Function at 0x409cfd
Capabilities:
Delete registry key

Disassembly:
push 0x30
mov eax, 0x596fd4
call fcn.00410ff3
mov esi, ecx
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], eax
call fcn.004159f2
test al, al
je 0x409d42
push edi
pop esp
push esp
pop edi
push esi
pop edx
push ecx
pop edx
push esi
pop edx
push esi
push eax
push esp
pop ebx
pop ebp
push ebx
pop ebx
push edx
push esp
pop ebp
push ebp
push edi
push ebp
pop esi
push ebx
pop ebx
mov esi, dword [ebp - 0x38]
call fcn.004158de
test al, al
je 0x409d5c
pop ebp
push esi
pop eax
pop esp
push ecx
pop ebp
push ebx
pop ebp
pop ecx
pop edi
push edi
pop ecx
push ecx
pop eax
pop ebx
push esp
pop edx
call fcn.004155e7
test al, al
je 0x409d77
pop ecx
push esp
pop ebp
push esi
pop esp
pop eax
pop edi
push ebp
push esp
pop edi
push ecx
pop ecx
push edx
push ecx
pop ecx
push eax
push esp
push ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov edi, str.SOFTWAREClassesCLSID_
mov word [ebp - 0x28], ax
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00434fd1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401f62
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409ddf
push dword [ebp - 0x2c]
mov ecx, esi
call fcn.004091f7
cmp dword [ebp - 0x2c], ebx
je 0x409ddf
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004159f2
test al, al
je 0x409e02
push edi
pop esp
push esp
pop edi
push esi
pop edx
push ecx
pop edx
push esi
pop edx
push esi
push eax
push esp
pop ebx
pop ebp
push ebx
pop ebx
push edx
push esp
pop ebp
push ebp
push edi
push ebp
pop esi
push ebx
pop ebx
call fcn.004158de
test al, al
je 0x409e1c
pop ebp
push esi
pop eax
pop esp
push ecx
pop ebp
push ebx
pop ebp
pop ecx
pop edi
push edi
pop ecx
push ecx
pop eax
pop ebx
push esp
pop edx
call fcn.004155e7
test al, al
je 0x409e37
pop ecx
push esp
pop ebp
push esi
pop esp
pop eax
pop edi
push ebp
push esp
pop edi
push ecx
pop ecx
push edx
push ecx
pop ecx
push eax
push esp
push ecx
mov esi, str.CLSID_
push esi
call fcn.00434fd1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401f62
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
mov ebx, 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e8e
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
call fcn.004091f7
cmp dword [ebp - 0x30], 0
je 0x409e8e
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004155a2
test al, al
je 0x409eb2
pop eax
push edx
push edi
push esp
push ebp
pop ebp
pop eax
push eax
pop esi
push esi
pop eax
pop esp
push esi
push esi
push eax
push esp
push eax
push eax
pop ecx
push edx
pop esi
push edx
pop esp
pop eax
push esi
push ebp
push edx
call fcn.004158de
test al, al
je 0x409ed8
pop esp
push ebx
pop esp
pop esp
pop esp
pop edi
pop eax
pop eax
push esi
push esi
pop eax
push esi
push ebx
push eax
push ebp
push ebp
push ebp
push edi
pop edi
pop ebp
pop esp
push ebx
push ebp
pop ebx
mov ebx, 0xf013f
mov esi, str.TypeLib_
push esi
call fcn.00434fd1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401f62
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409f2a
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
call fcn.004093e6
cmp dword [ebp - 0x34], 0
je 0x409f2a
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004155e7
test al, al
je 0x409f50
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
mov esi, str.SOFTWAREClassesDirectory_background_shellexContextMenuHandlers_
push esi
call fcn.00434fd1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401f62
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x3c]
push ecx
push ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409fbc
mov esi, str.GDSHLC4EF0604Zipcls
push esi
call fcn.00434fd1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401f62
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401bfd
call fcn.00410fae
ret