Function at 0x428000
Capabilities:
Delete registry key

Disassembly:
push 0x30
mov eax, 0x59e25f
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
and dword [ebp - 0x2c], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
and dword [ebp - 0x38], 0
call fcn.0042a8b9
test al, al
je 0x42803a
cmp eax, 0x69e69011
insd dword es:[edi], dx
test dword [0xc1bdce8], ebp
inc esp
adc eax, 0x6583b10a
call 0xbf02b341
loopne 0x428091
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.SOFTWAREClassesCLSID_
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
pop edx
add bh, al
inc ebp
in al, dx
pop es
add byte [eax], al
add byte [esi + 0x66], dl
mov dword [ebp - 0x28], eax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0xf013f
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4280a4
push dword [ebp - 0x2c]
mov ecx, ebx
call fcn.004276a8
cmp dword [ebp - 0x2c], 0
je 0x4280a4
adc esi, esi
invalid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042a8b9
test al, al
je 0x4280bd
sub byte [eax], al
add byte [eax + eax*8 - 0x889ef8c], al
jbe 0x4280a6
dec edx
add esi, dword [ebp + 0x4cb943ed]
rol dword [0xe7d5a266], 0x3a
mov esi, str.CLSID_
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428112
push dword [ebp - 0x30]
mov ecx, ebx
call fcn.004276a8
cmp dword [ebp - 0x30], 0
je 0x428112
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ad4e
test al, al
je 0x428138
mov eax, 0x4aeada77
adc eax, 0xf4a94526
call 0x702a6b7
idiv byte [ebx]
adc ecx, ebp
pop edi
insb byte es:[edi], dx
scasb al, byte es:[edi]
stc
cmp edx, dword [ebp - 0x1397cd8d]
call fcn.0042ae62
test al, al
je 0x42815f
aad 0x9d
lcall 0x6dde, 0x87bba6d6
mov byte [0x6aafb3e1], al
pushal
adc ebp, dword [esi]
push ebp
arpl word [edx + 0x48], si
int 0x29
test byte [edi - 0xd], 0xbb
pop eax
adc ah, bh
mov esi, str.TypeLib_
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4281b5
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
call fcn.0042785e
cmp dword [ebp - 0x34], 0
je 0x4281b5
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ac3a
test al, al
je 0x4281d2
push es
adc eax, 0xb0ea8765
ret 0x46ba
call fcn.0042aa57
test al, al
je 0x4281f9
cmp bh, bl
sbb ah, byte [esp + edx*2]
xor eax, 0x19f4a2f8
daa
inc esp
cmpsd dword [esi], dword es:[edi]
or al, 0x12
sbb dword [eax - 0x42fea1d5], ebp
leave
int1
int3
call fcn.0042ab26
test al, al
je 0x428221
pushal
ret 0xf7b3
mov esi, str.SOFTWAREClassesDirectory_background_shellexContextMenuHandlers_
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x38]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428291
mov esi, 0x5a0a54
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret