Function at 0x426bdb
Capabilities:
Delete registry key

Disassembly:
push 0x474
mov eax, 0x59e198
call fcn.005693c7
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.0056f390
push esi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0056f390
push str._shellexContextMenuHandlers_
mov esi, 0x5a0b58
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408d5e
push str._shellexDragDropHandlers_
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00408d5e
add esp, 0x30
call fcn.0042ae62
test al, al
je 0x426c61
psubsb mm1, qword [eax]
lahf
fidivr word [ebx]
invalid
call fcn.0042a8fe
test al, al
je 0x426c83
in eax, 0xda
xchg byte [edi - 0x36], al
xor al, 0x10
aam 0x1b
mov dword [0x56554213], eax
test al, 0x81
outsb dx, byte [esi]
xor edi, dword [esi + 0x55b994d7]
or ebp, eax
sub byte [edi], bh
add byte [eax], al
call fcn.0042abb0
test al, al
je 0x426ca8
pop ds
cwde
xor al, 0x82
and bh, bl
test al, 0x99
cli
ret
xor ebx, ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x478], ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov esi, 0x5a3498
mov dword [ebp - 0x424], 7
push esi
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
xor edi, edi
mov byte [ebp - 4], bl
push ebx
inc edi
lea ecx, [ebp - 0x438]
push edi
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, str.Folder
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, 0x5a4fc8
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
mov esi, str.Drive
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, str.lnkfile
mov dword [ebp - 0x428], ebx
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x480]
call fcn.004115d9
push ebx
push edi
cmpsd dword [esi], dword es:[edi]
invalid
call dword [ebx + 0x57]
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.00403628
call fcn.0042ab6b
test al, al
je 0x426e9e
and ah, byte [0x47e8a50f]
xchg esp, eax
jle 0x426e9a
jge 0x426e67
out 0xd1, eax
cmp ebp, edi
push 0x59
inc eax
retf 0x9fe8
jecxz 0x426e69
mov byte [0x3b6fe8dd], al
add byte [eax], al
call fcn.0042aa12
test al, al
je 0x426ec5
fstp qword [edx + 0x43]
cwde
test dword ss:[edx], edi
fadd qword [eax + 0x4c]
stosd dword es:[edi], eax
lcall 0x4bad, 0xb8aa2d8c
invalid
xor ebx, ebx
mov dword [ebp - 0x454], 7
xor eax, eax
mov dword [ebp - 0x458], ebx
mov word [ebp - 0x468], ax
mov esi, dword [ebp - 0x480]
mov byte [ebp - 4], 6
jmp 0x42713d
call fcn.0042aa12
test al, al
je 0x426f19
mov al, 0xdd
push ebx
push esp
mov bh, ch
cmp ebp, esp
adc dword [eax], edi
invalid
cmp dword [esi + 0x14], 8
jb 0x426f21
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x450]
call fcn.00402ac4
cmp word [ebp - 0x218], 0
mov byte [ebp - 4], 7
jne 0x426f3f
jmp dword [esi - 0x7d]
mov eax, ebx
jmp 0x426f4c
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x450]
call fcn.00408c34
call fcn.0042af76
test al, al
je 0x426f7b
mov dword [eax - 0x197fa3eb], ebx
pop ecx
out dx, al
pop edx
or ebx, dword [esi + 0x37890bd2]
add eax, 0xe858e406
insb byte es:[edi], dx
aas
call fcn.0042aeec
add byte [eax], al
test al, al
je 0x426f9f
out 4, al
js 0x426fe0
jle 0x426ff6
ja 0x426f7e
ficomp dword [edi + 0x6f7a5bd]
jo 0x426f2c
adc dh, byte [ebx - 0x7b]
test al, 0x36
jno 0x426fd7
popal
cli
xchg dword [edi - 0x18], eax
add edi, dword [edi]
add byte [eax], al
call fcn.0042aea7
test al, al
je 0x426fc1
sbb dl, bl
sbb esp, dword [edi + ebx - 0x691dbb5b]
sti
cli
stosb byte es:[edi], al
dec byte [ecx - 0x1194328d]
adc byte [edi + edx*4], cl
sbb eax, 0x8bba560e
test dword [ebx + edi*8 + 0x7883ffff], ecx
adc al, 8
mov eax, dword [ebp - 0x474]
cmp dword [eax + 0x14], 8
jb 0x426fcf
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402ac4
cmp word [ebp - 0x420], 0
mov byte [ebp - 4], 8
jne 0x426fef
jmp 0x67426d96
invalid
xor ebx, ebx
mov eax, ebx
jmp 0x426ffe
lea eax, [ebp - 0x420]
push eax
call fcn.00578706
pop ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00408c34
call fcn.0042ac7f
test al, al
je 0x42702c
out dx, al
mov esp, 0xb76969af
jne 0x427095
mov ebp, 0x5c0f0606
push cs
mov ch, 0xb4
outsd dx, dword [esi]
xchg dword [ebx - 0x43b43], eax
dec dword [eax]
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x46c]
push ebx
push ecx
push ebx
push 0xf013f
push ebx
push ebx
lea eax, [ebp - 0x450]
mov dword [ebp - 0x46c], ebx
cmovae eax, dword [ebp - 0x450]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427084
push 0x5a0a54
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042aeec
test al, al
je 0x42709f
cld
inc ebx
sbb byte [ecx + ecx*8 - 0x58], cl
inc edi
push ecx
jae 0x4270c3
ret 0x2d98
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x470]
push ebx
push ecx
push ebx
push 0xf013f
push ebx
push ebx
lea eax, [ebp - 0x438]
mov dword [ebp - 0x470], ebx
cmovae eax, dword [ebp - 0x438]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427114
inc ebx
test eax, ecx
sti
invalid
call fcn.0042ae1d
test al, al
je 0x4270f7
loopne 0x4270da
lodsd eax, dword [esi]
push cs
mov ebp, 0x45da4438
insd dword es:[edi], dx
cmp edi, ebp
pop eax
nop
in eax, dx
sbb byte [ebx + 0x68db3367], ch
push esp
or bl, byte [edx]
push 0x5a0a54
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x438]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.00403628
mov esi, dword [ebp - 0x474]
add esi, 0x18
mov dword [ebp - 0x474], esi
cmp esi, dword [ebp - 0x47c]
jne 0x426eef
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.00403628
lea ecx, [ebp - 0x480]
call fcn.0040c264
call fcn.00569382
ret