Function at 0x43ebc0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1dc]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea ecx, [esp + 0xe1]
push ebx
push ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0xe8], bl
call fcn.004f67e0
add esp, 0xc
push str.RegDeleteKeyExA
push str.ADVAPI32.DLL
mov dword [esp + 0x18], 0x2001f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
call fcn.00424490
test eax, eax
je 0x43ec34
mov dword [esp + 0x10], 0x2011f
mov esi, SysReAllocStringLen
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], str.CLSID_sInProcServer32
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], str.CLSID_s
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
xor eax, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + eax + 0x1c]
push edx
push eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.004f726c
add esp, 0xc
cmp ebp, ebx
je 0x43eca6
mov edx, dword [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xe4]
push eax
push esi
call ebp
jmp 0x43ecb5
lea ecx, [esp + 0xdc]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc edi
mov eax, edi
shl eax, 4
mov esi, dword [esp + eax + 0x18]
cmp esi, ebx
jne 0x43ec75
mov esi, SysReAllocStringLen
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], str.Folder_shellexContextMenuHandlers910
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
xor eax, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + eax + 0x1c]
push edx
push eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.004f726c
add esp, 0xc
cmp ebp, ebx
je 0x43ed21
mov edx, dword [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xe4]
push eax
push esi
call ebp
jmp 0x43ed30
lea ecx, [esp + 0xdc]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc edi
mov eax, edi
shl eax, 4
mov esi, dword [esp + eax + 0x18]
cmp esi, ebx
jne 0x43ecf0
mov eax, SysReAllocStringLen
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
xor edi, edi
mov dword [esp + 0x1c], str.CLSID_sInProcServer32
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], str.CLSID_s
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
xor eax, eax
mov esi, SysReAllocStringLen
mov edx, dword [esp + 0x14]
mov eax, dword [esp + eax + 0x1c]
push edx
push eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.004f726c
add esp, 0xc
cmp ebp, ebx
je 0x43edb5
mov edx, dword [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xe4]
push eax
push esi
call ebp
jmp 0x43edc4
lea ecx, [esp + 0xdc]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc edi
mov eax, edi
shl eax, 4
mov esi, dword [esp + eax + 0x18]
cmp esi, ebx
jne 0x43ed84
mov esi, SysReAllocStringLen
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], str._shellexContextMenuHandlers910
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
xor eax, eax
nop
mov edx, dword [esp + 0x14]
mov eax, dword [esp + eax + 0x1c]
push edx
push eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.004f726c
add esp, 0xc
cmp ebp, ebx
je 0x43ee31
mov edx, dword [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xe4]
push eax
push esi
call ebp
jmp 0x43ee40
lea ecx, [esp + 0xdc]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc edi
mov eax, edi
shl eax, 4
mov esi, dword [esp + eax + 0x18]
cmp esi, ebx
jne 0x43ee00
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x58], 2
jne 0x43eea9
mov ecx, 0x12
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved910
lea edi, [esp + 0xdc]
rep movsd dword es:[edi], dword [esi]
cmp ebp, ebx
je 0x43ee96
mov eax, dword [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0xe4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
jmp 0x43eea9
lea edx, [esp + 0xdc]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004f6592
add esp, 0x1d4
ret 8