Function at 0x426bdb
Capabilities:
Delete registry key

Disassembly:
push 0x474
mov eax, 0x59e198
call fcn.005693c7
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.0056f390
push esi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0056f390
push str._shellexContextMenuHandlers_
mov esi, 0x5a0b58
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408d5e
push str._shellexDragDropHandlers_
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00408d5e
add esp, 0x30
call fcn.0042ae62
test al, al
je 0x426c61
retf 0x6cbd
call fcn.0042a8fe
test al, al
je 0x426c83
test al, 0xa3
stosb byte es:[edi], al
invalid
call fcn.0042abb0
test al, al
je 0x426ca8
and byte [esi + esi*8], 0xc8
add al, 0xef
xchg ch, bh
mov ah, 0x37
hlt
xor ebx, ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x478], ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov esi, 0x5a3498
mov dword [ebp - 0x424], 7
push esi
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
xor edi, edi
mov byte [ebp - 4], bl
push ebx
inc edi
lea ecx, [ebp - 0x438]
push edi
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, str.Folder
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, 0x5a4fc8
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
mov esi, str.Drive
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, str.lnkfile
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
call fcn.0042ab6b
test al, al
je 0x426e9e
invalid
jb 0x426e83
xchg edx, eax
push cs
fcmovnb st(0), st(0)
sbb dh, dh
or byte [esi + 0x38], al
dec esi
sub al, 0xe0
xor eax, 0x30cc66ae
shl dword [edi], 1
test dword [ecx - 0x6d], ebx
call 0x3bb2572d
add byte [eax], al
call fcn.0042aa12
test al, al
je 0x426ec5
sti
dec ebx
xchg ecx, eax
inc edx
add al, 0x41
movsb byte es:[edi], byte [esi]
xchg edi, eax
daa
fld xword [edx]
movsb byte es:[edi], byte [esi]
cmp byte [edi], bh
inc esi
mov ecx, 0xa34ae291
pop eax
loopne 0x426e4e
out dx, eax
lodsb al, byte [esi]
xor dword [ebp - 0x24cc204f], edi
xor ebx, ebx
mov dword [ebp - 0x454], 7
xor eax, eax
mov dword [ebp - 0x458], ebx
mov word [ebp - 0x468], ax
mov esi, dword [ebp - 0x480]
mov byte [ebp - 4], 6
jmp 0x42713d
add byte [eax], al
call fcn.0042aa12
test al, al
je 0x426f19
les ebp, [esi + eax*4]
retf
jb 0x426eed
dec ebx
adc eax, 0xd1411af9
mov eax, 0xed514f74
mov word [ecx + ebx*4 + 0x33], fs
stc
cmp eax, 0x4e09b081
invalid
cmp dword [esi + 0x14], 8
jb 0x426f21
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x450]
call fcn.00402ac4
cmp word [ebp - 0x218], 0
mov byte [ebp - 4], 7
jne 0x426f3f
mov eax, ebx
jmp 0x426f4c
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x450]
call fcn.00408c34
call fcn.0042af76
test al, al
je 0x426f7b
loope 0x426efd
cli
mov esp, 0x2f697252
js 0x426fcd
push ecx
cli
mov esp, 0x8210b1f8
pop ss
call fcn.0042aeec
test al, al
je 0x426f9f
jp 0x426ff8
jo 0x426fa4
push ss
xor byte [ebp - 0x5b], ah
inc ebx
scasd eax, dword es:[edi]
dec eax
push 0xffffffffffffffe6
push ecx
add eax, 0xda527c10
lodsd eax, dword [esi]
jge 0x426fc6
mov ecx, esi
jecxz 0x426f88
jecxz 0x426f88
call fcn.0042aea7
add edi, dword [edi]
add byte [eax], al
test al, al
je 0x426fc1
dec ecx
inc esp
mov ecx, dword [ebx]
movsd dword es:[edi], dword [esi]
or dword [ebp + 0x44], edx
mov byte [ecx + 0x55f91721], dh
sbb eax, 0x1a54a279
insb byte es:[edi], dx
dec edi
fsub qword [eax - 0x7a749e2b]
invalid
mov eax, dword [ebp - 0x474]
cmp dword [eax + 0x14], 8
jb 0x426fcf
inc dword [ebx + 0x72081478]
add cl, byte [ebx - 0x7272b000]
enter 0xfffffffffffffffb, 0xffffffffffffffff
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402ac4
cmp word [ebp - 0x420], 0
mov byte [ebp - 4], 8
jne 0x426fef
xor ebx, ebx
mov eax, ebx
jmp 0x426ffe
lea eax, [ebp - 0x420]
push eax
call fcn.00578706
pop ecx
xor ebx, ebx
pop ss
adc eax, 0xdb335900
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00408c34
call fcn.0042ac7f
test al, al
je 0x42702c
js 0x426f9e
hlt
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x46c]
push ebx
push ecx
push ebx
push 0xf013f
push ebx
push ebx
lea eax, [ebp - 0x450]
mov dword [ebp - 0x46c], ebx
cmovae eax, dword [ebp - 0x450]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427084
push 0x5a0a54
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042aeec
test al, al
je 0x42709f
push cs
push cs
xor al, 2
outsd dx, dword [esi]
rol dword [esi + 0x20], 1
imul esi, esi, 0xe3d71ae3
das
add eax, 0xbd83db33
fdiv st(3), st(0)
invalid
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x470]
push ebx
push ecx
push ebx
push 0xf013f
push ebx
push ebx
lea eax, [ebp - 0x438]
mov dword [ebp - 0x470], ebx
cmovae eax, dword [ebp - 0x438]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427114
call fcn.0042ae1d
test al, al
je 0x4270f7
pop esi
cmp dword [esp + edi*4 - 0x66], ecx
jns 0x427143
cmp byte [ecx + 5], ah
mov ebp, 0x748975a9
inc ebp
ljmp 0xa54
push 0x5a0a54
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x438]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.00403628
mov esi, dword [ebp - 0x474]
add esi, 0x18
mov dword [ebp - 0x474], esi
cmp esi, dword [ebp - 0x47c]
jne 0x426eef
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.00403628
lea ecx, [ebp - 0x480]
call fcn.0040c264
call fcn.00569382
ret