Function at 0x42785e
Capabilities:
Delete registry key

Disassembly:
jmp 0x9c3f9e11
push 0x2c
mov eax, 0x59e232
call fcn.005693c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call fcn.0042acc4
test al, al
je 0x42789b
mov dword [ecx], ebp
jge 0x4278ec
jle 0x427825
call 0xe7f8c243
add ah, cl
lea esi, [ebp - 0x28]
mov ebx, 0xfb69a57d
call fcn.0042aa57
test al, al
je 0x4278bc
xchg dword [ebx + 0xa], esp
xor esi, dword [edx - 0x57]
loope 0x42783c
pop edi
jae 0x42790c
sub ah, al
pop ebx
test al, 0x66
aaa
pop edi
daa
mov ecx, 0xe8b78a28
and byte [edx], dh
add byte [eax], al
call fcn.0042aae1
test al, al
je 0x4278dd
int1
xor bl, bh
xchg dword [edi], ecx
les ebx, [ebp - 0x3692e757]
arpl word [ebx - 0x10], bp
stosd dword es:[edi], eax
mov esi, 0xa5366fed
jle 0x427938
mov cl, 0x5e
xor eax, eax
mov dword [ebp - 0x14], 7
mov esi, 0x5a500c
mov word [ebp - 0x28], ax
mov dword [ebp - 0x28], eax
xor ebx, ebx
push esi
mov dword [ebp - 0x18], ebx
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov esi, str.34E7B5C6_21C6_4A4B_AEFF_CD81A5A6EA57
mov dword [ebp - 4], ebx
cld
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
mov esi, 0x5a505c
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
call fcn.0042ac7f
test al, al
je 0x42794f
add byte [eax + eax*8 - 0x4999ed8c], al
lcall 0xacf5, 0x61e39743
mov dh, 0x9a
inc ebx
xchg edi, eax
jecxz 0x4279a5
cmc
lodsb al, byte [esi]
mov edx, 0xf70bd5c3
cdq
ljmp 0x8d08
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov edi, 0xf013f
push ecx
push edi
push ebx
push eax
push dword [ebp - 0x38]
call esi
test eax, eax
jne 0x427a8d
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push 0x5a512c
push dword [ebp - 0x34]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4279e9
lea eax, [ebp - 0x30]
push eax
push edi
push 0
mov edi, 0x5a0c30
push edi
push dword [ebp - 0x2c]
call esi
test eax, eax
jne 0x4279c6
push str.win32
push dword [ebp - 0x30]
call ebx
push str.win64
push dword [ebp - 0x30]
call ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp - 0x2c]
call ebx
push str.FLAGS
push dword [ebp - 0x2c]
call ebx
push str.HELPDIR
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ae1d
test al, al
je 0x427a0a
fcomi st(0)
xchg esi, eax
mov dh, 0xbf
arpl word [ecx + 0x2bc576ac], sp
lodsd eax, dword [esi]
aas
arpl bp, si
or edi, dword [ebx]
insd dword es:[edi], dx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x5a512c
push dword [ebp - 0x34]
call ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ad4e
test al, al
je 0x427a41
adc byte [edx + 0x51], al
rcr esi, 1
nop
xchg ebp, eax
sub eax, 0xf4579237
js 0x427a5e
jl 0x427a8c
push edi
pop ss
fld dword [edi + 0x2a83196a]
or bh, dl
call fcn.0042abb0
test al, al
je 0x427a5f
das
dec esp
imul edi, dword [edi - 0x37a2e4bb], 0x5f35dd33
enter 0xffffffffffffdd33, 0x35
pop edi
mov ebp, 0x125f7631
pop esp
xchg ebx, eax
call fcn.0042ad09
call fcn.0042ad09
test al, al
je 0x427a7a
outsd dx, dword [esi]
jl 0x427a51
shr al, cl
jecxz 0x4279f0
out 0xc7, eax
call 0xc685b12f
aam 0xbb
rol byte [ebx - 0x72f71383], 1
inc ebp
fmul dword [edi]
inc ebx
inc ebp
fcom dword [eax - 1]
jne 0x427a51
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call ebx
xor ebx, ebx
fist dword [ebx + 0x6a]
add dword [ebp - 0x6f1727b3], ecx
mov ebx, 0xe5e8fffd
sbb byte [eax + eax], dl
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret 4