Function at 0x4a6de7
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
push esi
push edi
call fcn.004a5dca
neg al
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push str.SoftwareNCH_SoftwareSwitchCapabilitiesFileTypes
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebx, ebx
test eax, eax
mov esi, 0x104
jne 0x4a6ee4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x634]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x18]
mov word [ebp - 0x634], bx
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0xc]
cmp eax, ebx
jne 0x4a6edb
cmp word [ebp - 0x224], bx
je 0x4a6e2a
cmp dword [ebp - 0x10], ebx
jbe 0x4a6e2a
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_sOpenWithProgIds
lea edi, [ebp - 0x42c]
call fcn.004a9039
pop ecx
pop ecx
lea eax, [ebp - 0x224]
push eax
lea edi, [ebp - 0x83c]
call fcn.004a6803
mov eax, edi
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 4]
call fcn.00446bf9
cmp word [ebp - 0x42c], bx
je 0x4a6eca
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
lea eax, [ebp - 0x224]
push eax
call fcn.004a764b
jmp 0x4a6e2a
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push str.SoftwareClasses
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a7015
push esi
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 0x10], ebx
push ebx
jmp 0x4a6ffb
cmp word [ebp - 0x224], 0x2e
jne 0x4a6fed
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_sOpenWithProgIds
lea edi, [ebp - 0x634]
call fcn.004a9039
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
push eax
push dword [ebp - 4]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a6fed
lea eax, [ebp - 0x224]
push eax
push str.NCH.Switch_s
lea edi, [ebp - 0x42c]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 0x14]
mov byte [ebp - 5], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4a6faa
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a6fa4
inc edi
cmp edi, ebx
seta byte [ebp - 5]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 5], bl
jne 0x4a6fed
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_s
lea edi, [ebp - 0x83c]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
inc dword [ebp - 0x10]
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4a6f12
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5b0844
push str.SoftwareRegisteredApplications
push dword [ebp - 4]
call fcn.00446bf9
push dword [ebp - 4]
mov eax, str.SoftwareClassesApplications_switch.exe
call fcn.004a9431
lea eax, [ebp - 0x18]
push eax
push str.SoftwareNCH_SoftwareSwitchCapabilitiesFileAssociations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a70c7
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x18]
mov word [ebp - 0x42c], bx
mov dword [ebp - 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x10]
cmp eax, ebx
jne 0x4a70be
cmp word [ebp - 0x42c], bx
je 0x4a704d
cmp dword [ebp - 0xc], ebx
jbe 0x4a704d
lea eax, [ebp - 0x42c]
push eax
push str.SoftwareClasses_s
lea edi, [ebp - 0x83c]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x4a704d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret