Function at 0x42dfe9
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0xf4], eax
xor edi, edi
xor eax, eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x104], esi
mov dword [ebp - 0xec], edi
mov dword [ebp - 0x64], 7
mov dword [ebp - 0x68], edi
mov word [ebp - 0x78], ax
call fcn.00416c04
test al, al
jne 0x42e054
push 0x543da0
lea eax, [ebp - 0x78]
push eax
call fcn.00402178
cmp byte [ebp + 0x14], 0
je 0x42e064
call fcn.0042e6e4
jmp 0x42e247
call fcn.0042c4d2
cmp byte [ebp + 0x10], 0
je 0x42e0d5
cmp dword [ebp - 0x68], edi
jne 0x42e086
call fcn.0042aaf9
test al, al
jne 0x42e086
call fcn.0042ace0
test al, al
je 0x42e0d5
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42e0d5
call fcn.00452c1a
cmp dword [eax], 3
jl 0x42e0d5
push 0xc
push str.run_as_admin
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x24], 0
call fcn.00405913
xor ebx, ebx
lea eax, [ebp - 0x24]
inc ebx
push eax
mov dword [ebp - 0xec], ebx
call fcn.0044cf63
test al, al
jne 0x42e0d8
mov byte [ebp - 0xed], bl
jmp 0x42e0df
xor ebx, ebx
inc ebx
mov byte [ebp - 0xed], 0
test byte [ebp - 0xec], 1
je 0x42e0f9
and dword [ebp - 0xec], 0xfffffffe
push edi
push ebx
lea ecx, [ebp - 0x24]
call fcn.0040582f
cmp byte [ebp - 0xed], 0
je 0x42e247
push dword [esi]
lea eax, [ebp - 0x94]
call fcn.0044a559
lea eax, [ebp - 0x94]
push eax
lea esi, [ebp - 0x5c]
call fcn.0040202c
push ebx
xor edi, edi
lea esi, [ebp - 0x94]
call fcn.004021a4
push dword [ebp - 0xf4]
lea esi, [ebp - 0x24]
call fcn.0040204f
mov esi, 0x5480e0
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0040afbc
push 0x5432dc
lea eax, [ebp - 0x24]
push eax
call fcn.0040afbc
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0040afbc
push str.remove_chrome_registration
lea eax, [ebp - 0x24]
push eax
call fcn.0040afbc
cmp dword [ebp - 0x68], edi
je 0x42e216
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0040afbc
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x100], str.register_chrome_browser_suffix
mov dword [ebp - 0xfc], 0x1e
call fcn.0045297f
pop ecx
push edi
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x24]
call fcn.0040b83a
push ebx
lea esi, [ebp - 0x94]
call fcn.004021a4
push 0x548ab8
lea edi, [ebp - 0x78]
lea eax, [ebp - 0x40]
call fcn.00414ab4
mov dword [esp], 0x544efc
push eax
call fcn.0040afbc
push eax
lea esi, [ebp - 0x94]
call fcn.00402a37
mov eax, esi
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x24]
call fcn.0040b83a
push ebx
xor edi, edi
lea esi, [ebp - 0x94]
call fcn.004021a4
push ebx
lea esi, [ebp - 0x40]
call fcn.004021a4
lea eax, [ebp - 0xf4]
push eax
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x5c]
mov dword [ebp - 0xf4], 9
call fcn.00436f31
pop ecx
push ebx
xor edi, edi
lea esi, [ebp - 0x24]
call fcn.004021a4
push ebx
lea esi, [ebp - 0x5c]
call fcn.004021a4
call fcn.00408ff5
push 0xf003f
push 0x542e0c
mov ebx, 0x80000001
push ebx
lea esi, [ebp - 0x100]
call fcn.0044eefb
test byte [ebp - 0xec], 4
je 0x42e282
and dword [ebp - 0xec], 0xfffffffb
lea esi, [ebp - 0x1cc]
call fcn.0044dd6a
push 0x543e90
push dword [ebp - 0x100]
call dword [0x52b00c]
lea esi, [ebp - 0x100]
call fcn.0044effe
cmp dword [0x59ce00], edi
je 0x42e2ab
call fcn.0042c5e3
mov eax, dword [ebp - 0x108]
cmp dword [eax + 0x10], edi
je 0x42e2bb
call fcn.0042c714
call fcn.0042ca9e
call fcn.0042cae0
call fcn.0042d96e
call fcn.0040e52c
add eax, 0x1c
push eax
lea esi, [ebp - 0xe8]
call fcn.0040202c
mov eax, esi
push eax
lea eax, [ebp - 0xb0]
call fcn.0044a559
push str.360se6Application
lea esi, [ebp - 0x5c]
call fcn.0040204f
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
call fcn.0044abc8
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0044a59f
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.004021a4
push 1
lea esi, [ebp - 0x5c]
call fcn.004021a4
push 1
push dword [ebp - 0x108]
lea ecx, [ebp - 0xb0]
call fcn.00401bab
pop ecx
pop ecx
call fcn.004380f1
mov esi, eax
mov eax, dword [esi]
push ebx
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, esi
mov dword [ebp - 0xf4], esi
call dword [eax + 0x6c]
