Function at 0x42c400
Capabilities:
Delete file
Delete registry key
Persist via contextmenuhandlers registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c5ab
mov eax, dword fs:[0]
push eax
sub esp, 0x75c
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x764], 1
push 0
push eax
mov dword [ebp - 0x760], 0x104
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x764]
push eax
push str.InstallDate
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c4a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push str.InstallDate
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x638]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x638], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.004230a0
mov ecx, eax
test ecx, ecx
je 0x42c6f8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x75c], eax
movzx eax, word [ebp - 0x62c]
push eax
movzx eax, word [ebp - 0x62e]
push eax
movzx eax, word [ebp - 0x630]
push eax
movzx eax, word [ebp - 0x632]
push eax
movzx eax, word [ebp - 0x636]
push eax
movzx eax, word [ebp - 0x638]
push eax
lea eax, [ebp - 0x75c]
mov dword [ebp - 4], 0
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.0040c210
mov esi, dword [ebp - 0x75c]
add esp, 0x20
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.LastUninstallDate
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SOFTWAREHaloDesktop
push SysReAllocString
call edi
lea ecx, [ebp - 0x758]
call fcn.0043b810
lea eax, [ebp - 0x758]
push eax
call fcn.0043c090
test eax, eax
je 0x42c68f
push str.DirectoryBackground_shellexContextMenuHandlers083B4516_7502_4311_8453_B5D8E05A156E
push SysReAllocString
call edi
push str.CLSID083B4516_7502_4311_8453_B5D8E05A156E
push SysReAllocString
call edi
push str.DirectoryBackground_shellexContextMenuHandlers6251BDF8_B6EA_4D7F_B250_D67862EED691
push SysReAllocString
call edi
push str.CLSID6251BDF8_B6EA_4D7F_B250_D67862EED691
push SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492a50
lea ecx, [ebp - 0x218]
add esp, 0xc
mov esi, ecx
lea eax, [ebp - 0x628]
sub eax, esi
mov edx, 0x104
mov esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x42c64e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42c64e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42c630
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x53219c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x75c]
jmp 0x42c6a7
push 0x5323fc
push SysReAllocString
call edi
push str.DesktopBackground_shell_
push SysReAllocString
call edi
push str.Directory_shellHalo
push SysReAllocString
call edi
lea ecx, [ebp - 0x758]
call fcn.0043b850
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42c6dd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404b60
int3