Function at 0x42d5f5
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x559ece
call fcn.00514868
mov eax, 0x2254
call fcn.00514be0
mov eax, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov ecx, eax
mov edi, dword [ebp + 8]
push edi
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0d
push ebx
jmp 0x42dae2
push 0x5ccd88
push edi
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x5ccd2c
sbb ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42d66c
test ebx, ebx
je 0x42d720
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
cmp dword [ebp + 0x10], 0
je 0x42d720
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push 0x5c
push edi
call fcn.0042e55b
pop ecx
pop ecx
test eax, eax
jne 0x42dafa
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0042b9f0
test eax, eax
je 0x42d6db
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.0042d1b8
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
jmp 0x42d6dd
xor eax, eax
test ebx, ebx
je 0x42d715
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42daf0
push edi
mov ecx, ebx
call fcn.0042e4c5
mov esi, eax
xor eax, eax
test esi, esi
js 0x42daf2
mov byte [ebp - 4], al
lea ecx, [ebp - 0x20]
jmp 0x42da90
mov byte [ebp - 4], al
lea ecx, [ebp - 0x20]
call fcn.0042ba92
push 0x5ccd5c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [ebp - 0x10]
test eax, eax
jne 0x42d748
push edi
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push 0x5ccd0c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42d851
lea eax, [ebp - 0x2260]
mov ecx, ebx
push eax
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push edi
mov ecx, ebx
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push 0x3d
pop eax
cmp word [edi], ax
jne 0x42db07
cmp dword [ebp + 0x10], 0
je 0x42d7e6
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2260]
push edi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov ecx, ebx
push eax
call fcn.0042b0fe
mov esi, eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
test esi, esi
js 0x42db2d
mov byte [ebp - 4], al
lea ecx, [ebp - 0x3c]
jmp 0x42da90
cmp dword [ebp + 0x14], 0
jne 0x42d844
cmp dword [ebp + 8], 0
je 0x42d844
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
push 0x20006
push eax
push dword [ebp + 0xc]
call fcn.0042ca27
test eax, eax
jne 0x42db35
lea eax, [ebp - 0x2260]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42d837
cmp eax, 2
jne 0x42db35
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x58]
call fcn.0042ba92
push edi
mov ecx, ebx
call fcn.0042e4c5
jmp 0x42dadc
push 0x5c
push edi
call fcn.0042e55b
pop ecx
pop ecx
test eax, eax
jne 0x42db07
cmp dword [ebp + 0x10], eax
je 0x42d8ee
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
push 0x2001f
push edi
push esi
call fcn.0042ca27
test eax, eax
je 0x42d8b2
push 0x20019
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0042ca27
test eax, eax
je 0x42d8b2
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push esi
call fcn.0042baac
test eax, eax
jne 0x42d9cc
push edi
mov ecx, ebx
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push 0x3d
pop eax
cmp word [edi], ax
jne 0x42da95
push edi
xor eax, eax
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042b0fe
mov esi, eax
test esi, esi
js 0x42db0c
jmp 0x42da95
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x42d908
push 0x20019
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0042ca27
jmp 0x42d90b
push 2
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], esi
test eax, eax
je 0x42d91c
mov dword [ebp - 0x30], 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x260]
push 0x104
push eax
call fcn.0053d474
push eax
call fcn.0042b629
add esp, 0x14
mov ecx, ebx
push edi
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push edi
mov ecx, ebx
call fcn.0042e4c5
mov esi, eax
test esi, esi
js 0x42db0c
push 0x7b
pop eax
cmp word [edi], ax
jne 0x42d9b2
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x4c]
jne 0x42d96a
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x42d9b2
push dword [ebp - 0x30]
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp - 0x2c]
push edi
call fcn.0042d5f5
mov esi, eax
test esi, esi
jns 0x42d9a0
cmp dword [ebp - 0x30], 0
je 0x42db0c
push edi
mov ecx, ebx
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x42dae2
test eax, eax
je 0x42d9da
cmp dword [ebp + 0x14], 0
jne 0x42dae2
push eax
call fcn.0042b695
pop ecx
mov esi, eax
jmp 0x42db0c
cmp dword [ebp + 0x14], 0
je 0x42da22
push dword [ebp - 0x2c]
mov ecx, ebx
call fcn.0042c708
test eax, eax
je 0x42da22
lea eax, [ebp - 0x260]
mov ecx, ebx
push eax
call fcn.0042b9f0
test eax, eax
je 0x42dae2
cmp dword [ebp + 8], 0
je 0x42dae2
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042d1b8
jmp 0x42dae2
push dword [ebp - 0x2c]
mov ecx, ebx
call fcn.0042c708
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
call fcn.0042ba92
test eax, eax
jne 0x42d9cc
cmp dword [ebp + 8], eax
je 0x42dae2
cmp dword [ebp - 0x14], eax
jne 0x42dae2
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x48]
push eax
call fcn.0042beb3
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
test eax, eax
jne 0x42db4d
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x48]
call fcn.0042ba92
cmp dword [ebp + 0x10], 0
je 0x42dae2
push 0x7b
pop eax
cmp word [edi], ax
jne 0x42dae2
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x4c]
jne 0x42daa8
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x42dae2
xor eax, eax
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
push edi
call fcn.0042d5f5
mov esi, eax
test esi, esi
js 0x42db0c
push edi
mov ecx, ebx
call fcn.0042c8e8
mov esi, eax
test esi, esi
js 0x42db0c
push 0x7d
pop eax
cmp word [edi], ax
jne 0x42d63c
jmp 0x42db0c
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x20]
jmp 0x42db46
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x20]
call fcn.0042ba92
mov esi, 0x80020009
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0042ba92
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], al
lea ecx, [ebp - 0x3c]
jmp 0x42db46
push eax
call fcn.0042b695
mov esi, eax
xor eax, eax
pop ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 0x58]
call fcn.0042ba92
jmp 0x42db0c
push eax
call fcn.0042b695
mov esi, eax
xor eax, eax
pop ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 0x48]
jmp 0x42db46