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
mov ecx, esi
call dword [eax + 0x74]
push ebx
call fcn.00436e20
pop ecx
push 1
lea esi, [ebp - 0x40]
call fcn.004021a4
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ecx]
lea edx, [ebp - 0x40]
push edx
call dword [eax + 0x78]
push ebx
call fcn.00436e20
pop ecx
push 1
lea esi, [ebp - 0x40]
call fcn.004021a4
call fcn.004097ca
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
mov dword [ebp - 0xf8], 9
call fcn.0042d087
add esp, 0xc
lea eax, [ebp - 0xf8]
push eax
call fcn.0042d83f
cmp byte [ebp + 0x10], 0
pop ecx
je 0x42e480
xor esi, esi
cmp dword [ebp - 0x68], esi
jne 0x42e3e5
call fcn.0042aaf9
test al, al
je 0x42e3fd
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x80000002
call fcn.0042d087
add esp, 0xc
push 0xf003f
push 0x543da0
push 0x80000002
lea eax, [ebp - 0x100]
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
call fcn.0044ef31
push 0x542da8
lea esi, [ebp - 0x24]
call fcn.0040204f
push 0x543538
lea esi, [ebp - 0x5c]
call fcn.0040204f
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00414d70
pop ecx
push 1
xor edi, edi
call fcn.004021a4
push 0x80000002
lea eax, [ebp - 0x24]
call fcn.00436e20
pop ecx
lea esi, [ebp - 0x100]
call fcn.0044effe
push 1
lea esi, [ebp - 0x24]
call fcn.004021a4
lea esi, [ebp - 0x100]
call fcn.0044effe
mov eax, dword [ebp - 0x108]
cmp dword [eax + 0x10], 0
jne 0x42e4dd
mov dword [ebp - 0xf4], 6
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0xcc]
call fcn.004021a4
push ebx
lea esi, [ebp - 0xb0]
call fcn.004021a4
push ebx
lea esi, [ebp - 0xe8]
call fcn.004021a4
push ebx
lea esi, [ebp - 0x78]
call fcn.004021a4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xf4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
mov ecx, dword [ebp - 0x104]
call fcn.0042c583
and dword [ebp - 0x14], 0
mov byte [ebp - 0xfc], al
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 0xf8], 6
call fcn.0040e52c
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040edde
push 1
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
call fcn.0044a559
mov ecx, eax
call fcn.004498a9
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.004021a4
push 1
lea esi, [ebp - 0x5c]
call fcn.004021a4
lea ecx, [ebp - 0x104]
call fcn.0041268d
cmp byte [ebp - 0x102], 0
je 0x42e55c
call fcn.00412890
lea eax, [ebp - 0x104]
push eax
call fcn.00412cc0
call fcn.00452c1a
cmp dword [eax], 3
jge 0x42e577
call fcn.00408995
push dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x24]
push eax
call fcn.0042b1d3
pop ecx
pop ecx
cmp eax, 1
jne 0x42e59f
mov dword [ebp - 0xf8], 7
jmp 0x42e5ae
cmp eax, 2
jne 0x42e5ae
mov dword [ebp - 0xf8], 0xb
cmp byte [ebp + 0x14], 0
jne 0x42e630
test byte [ebp - 0xec], 2
je 0x42e5cf
and dword [ebp - 0xec], 0xfffffffd
lea esi, [ebp - 0x1cc]
call fcn.0044dd6a
mov eax, dword [ebp - 0xf4]
mov esi, dword [eax]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x5c]
call fcn.0044a559
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x108]
call fcn.0044e4da
pop ecx
push eax
lea edi, [ebp - 0x118]
call fcn.00456d63
mov ecx, dword [ebp - 0xf4]
push eax
call dword [esi + 4]
mov esi, edi
call fcn.004347fb
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040582f
push 1
xor edi, edi
lea esi, [ebp - 0x5c]
call fcn.004021a4
cmp dword [ebp - 0x14], 0
je 0x42e658
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x40]
call fcn.0044a559
mov ecx, eax
call fcn.004498a9
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.004021a4
cmp dword [0x59ce00], 0
je 0x42e6c7
call fcn.0040e52c
push 0xf003f
push str.software
push ebx
lea esi, [ebp - 0x110]
call fcn.0044eefb
test byte [ebp - 0xec], 0x20
je 0x42e697
and dword [ebp - 0xec], 0xffffffdf
lea esi, [ebp - 0x1cc]
call fcn.0044dd6a
test byte [ebp - 0xec], 0x40
je 0x42e6ab
lea esi, [ebp - 0x1cc]
call fcn.0044dd6a
push str.360360se6
push dword [ebp - 0x110]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea esi, [ebp - 0x110]
call fcn.0044effe
push 1
xor edi, edi
lea esi, [ebp - 0x24]
call fcn.004021a4
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
jmp 0x42e496