Function at 0x10001ab7
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
push eax
push 2
push esi
mov ebx, SysReAllocString
push str.Drive_shellexContextMenuHandlers
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
cmp eax, esi
jne 0x10001b14
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001b14
push 0x100090e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
je 0x10001b14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
push esi
push str.Folder_shellexContextMenuHandlers
push ebx
call edi
cmp eax, esi
jne 0x10001b59
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001b59
push 0x100090e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
je 0x10001b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
push esi
push str.Directory_shellexContextMenuHandlers
push ebx
call edi
cmp eax, esi
jne 0x10001b9e
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001b9e
push 0x100090e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
je 0x10001b9e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
push esi
push str.binimage_shellexContextMenuHandlers
push ebx
call edi
cmp eax, esi
jne 0x10001be3
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001be3
push 0x100090e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
je 0x10001be3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
push esi
push str.UltraISO_shellexContextMenuHandlers
push ebx
call edi
cmp eax, esi
jne 0x10001c28
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001c28
push 0x10009248
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
je 0x10001c28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test ebx, eax
jne 0x10001c7b
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, esi
jne 0x10001c7b
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x10001c7b
push str.AD392E40_428C_459F_961E_9B147782D099
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 4], esi
je 0x10001c7b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
push esi
push 1
push 0x1000a678
call fcn.1000391d
cmp dword [ebp - 4], esi
mov edi, eax
je 0x10001c98
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret