Function at 0x42b73e
Capabilities:
Accept command line arguments
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd04
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0x4a0138
push edi
mov ecx, esi
mov dword [ebp - 0xcc8], eax
call fcn.004401b6
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push str.setup_process
mov byte [ecx], bl
call fcn.00402510
mov ecx, esi
call fcn.0042641d
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0046e0e0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xcbc]
call fcn.00406cb0
xor eax, eax
mov word [ebp - 0xc30], ax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0xc1c], 7
mov dword [ebp - 0xc20], ebx
call fcn.00401fb0
xor eax, eax
push 0x49b4f8
lea ecx, [ebp - 0xc68]
mov dword [ebp - 0xc54], 7
mov dword [ebp - 0xc58], ebx
mov word [ebp - 0xc68], ax
call fcn.00401fb0
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xcbc]
push ebx
push eax
call fcn.00412100
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0xc68]
call fcn.00402b70
push ebx
push 1
lea ecx, [ebp - 0xc30]
call fcn.00402b70
cmp dword [ebp - 0xcac], 3
ja 0x42b88e
or esi, 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0xcbc]
call fcn.00402b70
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret 0x10
lea ecx, [ebp - 0xd04]
call fcn.00414ce0
push ebx
push ebx
call fcn.0040fea0
pop ecx
pop ecx
call fcn.0043d0c4
test al, al
jne 0x42b98a
lea eax, [ebp - 0xca0]
push 0x138a
push eax
call fcn.0043eee7
pop ecx
pop ecx
push 8
pop edi
cmp dword [eax + 0x14], edi
jb 0x42b8cc
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xc68]
call fcn.00406cb0
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0xca0]
call fcn.00402b70
lea eax, [ebp - 0xca0]
push 0x1388
push eax
call fcn.0043eee7
pop ecx
pop ecx
cmp dword [eax + 0x14], edi
jb 0x42b902
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xc30]
call fcn.00406cb0
push ebx
push esi
lea ecx, [ebp - 0xca0]
call fcn.00402b70
call fcn.0042e85a
mov ecx, eax
call fcn.0042c8c9
test al, al
jne 0x42b95e
mov ecx, dword [ebp - 0xc68]
cmp dword [ebp - 0xc54], edi
jae 0x42b93f
lea ecx, [ebp - 0xc68]
mov eax, dword [ebp - 0xc30]
cmp dword [ebp - 0xc1c], edi
jae 0x42b953
lea eax, [ebp - 0xc30]
push 0x10
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
push esi
lea ecx, [ebp - 0xc30]
call fcn.00402b70
push ebx
push esi
lea ecx, [ebp - 0xc68]
call fcn.00402b70
lea ecx, [ebp - 0xd04]
call fcn.00414d60
xor esi, esi
jmp 0x42b86d
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0046e0e0
add esp, 0xc
push edi
lea eax, [ebp - 0x414]
push eax
push ebx
call esi
test eax, eax
je 0x42b9c4
lea eax, [ebp - 0x414]
push eax
call fcn.004148d0
pop ecx
call fcn.0040ff60
mov esi, str.associate_crx_file_only
mov dword [ebp - 0xcc4], eax
mov eax, esi
mov dword [ebp - 0xc1c], 0xf
mov dword [ebp - 0xc20], ebx
mov byte [ebp - 0xc30], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42b9ef
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0xc30]
call fcn.00402dd0
mov ecx, dword [ebp - 0xcc4]
lea eax, [ebp - 0xc30]
push eax
call fcn.004105c0
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xc30]
mov byte [ebp - 0xcbd], al
call fcn.00402540
cmp byte [ebp - 0xcbd], bl
je 0x42baeb
mov eax, esi
mov dword [ebp - 0xc1c], 0xf
mov dword [ebp - 0xc20], ebx
mov byte [ebp - 0xc30], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42ba54
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0xc30]
call fcn.00402dd0
mov ecx, dword [ebp - 0xcc4]
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xca0]
push eax
call fcn.00410790
push ebx
push 1
lea ecx, [ebp - 0xc30]
call fcn.00402540
xor eax, eax
push str..crx
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0xc1c], 7
mov dword [ebp - 0xc20], ebx
mov word [ebp - 0xc30], ax
call fcn.00401fb0
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xca0]
push eax
call fcn.0042fbf1
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc30]
call fcn.00402b70
push ebx
push 1
lea ecx, [ebp - 0xca0]
jmp 0x42b973
push dword [ebp - 0xcc8]
call fcn.0042b5b7
mov dword [ebp - 0xcc8], eax
pop ecx
lea eax, [ebp - 0xc4c]
push eax
call fcn.0042c877
mov ecx, eax
call fcn.0042cf91
cmp dword [ebp - 0xc3c], edi
jbe 0x42bb5b
cmp dword [ebp - 0xc38], 8
mov eax, dword [ebp - 0xc4c]
jae 0x42bb2d
lea eax, [ebp - 0xc4c]
cmp word [eax], 0x22
jne 0x42bb5b
cmp dword [ebp - 0xc38], 8
mov eax, dword [ebp - 0xc4c]
jae 0x42bb48
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0xc4c]
call fcn.00426354
mov eax, dword [ebp - 0xc3c]
cmp eax, ebx
jbe 0x42bbb0
cmp dword [ebp - 0xc38], 8
mov ecx, dword [ebp - 0xc4c]
jae 0x42bb7a
lea ecx, [ebp - 0xc4c]
add eax, eax
cmp word [ecx + eax - 2], 0x22
jne 0x42bbb0
cmp dword [ebp - 0xc38], 8
mov ecx, dword [ebp - 0xc4c]
jae 0x42bb99
lea ecx, [ebp - 0xc4c]
lea eax, [eax + ecx - 2]
push eax
lea eax, [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0xc4c]
call fcn.00426354
lea eax, [ebp - 0xc4c]
push eax
lea ecx, [ebp - 0xc84]
call fcn.00401f50
cmp dword [ebp - 0xc70], 8
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xcd0], edi
mov dword [ebp - 0xccc], 0x800
jae 0x42bbe7
lea eax, [ebp - 0xc84]
lea ecx, [ebp - 0xccc]
push ecx
lea ecx, [ebp - 0xc14]
push ecx
lea ecx, [ebp - 0xcd0]
push ecx
push eax
mov edi, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push edi
mov esi, SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42bc31
cmp dword [ebp - 0xc70], 8
mov eax, dword [ebp - 0xc84]
jae 0x42bc28
lea eax, [ebp - 0xc84]
push eax
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp - 0xc3c], ebx
jbe 0x42bc85
xor eax, eax
push str..crx
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0xc1c], 7
mov dword [ebp - 0xc20], ebx
mov word [ebp - 0xc30], ax
call fcn.00401fb0
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.0042fbf1
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc30]
call fcn.00402b70
lea ecx, [ebp - 0xc84]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xc4c]
call fcn.00402b70
lea ecx, [ebp - 0xd04]
call fcn.00414d60
mov esi, dword [ebp - 0xcc8]
jmp 0x42b86d