edx
mov esi, 1
push SysReAllocString
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x20
mov dword [ebp - 0x1c], SysReAllocString
mov byte [ebp - 0x16c], al
call ebx
test eax, eax
jne 0x4288de
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0
push str.Command_Line_option_for_DAL
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4288c9
push str.GetCommandLineOption__:_Bootup_registry_key_deleted_n
mov dword [ebp - 0x20], esi
call fcn.0040aac0
mov ecx, dword [ebp - 0x14]
add esp, 4
push str.Command_Line_option_for_DAL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x428a38
push 0x104
mov dword [ebp - 4], 0
call fcn.0045e556
mov edx, eax
add esp, 4
mov dword [ebp - 0x24], edx
jmp 0x428914
test edx, edx
mov dword [ebp - 4], 0xffffffff
je 0x428a76
xor eax, eax
mov edi, edx
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], eax
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x64], eax
push edx
mov dword [ebp - 0x60], eax
call fcn.00428520
add esp, 0xc
test eax, eax
je 0x428a64
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x42896f
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
push str.GetCommandLineOption____Access_Registry_n
xor edi, edi
call fcn.0040aac0
mov eax, dword [ebp - 0x1c]
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push edi
lea edx, [ebp - 0x180]
push edx
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4289dd
push str.GetCommandLineOption____impersonating_current_user_n
call fcn.0040aac0
add esp, 4
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x4289d9
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push eax
lea eax, [ebp - 0x180]
push eax
push ecx
mov edi, 1
call ebx
mov esi, eax
test esi, esi
jne 0x428a1e
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push str.Command_Line_option_for_DAL
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x428a14
mov eax, dword [ebp - 0x14]
push str.Command_Line_option_for_DAL
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x428a2c
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x428a83
mov esi, 1
mov dword [ebp - 0x18], esi
xor edi, edi
lea ecx, [ecx]
movsx esi, byte [ebp + edi - 0x3c]
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0045ef90
xor ebx, ebx
add esp, 8
cmp eax, ebx
jne 0x428ae7
mov dword [ebp - 0x18], ebx
jmp case.0x428b0a.67
push str.GetCommandLineOption____ImpersonateTheUser_failed_n
call fcn.0040aac0
add esp, 4
jmp 0x42896f
push str.GetCommandLineOption____new_char__MAX_PATH__failed_n
call fcn.0040aac0
add esp, 4
push str.failed_to_get_boot_up_option_n
call fcn.0040aac0
add esp, 4
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x428ac3
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x428aae
push str.__Failed_to_revert_
call fcn.0040aac0
add esp, 4
mov edx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x28]
push edx
push esi
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x428ad3
push eax
call fcn.0045de40
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
inc eax
push ebx
push eax
call fcn.0045f34e
add esp, 0xc
cmp eax, ebx
jne 0x428afb
mov dword [ebp - 0x18], ebx
lea ecx, [esi - 0x42]
cmp ecx, 0x14
ja case.0x428b0a.67
movzx ecx, byte [ecx + 0x428b54]
jmp dword [ecx*4 + 0x428b40]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
jmp case.0x428b0a.67
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp case.0x428b0a.67
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
jmp case.0x428b0a.67
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
inc edi
cmp edi, 4
jl 0x428a40
jmp 0x428a90