Function at 0x42d940
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1120
call fcn.00467fe0
mov eax, dword [0x4b9b20]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esp + 0x1c], str..doc
mov dword [esp + 0x20], str..docx
mov dword [esp + 0x24], str..xls
mov dword [esp + 0x28], str..xlsx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov edi, edi
push 0x800
lea eax, [esp + 0x130]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004661f0
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + ecx*4 + 0x28]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push closesocket
call edi
test eax, eax
jne 0x42dd2d
push str.Shell
lea edx, [esp + 0x130]
push edx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42daaa
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.004661f0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
jne 0x42dd2d
push str.Open
lea eax, [esp + 0x30]
push eax
call ebp
test eax, eax
je 0x42dac3
push 0x20
push str.Open
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call fcn.0042d600
add esp, 0x18
test eax, eax
je 0x42dd2d
jmp 0x42dac3
push 1
push 0
lea edx, [esp + 0x134]
push edx
push closesocket
call fcn.0042d730
add esp, 0x10
push str.Opencommand
lea eax, [esp + 0x130]
push eax
call ebx
cmp dword [esp + 0x1134], 0
je 0x42dc8f
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x936]
push edx
mov word [esp + 0x938], cx
call fcn.004661f0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x930]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
mov dword [esp + 0x28], 0x800
call edi
test eax, eax
jne 0x42dd2d
lea ecx, [esp + 0x92c]
push 0x490390
push ecx
call fcn.00468b09
add esp, 8
test eax, eax
je 0x42dbe0
push str..doc
xor edx, edx
push esi
mov word [eax], dx
call ebp
test eax, eax
je 0x42db94
push str..docx
push esi
call ebp
test eax, eax
je 0x42db94
push str..xls
push esi
call ebp
test eax, eax
je 0x42db85
push str..xlsx
push esi
call ebp
test eax, eax
jne 0x42dba3
push str.___1_
lea eax, [esp + 0x930]
push eax
jmp 0x42dba1
push str.__t__n___1_
lea ecx, [esp + 0x930]
push ecx
call ebx
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042d600
add esp, 0x18
test eax, eax
je 0x42dd2d
push 0x800
lea eax, [esp + 0x930]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.004661f0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x930]
push edx
lea eax, [esp + 0x1c]
push eax
push str.command
lea ecx, [esp + 0x13c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x42dd2d
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push str.command
lea edx, [esp + 0x13c]
push edx
push closesocket
call fcn.0042d600
add esp, 0x18
test eax, eax
je 0x42dd2d
push str.command
lea eax, [esp + 0x130]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x42dd2d
jmp 0x42dcc1
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042d730
push 1
push str.command
lea edx, [esp + 0x144]
push edx
push closesocket
call fcn.0042d730
add esp, 0x20
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.00466eac
add esp, 8
test eax, eax
je 0x42dd2d
push str.ddeexec
lea edx, [esp + 0x130]
xor ecx, ecx
push edx
mov word [eax], cx
call ebx
cmp dword [esp + 0x1134], 0
je 0x42dd14
push 0
push 0
push 1
push 0
lea eax, [esp + 0x13c]
push eax
push closesocket
call fcn.0042d600
add esp, 0x18
jmp 0x42dd2d
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push closesocket
call fcn.0042d730
add esp, 0x10
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jb 0x42d9a0
mov ecx, dword [esp + 0x112c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00466e70
add esp, 0x1120
ret 4