Function at 0x427361
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
cmp dword [0x462284], 0
je 0x4273a0
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push 0x474584
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
jmp 0x4273f4
cmp dword [0x462280], 0
je 0x4273d3
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push 0x4745b0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
jmp 0x4273f4
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push 0x4745dc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427441
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42741f
push str._nUsage_of_this_function_is_intended_only_for_Windows_NT_2000_XP_systems.
call fcn.00452380
add esp, 4
jmp 0x427437
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push str._nERROR___d___d__Opening_Services_Key.
call fcn.00452380
add esp, 0xc
mov eax, 0xff
jmp 0x42761d
mov dword [ebp - 0xc], 0x200
mov byte [ebp - 0x20b], 0
mov al, byte [ebp - 0x20b]
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x47467c
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427608
cmp dword [0x462284], 0
je 0x4274f0
push str.system32drivers_stlwa_64.sys
lea eax, [ebp - 0x20c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x4274d0
push 0x200
lea eax, [ebp - 0x20c]
push eax
push str.SystemRoot_system32drivers_stlwa_64.sys
call fcn.004280cc
add esp, 0xc
jmp 0x4274eb
push 0x200
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004280cc
add esp, 0xc
jmp 0x4275ac
cmp dword [0x462280], 0
je 0x427557
push str.system32drivers_stvista.sys
lea eax, [ebp - 0x20c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x427537
push 0x200
lea eax, [ebp - 0x20c]
push eax
push str.SystemRoot_system32drivers_stvista.sys
call fcn.004280cc
add esp, 0xc
jmp 0x427552
push 0x200
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004280cc
add esp, 0xc
jmp 0x4275ac
push str.system32drivers_stlwmon.sys
lea eax, [ebp - 0x20c]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x427591
push 0x200
lea eax, [ebp - 0x20c]
push eax
push str.SystemRoot_system32drivers_stlwmon.sys
call fcn.004280cc
add esp, 0xc
jmp 0x4275ac
push 0x200
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004280cc
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
movsx eax, byte [ebp - 0x20b]
cmp eax, 0x3f
jne 0x4275d9
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
jmp 0x4275e9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 8]
push eax
push str._n__d___d_Removed_SYS_Image___s_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x42761d
pop edi
pop esi
pop ebx
leave
ret