Function at 0x410c20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51df23
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004cbbe0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004cbbe0
push str._shellexContextMenuHandlers_
lea eax, [ebp - 0x218]
push 0x526068
push eax
call fcn.0040c370
push str._shellexDragDropHandlers_
lea eax, [ebp - 0x420]
push 0x526068
push eax
call fcn.0040c370
add esp, 0x30
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
xor eax, eax
mov dword [ebp - 4], 0
push 0x526988
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
call fcn.0040b4a0
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
push 0
lea ecx, [ebp - 0x474]
call fcn.0040f030
mov edx, dword [ebp - 0x43c]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x410d50
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410d46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41138f
push edx
push ecx
call fcn.0049bb5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x428], 0
push 0x52698c
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.0040b4a0
mov esi, dword [ebp - 0x46c]
mov edi, dword [ebp - 0x470]
mov byte [ebp - 4], 2
cmp esi, edi
je 0x410dcf
movups xmm0, xmmword [ebp - 0x438]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
mov edx, 7
movups xmmword [edi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [edi + 0x10], xmm0
add edi, 0x18
mov dword [ebp - 0x470], edi
jmp 0x410df4
lea eax, [ebp - 0x438]
push eax
push edi
lea ecx, [ebp - 0x474]
call fcn.0040f030
mov esi, dword [ebp - 0x46c]
mov edi, dword [ebp - 0x470]
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x410e32
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410e28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411394
push edx
push ecx
call fcn.0049bb5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x428], 0
push str.Directory
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.0040b4a0
mov byte [ebp - 4], 3
cmp esi, edi
je 0x410ea5
movups xmm0, xmmword [ebp - 0x438]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
mov edx, 7
movups xmmword [edi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [edi + 0x10], xmm0
add edi, 0x18
mov dword [ebp - 0x470], edi
jmp 0x410eca
lea eax, [ebp - 0x438]
push eax
push edi
lea ecx, [ebp - 0x474]
call fcn.0040f030
mov esi, dword [ebp - 0x46c]
mov edi, dword [ebp - 0x470]
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x410f08
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410efe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411399
push edx
push ecx
call fcn.0049bb5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x428], 0
push str.Drive
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.0040b4a0
mov byte [ebp - 4], 4
cmp esi, edi
je 0x410f7b
movups xmm0, xmmword [ebp - 0x438]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
mov edx, 7
movups xmmword [edi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [edi + 0x10], xmm0
add edi, 0x18
mov dword [ebp - 0x470], edi
jmp 0x410fa0
lea eax, [ebp - 0x438]
push eax
push edi
lea ecx, [ebp - 0x474]
call fcn.0040f030
mov esi, dword [ebp - 0x46c]
mov edi, dword [ebp - 0x470]
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x410fde
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410fd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41139e
push edx
push ecx
call fcn.0049bb5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x428], 0
push str.lnkfile
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.0040b4a0
mov byte [ebp - 4], 5
cmp esi, edi
je 0x411051
movups xmm0, xmmword [ebp - 0x438]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
mov edx, 7
movups xmmword [edi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [edi + 0x10], xmm0
add edi, 0x18
mov dword [ebp - 0x470], edi
jmp 0x411070
lea eax, [ebp - 0x438]
push eax
push edi
lea ecx, [ebp - 0x474]
call fcn.0040f030
mov edi, dword [ebp - 0x470]
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4110ae
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4110a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4113a3
push edx
push ecx
call fcn.0049bb5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov esi, dword [ebp - 0x474]
mov byte [ebp - 4], 6
cmp esi, edi
je 0x411316
nop dword [eax]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4110ea
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x440], 0
mov word [ebp - 0x450], cx
lea ecx, [ebp - 0x450]
push eax
mov dword [ebp - 0x43c], 7
call fcn.0040b4a0
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411120
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0040b840
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41114c
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], cx
lea ecx, [ebp - 0x438]
push eax
mov dword [ebp - 0x424], 7
call fcn.0040b4a0
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411182
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.0040b840
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x478]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x450]
mov dword [ebp - 0x478], 0
cmovae eax, dword [ebp - 0x450]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x411205
push 0x525e00
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x47c]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x438]
mov dword [ebp - 0x47c], 0
cmovae eax, dword [ebp - 0x438]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x411266
push 0x525e00
push dword [ebp - 0x47c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x47c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x4112aa
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4112a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41138f
push edx
push ecx
call fcn.0049bb5c
add esp, 8
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x41130b
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411301
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41138f
push edx
push ecx
call fcn.0049bb5c
add esp, 8
add esi, 0x18
cmp esi, edi
jne 0x4110e0
mov esi, dword [ebp - 0x474]
test esi, esi
je 0x411374
lea eax, [ebp - 0x474]
push eax
push edi
push esi
call fcn.0040efc0
mov ecx, dword [ebp - 0x46c]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 0xc
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x41136a
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4113a8
push ecx
push esi
call fcn.0049bb5c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049be04
mov esp, ebp
pop ebp
ret
call fcn.004cf6b9
call fcn.004cf6b9
call fcn.004cf6b9
call fcn.004cf6b9
call fcn.004cf6b9
call fcn.004cf6b9
int3