Function at 0x401c64
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32]
push ebx
push esi
lea eax, [ebp - 0x248]
push edi
mov esi, 0x80000000
push eax
push 0
mov ecx, esi
call fcn.00401e8c
test eax, eax
mov ebx, 0x403140
je 0x401d3c
push str.7_zip.dll
mov edx, 0x404f28
lea ecx, [ebp - 0x248]
call fcn.00401f4e
test eax, eax
je 0x401d3c
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32]
mov ecx, esi
call fcn.00401ed0
test eax, eax
jne 0x401cd3
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000]
mov ecx, esi
call fcn.00401ed0
mov edi, 0x40312c
mov edx, dword [edi]
lea ecx, [ebp - 0x450]
call fcn.0040152d
mov edx, 0x40388c
lea ecx, [ebp - 0x450]
call fcn.00401540
lea edx, [ebp - 0x450]
mov ecx, esi
call fcn.00401ed0
add edi, 4
cmp edi, ebx
jb 0x401cd8
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ecx, 0x80000002
push eax
call fcn.00401a15
test eax, eax
jne 0x401d3c
push str.23170F69_40C1_278A_1000_000100020000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32]
lea eax, [ebp - 0x248]
push eax
push 0
mov ecx, esi
call fcn.00401eeb
test eax, eax
je 0x401dfe
push str.7_zip32.dll
mov edx, 0x404f28
lea ecx, [ebp - 0x248]
call fcn.00401f4e
test eax, eax
je 0x401dfe
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000InprocServer32]
mov ecx, esi
call fcn.00401f45
test eax, eax
jne 0x401d95
mov edx, dword [str.CLSID23170F69_40C1_278A_1000_000100020000]
mov ecx, esi
call fcn.00401f45
mov edi, 0x40312c
mov edx, dword [edi]
lea ecx, [ebp - 0x450]
call fcn.0040152d
mov edx, 0x40388c
lea ecx, [ebp - 0x450]
call fcn.00401540
lea edx, [ebp - 0x450]
mov ecx, esi
call fcn.00401f45
add edi, 4
cmp edi, ebx
jb 0x401d9a
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ecx, 0x80000002
push eax
call fcn.00401f2f
test eax, eax
jne 0x401dfe
push str.23170F69_40C1_278A_1000_000100020000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths7zFM.exe]
lea eax, [ebp - 0x248]
mov esi, 0x80000002
push eax
push 0
mov ecx, esi
call fcn.00401e8c
test eax, eax
je 0x401e43
push str.7zFM.exe
mov edx, 0x404f28
lea ecx, [ebp - 0x248]
call fcn.00401f4e
test eax, eax
je 0x401e43
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths7zFM.exe]
mov ecx, esi
call fcn.00401ed0
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionUninstall7_Zip]
lea eax, [ebp - 0x248]
push eax
push str.UninstallString
mov ecx, esi
call fcn.00401e8c
test eax, eax
je 0x401e87
push dword [0x403128]
mov edx, 0x404f28
lea ecx, [ebp - 0x248]
call fcn.00401f4e
test eax, eax
je 0x401e87
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionUninstall7_Zip]
mov ecx, esi
call fcn.00401ed0
pop edi
pop esi
pop ebx
leave
ret