Function at 0x412c39
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1074
call fcn.00424e30
sub esp, eax
mov dword [esp], str.Registering_Chrome_extension
call fcn.00411655
lea eax, [ebp - 0x15]
mov ecx, eax
call fcn.00436750
call fcn.00411583
mov edx, eax
lea eax, [ebp - 0x1030]
lea ecx, [ebp - 0x15]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call fcn.0043d460
sub esp, 8
lea eax, [ebp - 0x15]
mov ecx, eax
call fcn.00436780
lea eax, [ebp - 0x1030]
mov dword [esp], str._afrodita_chrome.manifest
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
lea eax, [ebp - 0x1030]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.SoftwareGoogleChromeNativeMessagingHostscom.soffid.esso_chrome1
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
call fcn.00411583
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1048]
mov ecx, eax
call fcn.0043d820
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x412d5e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x412d37
lea eax, [ebp - 0x1048]
mov dword [esp], 0x5c
mov ecx, eax
call fcn.0043e3d0
sub esp, 4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
movsx edx, al
lea eax, [ebp - 0x1048]
mov dword [esp], edx
mov ecx, eax
call fcn.0043e3d0
sub esp, 4
add dword [ebp - 0xc], 1
jmp 0x412d02
lea eax, [ebp - 0x1030]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], 0x44800e
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1048]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 8], eax
mov dword [esp + 4], str._n___name_:__com.soffid.esso_chrome1____n___description_:__Soffid_Chrome_ESSO_Handler____n___path_:___s_afrodita_chrome.exe___n___type_:__stdio___n___allowed_origins_:___n_____chrome_extension:__phjdhfhnbedpkmplaegoejildnieofcf____n_____chrome_extension:__bnkdlnnmeeaifncdjedofbdpmipicljc____n_____chrome_extension:__gacgphonbajokjblndebfhakgcpbemdl____n_____chrome_extension:__ggafmbddcpnehaegkbfleodcbjnllmbc___n____n_n
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00431910
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.https:__clients2.google.com_service_update2_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], str.update_url
mov dword [esp + 8], str.SoftwareGoogleChromeExtensionsgacgphonbajokjblndebfhakgcpbemdl
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.https:__clients2.google.com_service_update2_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], str.update_url
mov dword [esp + 8], str.SoftwareGoogleChromeExtensionsphjdhfhnbedpkmplaegoejildnieofcf
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.ggafmbddcpnehaegkbfleodcbjnllmbc_https:__clients2.google.com_service_update2_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x4483fd
mov dword [esp + 8], str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.phjdhfhnbedpkmplaegoejildnieofcf_https:__clients2.google.com_service_update2_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x44848d
mov dword [esp + 8], str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.https:__edge.microsoft.com_extensionwebstorebase_v1_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], str.update_url
mov dword [esp + 8], str.SoftwareMicrosoftEdgeExtensionsggafmbddcpnehaegkbfleodcbjnllmbc
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.https:__edge.microsoft.com_extensionwebstorebase_v1_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], str.update_url
mov dword [esp + 8], str.SoftwareMicrosoftEdgeExtensions_bnkdlnnmeeaifncdjedofbdpmipicljc
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.ggafmbddcpnehaegkbfleodcbjnllmbc_https:__edge.microsoft.com_extensionwebstorebase_v1_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x4483fd
mov dword [esp + 8], str.SoftwarePoliciesMicrosoftEdgeExtensionInstallForcelist
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], str.bnkdlnnmeeaifncdjedofbdpmipicljc_https:__edge.microsoft.com_extensionwebstorebase_v1_crx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x44848d
mov dword [esp + 8], str.SoftwarePoliciesMicrosoftEdgeExtensionInstallForcelist
mov dword [esp + 4], 0x80000002
mov dword [esp], 0
call fcn.004117e4
lea eax, [ebp - 0x104c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareGoogleChromeExtensions
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x412ff7
mov eax, dword [ebp - 0x104c]
mov dword [esp + 4], str.ecdihhgdjciiabklgobilokhejhecjbm
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x104c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x1048]
mov ecx, eax
call fcn.0043dfb0
lea eax, [ebp - 0x1030]
mov ecx, eax
call fcn.0043dfb0
jmp 0x413053
mov ebx, dword [ebp - 4]
leave
ret