Function at 0x428000
Capabilities:
Delete registry key

Disassembly:
push 0x30
mov eax, 0x59e25f
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
and dword [ebp - 0x2c], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
and dword [ebp - 0x38], 0
call fcn.0042a8b9
test al, al
je 0x42803a
dec ebx
and al, 0x75
test eax, 0x1d86cd8
lock sub byte [edi + 0x3b159791], 0x83
call 0xbf02b341
loopne 0x428091
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.SOFTWAREClassesCLSID_
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
pop edx
add bh, al
inc ebp
in al, dx
pop es
add byte [eax], al
add byte [esi + 0x66], dl
mov dword [ebp - 0x28], eax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0xf013f
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4280a4
push dword [ebp - 0x2c]
mov ecx, ebx
call fcn.004276a8
cmp dword [ebp - 0x2c], 0
je 0x4280a4
adc esi, esi
invalid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042a8b9
test al, al
je 0x4280bd
arpl word [ebp - 0x1ae1b570], di
jbe 0x4280c5
aam 0xbc
leave
fcomp qword [ebx]
push edx
invalid
mov esi, str.CLSID_
push esi
call fcn.00578706
pop ecx
push eax
push esi
push es
adc eax, 0x56505900
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
str word [ebp + 0x430fd845]
inc ebp
fsubr dword [edx]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428112
push dword [ebp - 0x30]
mov ecx, ebx
call fcn.004276a8
cmp dword [ebp - 0x30], 0
je 0x428112
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ad4e
test al, al
je 0x428138
cmp sp, word [ebx - 0xa]
cmp dword [eax], ebp
stosb byte es:[edi], al
xchg edi, eax
lodsd eax, dword es:[esi]
or dh, byte [edi]
cmc
cmc
iretd
call fcn.0042ae62
test al, al
je 0x42815f
cmp dword [ecx + 0x3ade3393], 0xd8c878a9
push esi
clc
jae 0x4280de
xchg byte [ebp - 0x5dc32678], al
push 0x78
lodsd eax, dword [esi]
add byte [eax + 0x73a160e5], dh
mov bh, 0xbe
clc
dec edi
pop edx
add byte [esi - 0x18], dl
pushfd
add eax, 0x50590015
mov esi, str.TypeLib_
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4281b5
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
call fcn.0042785e
cmp dword [ebp - 0x34], 0
je 0x4281b5
invalid
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042ac3a
test al, al
je 0x4281d2
cld
fist dword [ebp + 0x5e]
xabort 0xffffffffffffff8f
out 0x80, eax
dec ebp
xor esp, ebp
jge 0x4281a0
mov bh, 0x89
mov bl, 0xa4
cdq
out dx, al
call fcn.0042aa57
test al, al
je 0x4281f9
pop es
out dx, eax
int3
call fcn.0042ab26
test al, al
je 0x428221
push ecx
movsd dword es:[di], dword [si]
inc esi
pop es
push ebp
rol dword [eax - 0x162f480d], 1
adc al, 0xe0
call 0x44cafc82
pop ds
fldenv [eax + 0x40]
cdq
lea esi, [edx + 0x6e903a9]
mov esi, str.SOFTWAREClassesDirectory_background_shellexContextMenuHandlers_
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x38]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428291
mov esi, 0x5a0a54
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret