Function at 0x422cb0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.0042ad4e
test al, al
je 0x422b93
fadd qword [esi + 0x3d711f93]
in eax, 0xf4
loope 0x422bef
enter 0xffffffffffffdb3a, 0x5c
ror dword [esp + ecx*4 + 4], 1
loopne 0x422bb4
mov ds, word [edi]
xor bl, bl
sar byte [esi - 0x7fe717e8], cl
add byte [eax], al
call fcn.0042abb0
test al, al
je 0x422bb1
leave
xor ecx, dword [esi]
and dword [ebx + esi*2 + 0x22], edx
push edx
and dword [esi + 0x24df18f0], eax
inc ecx
in al, dx
pop edi
sahf
sbb esp, ebp
sub eax, 0x8153
call fcn.0042ad09
add byte [eax], al
test al, al
je 0x422bcc
cmp eax, dword [edi + 0xe]
lahf
enter 0x1ed8, 0x43
xor bl, byte [ebx]
sbb al, 0xb5
sahf
loopne 0x422bcf
bound ebp, qword [eax]
sbb ch, byte [eax + 0x3f]
add byte [edi], cl
add byte [edx], ch
push 0xf003f
push 0
verw word [edx]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x422be9
xor al, al
jmp 0x422c9a
push 0xf01ff
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x422be2
call fcn.0042ae1d
test al, al
je 0x422c1d
daa
mov ah, 0xa8
dec edi
rol dword [ebx + 0x1b], 1
popal
invalid
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x422c3b
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.0042ab6b
test al, al
je 0x422c5f
add cl, al
jl 0x422c04
lea ebp, [edi]
adc eax, 0xbbc9ccc7
outsd dx, dword [esi]
or eax, dword [eax + ecx*4]
jecxz 0x422cb0
lcall 0x321e, 0xdb4e1485
and ecx, dword [edi]
cmpsd dword [esi], dword es:[edi]
call fcn.0042aa12
test al, al
je 0x422c86
cmp esp, dword [ebp - 0x17e5023e]
pop eax
xlatb
mov byte [0x9e5b1d1], al
xor eax, 0x3f97460e
invalid
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
sub esp, 0x24
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
mov dword [ebp - 0x24], eax
call fcn.00422b59
test al, al
jne 0x422ce3
mov edi, esi
invalid
push edi
push 0x7d
call fcn.00413331
pop ecx
pop ecx
xor eax, eax
jmp 0x422d98
call fcn.0042ae1d
test al, al
je 0x422cfd
pop edx
adc edi, ebp
pop es
jge 0x422cca
xchg edx, eax
invalid
mov ecx, dword [ebp - 0x24]
push edi
call 0x4229d0
test al, al
jne 0x422d0f
push edi
push 0x7e
jmp 0x422cd5
call fcn.0042a8b9
test al, al
je 0x422d28
push ecx
invalid
lea eax, [ebp - 0x20]
xor edi, edi
push eax
push 0xf003f
push edi
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionSvchost
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422d95
mov esi, str.LocalWorkSvc
mov dword [ebp - 8], 7
push esi
mov dword [ebp - 0xc], edi
mov word [ebp - 0x1c], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403772
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00403628
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4