Function at 0x44ab30
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov ebp, r8d
mov r13, rdx
mov r12b, cl
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.004029d0
nop
lea rdx, str.23170F69_40C1_278A_1000_000100020000
lea rcx, [rsp + 0x58]
call fcn.00402da8
xor r15d, r15d
cmp r12b, r15b
je 0x44accc
mov qword [rsp + 0x40], r15
mov edi, ebp
or edi, 0xf003f
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rbx, 0xffffffff80000000
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.0040c330
mov esi, eax
cmp eax, r15d
jne 0x44ac57
lea r8, str.7_Zip_Shell_Extension
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0040c128
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x004a3ed0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.0040c330
mov esi, eax
cmp eax, r15d
jne 0x44ac4a
mov r8, qword [r13]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c128
mov esi, eax
lea r8, str.Apartment
lea rdx, [0x004a40c0]
lea rcx, [rsp + 0xd8]
call fcn.0040c128
lea rcx, [rsp + 0xd8]
call fcn.0040c0b0
lea rcx, [rsp + 0x40]
call fcn.0040c0b0
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xd8]
call fcn.0040c330
cmp eax, r15d
jne 0x44acba
lea r8, str.7_Zip_Shell_Extension
lea rdx, [0x004a3fb0]
lea rcx, [rsp + 0xd8]
call fcn.0040c128
lea rcx, [rsp + 0xd8]
call fcn.0040c0b0
jmp 0x44ad59
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.00402a78
nop
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x40]
call fcn.00402da8
cmp ebp, r15d
jne 0x44ad09
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44ad26
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x44ad38
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x44ad4e
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
cmp r12b, r15b
je 0x44ae68
mov edi, r15d
lea r12, [0x004a3e60]
lea rax, str._shellexContextMenuHandlers7_Zip
lea r14, str._shellexDragDropHandlers7_Zip
cmp edi, r15d
cmove r14, rax
lea r13, [0x004d6720]
mov r15d, 4
mov rdx, qword [r13]
lea rcx, [rsp + 0x58]
call fcn.004029d0
nop
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.00402da8
xor ecx, ecx
cmp byte [r12], cl
je 0x44ae1a
mov qword [rsp + 0xd8], rcx
mov eax, ebp
or eax, 0xf003f
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.0040c330
lea r8, [0x004a3fb0]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c128
lea rcx, [rsp + 0xd8]
call fcn.0040c0b0
jmp 0x44ae43
cmp ebp, ecx
jne 0x44ae2e
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44ae43
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
add r13, 8
inc r12
dec r15
jne 0x44ad98
inc edi
cmp edi, 2
jb 0x44ad76
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret