Function at 0x4895a1
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x4ef2fe
call fcn.004ebd20
sub esp, 0x23c
mov eax, dword [0x517ad4]
push ebx
xor eax, ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll__wcsicmp]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0xc]
push str.AudioCD
push edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x248], eax
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
push str.Directory
push edi
inc ebx
call esi
mov edi, eax
mov eax, dword [0x51b438]
add esp, 0x10
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x238], eax
and dword [ebp - 4], 0
test ebx, ebx
jne 0x48963b
test edi, edi
jne 0x48963b
lea eax, [ebp - 0x23c]
push eax
xor eax, eax
inc eax
lea esi, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x2e
call fcn.004034a6
push dword [ebp - 0x22c]
lea eax, [ebp - 0x238]
push eax
call fcn.00403184
and dword [ebp - 0x220], 0
mov dword [ebp - 0x23c], 0x104
and dword [ebp - 0x224], 0
test ebx, ebx
mov byte [ebp - 4], 2
jne 0x489b01
test edi, edi
jne 0x489b01
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea edi, [ebp - 0x22c]
call fcn.00403098
mov eax, dword [ebp - 0x238]
mov edi, dword [eax - 8]
push eax
lea eax, [ebp - 0x22c]
call fcn.00403522
and dword [ebp - 0x21c], ebx
mov esi, 0x2001f
push esi
push dword [ebp - 0x22c]
lea eax, [ebp - 0x21c]
push reloc.ttpcomm.dll_Ordinal_1
call fcn.0040124f
test eax, eax
jne 0x48971b
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Application
push dword [ebp - 0x21c]
call edi
push str.Progid
push dword [ebp - 0x21c]
call edi
call fcn.004aea30
cmp eax, 5
jle 0x4896ff
push 0x4ff634
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x21c], 0
je 0x48971b
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x21c], 0
mov eax, dword [0x51b438]
mov dword [ebp - 0x234], eax
push str.Audio
lea edi, [ebp - 0x244]
call fcn.00403098
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x230]
push ecx
mov ecx, eax
call fcn.0040328f
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x244]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489766
push eax
call fcn.004013b2
xor eax, eax
push eax
push esi
push eax
push eax
push dword [ebp - 0x238]
xor edi, edi
push SysReAllocStringLen
lea eax, [ebp - 0x220]
call fcn.0047a9cc
test eax, eax
je 0x4897ee
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x48979f
push eax
call fcn.004013b2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4897b6
push eax
call fcn.004013b2
cmp dword [ebp - 0x21c], 0
je 0x4897cb
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4897e2
push eax
call fcn.004013b2
cmp dword [ebp - 0x220], 0
jmp 0x489ad5
mov eax, 0x105
lea ecx, [ebp - 0x234]
call fcn.00403201
push 0x4f8548
lea ecx, [ebp - 0x220]
push ecx
lea esi, [ebp - 0x23c]
mov edi, eax
call fcn.00401282
or eax, 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.0040322d
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push dword [ebp - 0x230]
xor edi, edi
push SysReAllocStringLen
lea eax, [ebp - 0x224]
call fcn.0047a9cc
test eax, eax
je 0x4898af
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489862
push eax
call fcn.004013b2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489879
push eax
call fcn.004013b2
xor esi, esi
cmp dword [ebp - 0x21c], esi
je 0x48988f
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489abb
push eax
call fcn.004013b2
jmp 0x489abb
push 1
push dword [ebp - 0x240]
mov edi, 0x4f8548
push edi
lea eax, [ebp - 0x224]
push eax
call fcn.0047aa66
push 0x4ff618
lea ecx, [ebp - 0x224]
call fcn.0047aa91
push dword [ebp - 0x230]
mov esi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push dword [ebp - 0x234]
call esi
test eax, eax
pop ecx
pop ecx
je 0x48990c
push 1
push dword [ebp - 0x234]
lea eax, [ebp - 0x220]
push str.Backup
push eax
call fcn.0047aa66
push 1
push dword [ebp - 0x230]
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.0047aa66
cmp dword [ebp - 0x220], 0
je 0x48993d
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x220], 0
mov edi, dword [ebp - 0x234]
cmp dword [edi - 8], 0
je 0x4899a1
push edi
push dword [ebp - 0x230]
call esi
test eax, eax
pop ecx
pop ecx
je 0x4899a1
push 0x2001f
push edi
push SysReAllocStringLen
lea eax, [ebp - 0x220]
call fcn.0040124f
test eax, eax
jne 0x4899a1
push dword [ebp - 0x224]
push dword [ebp - 0x220]
call fcn.0047acaa
cmp dword [ebp - 0x220], 0
pop ecx
pop ecx
