Function at 0x42a460
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6726
mov eax, dword fs:[0]
push eax
sub esp, 0xc70
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc6c], eax
test eax, eax
je 0x42b0a8
cmp word [eax], 0
je 0x42b0a8
mov edi, dword [ebp + 0x10]
cmp edi, 0x20000
ja 0x42b0a8
test esi, esi
jne 0x42a59e
lea eax, [ebp - 0xc48]
mov dword [ebp - 0xc48], esi
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x42a4ea
lea eax, [esi - 2]
jmp 0x42b0ab
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0xc4c], 0
push eax
push str.softwareFortinetFortiClientFA_DPSTORE
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42a542
lea eax, [ebp - 0xc4c]
push eax
push str.softwareFortinetFortiClientFA_DPSTORE
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x42a542
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffd
jmp 0x42b0ab
push dword [ebp - 0xc6c]
push dword [ebp - 0xc4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42a57f
cmp eax, 2
je 0x42a57f
push dword [ebp - 0xc4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffc
jmp 0x42b0ab
push dword [ebp - 0xc4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x42b0ab
xor eax, eax
mov dword [ebp - 0xc34], 0
mov dword [ebp - 0xc30], 7
mov word [ebp - 0xc44], ax
mov dword [ebp - 4], eax
cmp edi, 0x20000
jae 0x42a75c
cmp edi, 0x800
jae 0x42a75c
mov eax, edi
shr eax, 1
dec eax
cmp eax, 4
jb 0x42a75c
cmp word [esi + eax*2], 0
jne 0x42a75c
push str.Enc
push esi
call fcn.004b4972
add esp, 8
cmp eax, esi
jne 0x42a75c
mov ecx, esi
mov dword [ebp - 0xc4c], 0x400
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a614
sub ecx, edx
lea eax, [ebp - 0xc4c]
push eax
sar ecx, 1
lea eax, [ebp - 0x414]
push eax
lea eax, [ecx - 4]
push eax
lea eax, [esi + 8]
push eax
call fcn.004a7f2a
add esp, 0x10
test eax, eax
jne 0x42a75c
push 0x50dcf0
lea eax, [ebp - 0xc48]
mov dword [ebp - 0xc48], 0x800
push eax
lea eax, [ebp - 0xc14]
push eax
push dword [ebp - 0xc4c]
lea eax, [ebp - 0x414]
push eax
call fcn.004a7f48
add esp, 0x14
test eax, eax
jne 0x42a75c
mov eax, dword [ebp - 0xc48]
cmp eax, 0x800
jae 0x42b0c7
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp + eax - 0xc14], 0
lea eax, [ebp - 0xc14]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc5c], eax
push 2
test eax, eax
jle 0x42a6ef
push eax
call dword [0x4c5964]
mov edi, eax
add esp, 8
test edi, edi
je 0x42a759
push dword [ebp - 0xc5c]
lea eax, [ebp - 0xc14]
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x42a705
push 1
call dword [0x4c5964]
mov edi, eax
add esp, 8
test edi, edi
je 0x42a759
xor eax, eax
mov word [edi], ax
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a710
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xc44]
call int.00410410
push edi
call dword [0x4c5958]
mov eax, dword [ebp - 0xc34]
lea esi, [ebp - 0xc44]
add esp, 4
cmp dword [ebp - 0xc30], 8
cmovae esi, dword [ebp - 0xc44]
lea edi, [eax*2 + 2]
jmp 0x42a75c
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
lea eax, [edi + 0x24]
mov byte [ebp - 4], 2
mov dword [ebp - 0xc58], eax
lea ecx, [ebp - 0xc2c]
add eax, 8
push eax
call fcn.00410130
movups xmm1, xmmword [0x50d250]
cmp dword [ebp - 0xc18], 8
lea ecx, [ebp - 0xc58]
movups xmm0, xmmword [0x4ccc60]
push 0x50d250
push ecx
pxor xmm1, xmm0
lea eax, [ebp - 0xc2c]
movups xmm0, xmmword [0x50d260]
cmovae eax, dword [ebp - 0xc2c]
movups xmmword [0x50d250], xmm1
push eax
movups xmm1, xmmword [0x4ccc70]
push edi
push esi
pxor xmm1, xmm0
mov dword [ebp - 0xc5c], eax
movups xmm0, xmmword [0x50d270]
movups xmmword [0x50d260], xmm1
movups xmm1, xmmword [0x4ccc80]
pxor xmm1, xmm0
movups xmm0, xmmword [0x50d280]
movups xmmword [0x50d270], xmm1
movups xmm1, xmmword [0x4ccc90]
pxor xmm1, xmm0
movups xmmword [0x50d280], xmm1
call fcn.004a7f42
movups xmm1, xmmword [0x50d250]
add esp, 0x14
movups xmm0, xmmword [0x4ccc60]
pxor xmm1, xmm0
movups xmm0, xmmword [0x50d260]
movups xmmword [0x50d250], xmm1
movups xmm1, xmmword [0x4ccc70]
pxor xmm1, xmm0
movups xmm0, xmmword [0x50d270]
movups xmmword [0x50d260], xmm1
movups xmm1, xmmword [0x4ccc80]
pxor xmm1, xmm0
movups xmm0, xmmword [0x50d280]
movups xmmword [0x50d270], xmm1
movups xmm1, xmmword [0x4ccc90]
pxor xmm1, xmm0
movups xmmword [0x50d280], xmm1
test eax, eax
je 0x42a941
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42a8d8
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a8ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42a8ce
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42a937
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a92d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42a92d
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xfffffff1
jmp 0x42b0ab
mov edi, dword [ebp - 0xc5c]
mov ecx, edi
mov esi, dword [ebp - 0xc58]
lea eax, [edi + esi]
cmp edi, eax
jae 0x42a979
xor edx, edx
mov eax, edx
inc edx
and eax, 0x3f
mov al, byte [eax + 0x4ccca0]
xor al, byte [ecx]
rol al, 4
mov byte [ecx], al
inc ecx
mov esi, dword [ebp - 0xc58]
lea eax, [edi + esi]
cmp ecx, eax
jb 0x42a958
lea eax, [ebp - 0xc64]
mov dword [ebp - 0xc78], edi
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc74]
mov dword [ebp - 0xc7c], esi
push eax
push 0
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xc70], 0x4ccc20
xorps xmm0, xmm0
mov dword [ebp - 0xc74], 0x40
push eax
movlpd qword [ebp - 0xc64], xmm0
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
jne 0x42aa85
push dword [ebp - 0xc60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42aa1c
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42aa12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42aa12
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42aa7b
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42aa71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42aa71
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffec
jmp 0x42b0ab
mov eax, dword [ebp - 0xc64]
push 1
lea eax, [eax*2 + 1]
mov dword [ebp - 0xc68], eax
lea eax, [eax*2 + 8]
push eax
call dword [0x4c5964]
mov edi, eax
add esp, 8
test edi, edi
jne 0x42ab6c
push dword [ebp - 0xc60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42ab03
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42aaf9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42aaf9
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42ab62
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ab58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42ab58
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffe2
jmp 0x42b0ab
lea eax, [ebp - 0xc68]
push eax
push edi
push dword [ebp - 0xc64]
push dword [ebp - 0xc60]
call fcn.004a7f4e
add esp, 0x10
mov esi, eax
push dword [ebp - 0xc60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x42ac53
push edi
call dword [0x4c5958]
mov edx, dword [ebp - 0xc18]
add esp, 4
cmp edx, 8
jb 0x42abea
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42abe0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42abe0
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42ac49
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ac3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42ac3f
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffdd
jmp 0x42b0ab
lea eax, [ebp - 0xc50]
mov dword [ebp - 0xc50], 0
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x42ad2c
push edi
call dword [0x4c5958]
mov edx, dword [ebp - 0xc18]
add esp, 4
cmp edx, 8
jb 0x42acc3
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42acb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42acb9
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42ad22
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ad18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42ad18
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffd8
jmp 0x42b0ab
lea eax, [ebp - 0xc54]
mov dword [ebp - 0xc54], 0
push eax
push str.softwareFortinetFortiClientFA_DPSTORE
push dword [ebp - 0xc50]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42ae37
lea eax, [ebp - 0xc54]
push eax
push str.softwareFortinetFortiClientFA_DPSTORE
push dword [ebp - 0xc50]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x42ae37
push edi
call dword [0x4c5958]
add esp, 4
push dword [ebp - 0xc50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42adce
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42adc4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42adc4
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42ae2d
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ae23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42ae23
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffd3
jmp 0x42b0ab
mov eax, dword [ebp - 0xc68]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc6c]
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
test eax, eax
je 0x42af31
call dword [0x4c5958]
add esp, 4
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42aec8
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42aebe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42aebe
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42af27
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42af1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42af1d
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 0xffffffd0
jmp 0x42b0ab
call dword [0x4c5958]
add esp, 4
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc18]
cmp edx, 8
jb 0x42af94
mov ecx, dword [ebp - 0xc2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42af8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42af8a
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov edx, dword [ebp - 0xc30]
xor eax, eax
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 7
mov word [ebp - 0xc2c], ax
cmp edx, 8
jb 0x42aff3
mov ecx, dword [ebp - 0xc44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42afe9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42afe9
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
xor eax, eax
jmp 0x42b0ab
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
call fcn.004af2fd
int3