Function at 0x44a568
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov ebp, r8d
mov r13, rdx
mov r12b, cl
lea rdx, str.CLSID_
lea rcx, [rsp + 0x58]
call fcn.0040294c
nop
lea rdx, str.23170F69_40C1_278A_1000_000100020000
lea rcx, [rsp + 0x58]
call fcn.00402d24
xor r15d, r15d
cmp r12b, r15b
je 0x44a704
mov qword [rsp + 0x40], r15
mov edi, ebp
or edi, 0xf003f
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rbx, 0xffffffff80000000
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.0040c28c
mov esi, eax
cmp eax, r15d
jne 0x44a68f
lea r8, str.7_Zip_Shell_Extension
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0040c084
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x0049ddd0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.0040c28c
mov esi, eax
cmp eax, r15d
jne 0x44a682
mov r8, qword [r13]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c084
mov esi, eax
lea r8, str.Apartment
lea rdx, [0x0049dfc0]
lea rcx, [rsp + 0xd8]
call fcn.0040c084
lea rcx, [rsp + 0xd8]
call fcn.0040c00c
lea rcx, [rsp + 0x40]
call fcn.0040c00c
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xd8]
call fcn.0040c28c
cmp eax, r15d
jne 0x44a6f2
lea r8, str.7_Zip_Shell_Extension
lea rdx, [0x0049deb0]
lea rcx, [rsp + 0xd8]
call fcn.0040c084
lea rcx, [rsp + 0xd8]
call fcn.0040c00c
jmp 0x44a791
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.004029f4
nop
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x40]
call fcn.00402d24
cmp ebp, r15d
jne 0x44a741
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44a75e
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x40]
mov rbx, 0xffffffff80000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x44a770
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x44a786
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
cmp r12b, r15b
je 0x44a8a0
mov edi, r15d
lea r12, [0x0049dd60]
lea rax, str._shellexContextMenuHandlers7_Zip
lea r14, str._shellexDragDropHandlers7_Zip
cmp edi, r15d
cmove r14, rax
lea r13, [0x004ce710]
mov r15d, 4
mov rdx, qword [r13]
lea rcx, [rsp + 0x58]
call fcn.0040294c
nop
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.00402d24
xor ecx, ecx
cmp byte [r12], cl
je 0x44a852
mov qword [rsp + 0xd8], rcx
mov eax, ebp
or eax, 0xf003f
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.0040c28c
lea r8, [0x0049deb0]
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.0040c084
lea rcx, [rsp + 0xd8]
call fcn.0040c00c
jmp 0x44a87b
cmp ebp, ecx
jne 0x44a866
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x44a87b
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
add r13, 8
inc r12
dec r15
jne 0x44a7d0
inc edi
cmp edi, 2
jb 0x44a7ae
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret