Function at 0x42bbdb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x3444]
mov eax, 0x34c4
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x3440], eax
and dword [ebp - 0x64], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x64]
push eax
mov esi, str.SoftwareMicrosoftInternet_ExplorerIntelliForms
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42bcbb
mov ebx, 0x1046
push ebx
push eax
mov word [ebp + 0xfe8], ax
lea eax, [ebp + 0xfea]
push eax
call fcn.004dbcc0
mov edi, 0x823
mov dword [ebp - 0x68], edi
jmp 0x42bc95
xor eax, eax
push ebx
push eax
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push eax
call fcn.004dbcc0
lea eax, [ebp + 0xfe8]
push eax
push esi
push 0x507a0c
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.004d5add
add esp, 0x20
lea eax, [ebp - 0x60]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x42bcb2
push 0x1048
push eax
lea eax, [ebp + 0xfe8]
push eax
mov dword [ebp - 0x68], edi
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xfe8]
push eax
push 0
push dword [ebp - 0x64]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
je 0x42bc42
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + 0x3238], ax
lea eax, [ebp + 0x323a]
push esi
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.004dbcc0
lea eax, [ebp - 0x64]
push eax
call fcn.0043fe13
add esp, 0x10
test eax, eax
je 0x42be56
mov ecx, dword [ebp - 0x64]
lea ebx, [ebp + 0x3238]
call fcn.0043f9ed
mov ebx, 0x104
push ebx
lea eax, [ebp + 0x2030]
push str.SoftwareMicrosoftProtected_Storage_System_Provider_
push eax
call fcn.004d6323
lea eax, [ebp + 0x3238]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x42bd22
sub eax, edx
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x42bd36
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
lea eax, [ebp + 0x2030]
push eax
lea eax, [ebp + 0x3030]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004d6323
lea eax, [ebp + 0x3030]
push eax
lea esi, [ebp - 0x6c]
call fcn.0043fab6
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0043fb46
add esp, 0x18
mov ebx, 0x80000001
test eax, eax
je 0x42be1c
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x2030]
push eax
push ebx
call fcn.0043fd0d
add esp, 0x10
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x42bdb2
mov esi, str.Data
movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x80]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x2030]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call fcn.0043fd0d
add esp, 0x10
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x42bde3
push 0x13
pop ecx
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x2030]
push eax
mov esi, str.e161255a_37c3_11d2_bcaa_00c04fd929db
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0043fd0d
add esp, 0x10
lea eax, [ebp + 0x2030]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor esi, esi
cmp dword [ebp - 0x68], esi
je 0x42be34
push dword [ebp - 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x6c], esi
je 0x42be56
push 0
push dword [ebp - 0x6c]
lea eax, [ebp + 0x3030]
push eax
push ebx
call fcn.0043fd0d
push dword [ebp - 0x6c]
call fcn.004d5a72
add esp, 0x14
cmp dword [ebp - 0x64], 0
pop edi
pop esi
pop ebx
je 0x42be71
push dword [ebp - 0x64]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp + 0x3440]
xor ecx, ebp
call fcn.004d5a7d
add ebp, 0x3444
leave
ret