Function at 0x44ab78
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov ebp, r8d
mov r13, rdx
mov r12b, cl
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.004029e0
nop
lea rdx, str.23170F69_40C1_278A_1000_000100020000
lea rcx, [rsp + 0x58]
call fcn.00402db8
xor r15d, r15d
cmp r12b, r15b
je 0x44ad14
mov qword [rsp + 0x40], r15
mov edi, ebp
or edi, 0xf003f
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rbx, 0xffffffff80000000
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.0040c2f8
mov esi, eax
cmp eax, r15d
jne 0x44ac9f
lea r8, str.7_Zip_Shell_Extension
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0040c0f0
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x004a2ec0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.0040c2f8
mov esi, eax
cmp eax, r15d
jne 0x44ac92
mov r8, qword [r13]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c0f0
mov esi, eax
lea r8, str.Apartment
lea rdx, [0x004a30b0]
lea rcx, [rsp + 0xd8]
call fcn.0040c0f0
lea rcx, [rsp + 0xd8]
call fcn.0040c078
lea rcx, [rsp + 0x40]
call fcn.0040c078
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xd8]
call fcn.0040c2f8
cmp eax, r15d
jne 0x44ad02
lea r8, str.7_Zip_Shell_Extension
lea rdx, [0x004a2fa0]
lea rcx, [rsp + 0xd8]
call fcn.0040c0f0
lea rcx, [rsp + 0xd8]
call fcn.0040c078
jmp 0x44ada1
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.00402a88
nop
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x40]
call fcn.00402db8
cmp ebp, r15d
jne 0x44ad51
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44ad6e
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x44ad80
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x44ad96
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
cmp r12b, r15b
je 0x44aeb0
mov edi, r15d
lea r12, [0x004a2e50]
lea rax, str._shellexContextMenuHandlers7_Zip
lea r14, str._shellexDragDropHandlers7_Zip
cmp edi, r15d
cmove r14, rax
lea r13, [0x004d5720]
mov r15d, 4
mov rdx, qword [r13]
lea rcx, [rsp + 0x58]
call fcn.004029e0
nop
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.00402db8
xor ecx, ecx
cmp byte [r12], cl
je 0x44ae62
mov qword [rsp + 0xd8], rcx
mov eax, ebp
or eax, 0xf003f
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.0040c2f8
lea r8, [0x004a2fa0]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c0f0
lea rcx, [rsp + 0xd8]
call fcn.0040c078
jmp 0x44ae8b
cmp ebp, ecx
jne 0x44ae76
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44ae8b
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
add r13, 8
inc r12
dec r15
jne 0x44ade0
inc edi
cmp edi, 2
jb 0x44adbe
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret