Function at 0x408390
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x420], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], 0
test esi, esi
je 0x408504
test ebx, ebx
je 0x408504
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x408546
push str.SOFTWAREClassesCLSID_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.SOFTWAREClasses_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.SOFTWAREClasses_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x20c]
add esp, 0x24
push eax
push reloc.SHLWAPI.dll_ParseURLW
call ebx
push dword [ebp - 0x41c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40854c
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408541
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x408541
test byte [ecx + 8], 1
je 0x408541
cmp byte [ecx + 0xf], 9
jb 0x408541
push 0
push 0x11
push str.UnregisterServer
push 0xc
push 0x43d36c
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
mov esi, 0x80070057
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push eax
push 0x43d37c
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x4085ce
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call ebx
push dword [ebp - 0x418]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0xc