Function at 0x428e80
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4692a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x17f]
rep stosd dword es:[edi], eax
mov ecx, dword [str.HVBJ]
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x3c], ecx
mov ecx, dword [str.SoftwareAMDInstall]
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x180], ecx
mov ecx, dword [0x47ae9c]
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov dword [ebp - 0x178], ecx
mov ecx, dword [0x47aea4]
xor edx, edx
mov byte [ebp - 0x3d], al
mov al, byte [0x47aeb0]
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 0x38], al
mov eax, dword [0x47ae98]
push 0xf003f
push edx
mov dword [ebp - 0x17c], eax
mov eax, dword [0x47aea0]
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x5c], dl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x180]
mov dword [ebp - 0x174], eax
mov al, byte [0x47aea8]
push edx
mov esi, 1
push SysReAllocString
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x20
mov dword [ebp - 0x1c], SysReAllocString
mov byte [ebp - 0x16c], al
call ebx
test eax, eax
jne 0x428fce
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0
push str.Command_Line_option_for_DAL
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x428fb9
push str.GetCommandLineOption__:_Bootup_registry_key_deleted_n
mov dword [ebp - 0x20], esi
call fcn.0040a4a0
mov ecx, dword [ebp - 0x14]
add esp, 4
push str.Command_Line_option_for_DAL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x429128
push 0x104
mov dword [ebp - 4], 0
call fcn.0045f1c6
mov edx, eax
add esp, 4
mov dword [ebp - 0x24], edx
jmp 0x429004
test edx, edx
mov dword [ebp - 4], 0xffffffff
je 0x429166
xor eax, eax
mov edi, edx
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], eax
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x64], eax
push edx
mov dword [ebp - 0x60], eax
call fcn.00428c10
add esp, 0xc
test eax, eax
je 0x429154
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x42905f
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
push str.GetCommandLineOption____Access_Registry_n
xor edi, edi
call fcn.0040a4a0
mov eax, dword [ebp - 0x1c]
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push edi
lea edx, [ebp - 0x180]
push edx
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4290cd
push str.GetCommandLineOption____impersonating_current_user_n
call fcn.0040a4a0
add esp, 4
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x4290c9
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push eax
lea eax, [ebp - 0x180]
push eax
push ecx
mov edi, 1
call ebx
mov esi, eax
test esi, esi
jne 0x42910e
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push str.Command_Line_option_for_DAL
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x429104
mov eax, dword [ebp - 0x14]
push str.Command_Line_option_for_DAL
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x42911c
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x429173
mov esi, 1
mov dword [ebp - 0x18], esi
xor edi, edi
lea ecx, [ecx]
movsx esi, byte [ebp + edi - 0x3c]
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0045fc00
xor ebx, ebx
add esp, 8
cmp eax, ebx
jne 0x4291d7
mov dword [ebp - 0x18], ebx
jmp case.0x4291fa.67
push str.GetCommandLineOption____ImpersonateTheUser_failed_n
call fcn.0040a4a0
add esp, 4
jmp 0x42905f
push str.GetCommandLineOption____new_char__MAX_PATH__failed_n
call fcn.0040a4a0
add esp, 4
push str.failed_to_get_boot_up_option_n
call fcn.0040a4a0
add esp, 4
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4291b3
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x42919e
push str.__Failed_to_revert_
call fcn.0040a4a0
add esp, 4
mov edx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x28]
push edx
push esi
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4291c3
push eax
call fcn.0045eab0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
inc eax
push ebx
push eax
call fcn.0045ffbe
add esp, 0xc
cmp eax, ebx
jne 0x4291eb
mov dword [ebp - 0x18], ebx
lea ecx, [esi - 0x42]
cmp ecx, 0x14
ja case.0x4291fa.67
movzx ecx, byte [ecx + 0x429244]
jmp dword [ecx*4 + 0x429230]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
jmp case.0x4291fa.67
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp case.0x4291fa.67
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
jmp case.0x4291fa.67
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
inc edi
cmp edi, 4
jl 0x429130
jmp 0x429180