je 0x4899a1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x220], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x51b438]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x4899de
cmp word [eax], 0
je 0x4899de
push eax
lea eax, [ebp - 0x234]
call fcn.0040315f
jmp 0x4899f9
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push str.__s__1
push eax
call fcn.00405b51
add esp, 0xc
mov esi, dword [ebp - 0x234]
push 0
push esi
push 0x4ff5f0
lea eax, [ebp - 0x224]
call fcn.0047aa15
lea eax, [esi - 0xc]
cmp eax, dword [0x51b43c]
je 0x489a23
push eax
call fcn.004013b2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489a3a
push eax
call fcn.004013b2
lea eax, [edi - 0xc]
cmp eax, dword [0x51b43c]
je 0x489a4b
push eax
call fcn.004013b2
cmp dword [ebp - 0x21c], 0
je 0x489a60
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489a77
push eax
call fcn.004013b2
xor esi, esi
push esi
push 0x2001f
push esi
push esi
push str.shell
push dword [ebp - 0x224]
xor edi, edi
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
call fcn.0047a9cc
test eax, eax
je 0x489b3b
cmp dword [ebp - 0x21c], esi
je 0x489abb
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], esi
je 0x489acf
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], esi
je 0x489ae3
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489afa
push eax
call fcn.004013b2
xor eax, eax
jmp 0x489df8
xor esi, esi
push esi
push 0x2001f
push esi
push esi
push dword [ebp - 0x22c]
xor edi, edi
push SysReAllocStringLen
lea eax, [ebp - 0x224]
call fcn.0047a9cc
test eax, eax
je 0x489a77
cmp dword [ebp - 0x224], esi
je 0x489ae3
push dword [ebp - 0x224]
jmp 0x489add
cmp dword [ebp - 0x228], esi
je 0x489b98
push 0x81a8
lea eax, [ebp - 0x228]
call fcn.00401692
pop ecx
push esi
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x4ff5d0
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489b7e
push eax
call fcn.004013b2
push esi
lea ecx, [ebp - 0x228]
call fcn.00488de7
pop ecx
push esi
push dword [eax]
push str.Playbackcommand
jmp 0x489d0b
cmp ebx, esi
je 0x489ccc
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push str.opencommand
push dword [ebp - 0x21c]
mov dword [ebp - 0x22c], eax
xor edi, edi
lea eax, [ebp - 0x22c]
call fcn.0047a9cc
test eax, eax
jne 0x489c43
mov eax, dword [0x51b438]
mov dword [ebp - 0x230], eax
mov eax, 0x10f
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x23c], 0x10e
call fcn.00403201
push 0x4f8548
lea ecx, [ebp - 0x22c]
push ecx
lea esi, [ebp - 0x23c]
mov edi, eax
call fcn.00401282
or eax, 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040322d
mov esi, dword [ebp - 0x230]
push 1
push esi
push str.Backup
lea eax, [ebp - 0x22c]
push eax
call fcn.0047aa66
lea eax, [esi - 0xc]
cmp eax, dword [0x51b43c]
je 0x489c43
push eax
call fcn.004013b2
push 0x81a9
lea eax, [ebp - 0x228]
call fcn.00401692
pop ecx
xor esi, esi
push esi
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x4fdd60
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489c80
push eax
call fcn.004013b2
push 1
lea ecx, [ebp - 0x228]
call fcn.00488de7
pop ecx
push esi
push dword [eax]
lea eax, [ebp - 0x21c]
push str.PlayListcommand
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489cb8
push eax
call fcn.004013b2
cmp dword [ebp - 0x22c], esi
je 0x489ccc
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov esi, 0x4fb5a0
push esi
mov edi, 0x4f8548
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.0047aa66
xor ebx, ebx
push ebx
push edi
push esi
lea eax, [ebp - 0x21c]
call fcn.0047aa15
push ebx
lea ecx, [ebp - 0x228]
call fcn.00488de7
pop ecx
push ebx
push dword [eax]
push str.opencommand
lea eax, [ebp - 0x21c]
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489d2d
push eax
call fcn.004013b2
push 0x81a9
lea eax, [ebp - 0x228]
call fcn.00401692
pop ecx
xor esi, esi
push esi
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x4fdd60
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489d6a
push eax
call fcn.004013b2
push 1
lea ecx, [ebp - 0x228]
call fcn.00488de7
pop ecx
push esi
push dword [eax]
lea eax, [ebp - 0x21c]
push str.PlayListcommand
call fcn.0047aa15
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489da2
push eax
call fcn.004013b2
cmp dword [ebp - 0x21c], esi
je 0x489db6
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], esi
je 0x489dca
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], esi
je 0x489dde
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x489df5
push eax
call fcn.004013b2
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ebd70
leave
ret