Function at 0x48e760
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a4c50
mov eax, dword fs:[0]
push eax
mov eax, 0x104c
call fcn.0055cc70
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x1020], str..MP4
xor ebx, ebx
mov dword [ebp - 0x101c], str..AVI
mov dword [ebp - 0x1018], str..MOV
mov dword [ebp - 0x1014], str..MPEG
mov dword [ebp - 0x1010], str..WMV
mov dword [ebp - 0x100c], str..3GP
mov dword [ebp - 0x1008], str..ASF
mov dword [ebp - 0x1004], str..MPG
mov dword [ebp - 0x1000], 0x5c6d88
mov dword [ebp - 0xffc], str..MTS
mov dword [ebp - 0xff8], str..MKV
mov dword [ebp - 0xff4], str..WEBM
mov dword [ebp - 0xff0], str..FLV
mov dword [ebp - 0xfec], str..M4V
mov dword [ebp - 0xfe8], str..VOB
mov dword [ebp - 0xfe4], str..MXF
mov dword [ebp - 0xfe0], str..SWF
mov dword [ebp - 0xfdc], str..RMVB
mov dword [ebp - 0xfd8], str..F4V
mov dword [ebp - 0xfd4], str..MP3
mov dword [ebp - 0xfd0], str..AAC
mov dword [ebp - 0xfcc], str..FLAC
mov dword [ebp - 0xfc8], str..WAV
mov dword [ebp - 0xfc4], str..M4A
mov dword [ebp - 0xfc0], str..WMA
mov dword [ebp - 0xfbc], str..OGG
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], esi
mov dword [ebp - 0x1034], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x1044], ebx
push eax
push 0x2001f
push ebx
push 0x5b8734
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x48e923
mov eax, dword [ebp - 0x1044]
lea ecx, [ebp - 0x103c]
push str.WPSVideoPlayer
mov dword [ebp - 0x103c], eax
mov dword [ebp - 0x1038], ebx
call fcn.0043a090
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48e913
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor ecx, ecx
mov dword [ebp - 0x1040], ecx
jmp 0x48e930
push dword [ebp + ecx*4 - 0x1020]
lea eax, [ebp - 0x218]
push str.WPSVideoPlayer_s
push 0x1800
push 0
push 0
push 0x104
push eax
call fcn.0049d480
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareClassesWPSVideoPlayer_s
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049d480
add esp, 0x38
mov byte [ebp - 4], 2
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48e9ee
cmp dword [ebx], 0
je 0x48e9e1
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ea78
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e9e7
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48ea0e
cmp dword [ebx + 4], 0
jne 0x48e9ee
mov eax, 1
jmp 0x48ea0e
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ea78
test esi, esi
je 0x48ea19
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48ea78
push str.DefaultIcon
lea ecx, [ebp - 0x103c]
call fcn.0043a090
push str.shell
lea ecx, [ebp - 0x103c]
call fcn.0043a090
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48ea68
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48eaea
cmp dword [ebx], edi
je 0x48eade
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call edi
test eax, eax
je 0x48ebb7
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ead1
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000001
call eax
jmp 0x48eb08
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48eb0e
cmp dword [ebx + 4], edi
jne 0x48eaea
mov eax, 1
jmp 0x48eb0e
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48ebb1
test esi, esi
je 0x48eb27
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48ebb1
mov byte [ebp - 4], 4
test ebx, ebx
je 0x48ec1e
cmp dword [ebx], eax
je 0x48eb80
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48eb94
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48eb94
push 0
push dword [ebx]
lea ecx, [ebp - 0x218]
push 0
push 0
push ecx
push edi
call eax
jmp 0x48eb94
cmp dword [ebx + 4], 0
je 0x48eb94
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test edi, edi
je 0x48eba7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 5
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48ec8b
cmp dword [ebx], 0
je 0x48ec7e
push str.Advapi32.dll
call edi
test eax, eax
je 0x48ed1b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ec84
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000002
call eax
jmp 0x48ecab
cmp byte [0x641b44], 0
jne 0x48ec5e
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ec50
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x641b40], eax
mov byte [0x641b44], 1
jmp 0x48ec63
mov eax, dword [0x641b40]
mov byte [0x641b44], 1
jmp 0x48ec63
mov eax, dword [0x641b40]
test eax, eax
je 0x48eb86
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push edi
call eax
jmp 0x48eb94
cmp dword [ebx + 4], 0
jne 0x48ec8b
mov eax, 1
jmp 0x48ecab
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ed1b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x48ecbc
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48ed1b
push str.DefaultIcon
lea ecx, [ebp - 0x103c]
call fcn.0043a090
push str.shell
lea ecx, [ebp - 0x103c]
call fcn.0043a090
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48ed0b
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 6
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48ed89
cmp dword [ebx], edi
je 0x48ed7d
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ee50
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ed70
push edi
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push edi
push str.SoftwareClasses
push 0x80000002
call eax
jmp 0x48eda7
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48edad
cmp dword [ebx + 4], edi
jne 0x48ed89
mov eax, 1
jmp 0x48edad
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48ee50
test esi, esi
je 0x48edc6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48ee50
mov byte [ebp - 4], 7
test ebx, ebx
je 0x48eebc
cmp dword [ebx], eax
je 0x48ee1f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ee33
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ee33
push 0
push dword [ebx]
lea ecx, [ebp - 0x218]
push 0
push 0
push ecx
push edi
call eax
jmp 0x48ee33
cmp dword [ebx + 4], 0
je 0x48ee33
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test edi, edi
je 0x48ee46
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 8
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48ef35
cmp dword [ebx], edi
je 0x48ef29
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48f03d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ef1c
push edi
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
mov ecx, dword [ebp - 0x1040]
push 0x2001f
push edi
push dword [ebp + ecx*4 - 0x1020]
push 0x80000000
call eax
jmp 0x48ef5b
cmp byte [0x641b44], 0
jne 0x48eefc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48eeee
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x641b40], eax
mov byte [0x641b44], 1
jmp 0x48ef01
mov eax, dword [0x641b40]
mov byte [0x641b44], 1
jmp 0x48ef01
mov eax, dword [0x641b40]
test eax, eax
je 0x48ee25
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push edi
call eax
jmp 0x48ee33
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48ef61
cmp dword [ebx + 4], edi
jne 0x48ef35
mov eax, 1
jmp 0x48ef61
lea eax, [ebp - 0x1030]
push eax
mov eax, dword [ebp - 0x1040]
push 0x2001f
push 0
push dword [ebp + eax*4 - 0x1020]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48f03d
test esi, esi
je 0x48ef7a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48f03d
push 0x208
push eax
lea eax, [ebp - 0x9b0]
push eax
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x1030], 0x206
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0x5b8734
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48effc
mov eax, dword [ebp - 0x1048]
cmp eax, 1
je 0x48efea
cmp eax, 2
jne 0x48effc
cmp dword [ebp - 0x1030], 0
jne 0x48effc
xor eax, eax
mov word [ebp - 0x9b0], ax
lea eax, [ebp - 0x9b0]
push str.WPSVideoPlayer
push eax
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x48f020
push 0x5b8734
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x48f033
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x1040]
mov edi, dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x7a8]
push edi
push str._sOpenWithProgids
push 0x1800
push 0
push 0
push 0xc8
push eax
call fcn.0049d480
add esp, 0x1c
mov byte [ebp - 4], 9
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48f0dc
cmp dword [ebx], 0
je 0x48f0cf
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x48f09d
mov eax, 1
jmp 0x48f121
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f0d5
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x7a8]
push ecx
push 0x80000000
call eax
jmp 0x48f0fc
cmp dword [ebx + 4], 0
jne 0x48f0dc
mov eax, 1
jmp 0x48f0fc
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x7a8]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48f121
test esi, esi
je 0x48f10b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x48f152
push str.WPSVideoPlayer
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48f148
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
push edi
push str..SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_s
push 0x1800
push 0
push 0
lea eax, [ebp - 0xfb8]
push 0x200
push eax
call fcn.0049d480
push 0
lea eax, [ebp - 0xfb8]
push 0x2001b
push eax
call fcn.0055b0b0
push 0
push 0x60000
push str.UserChoice
push eax
mov dword [ebp - 0x1054], eax
call fcn.0055b230
add esp, 0x38
mov dword [ebp - 0x1030], eax
lea ecx, [ebp - 0x104c]
push ecx
push 0
lea ecx, [ebp - 0x1044]
push ecx
push 0
push 0
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x48f2a1
mov eax, dword [ebp - 0x1044]
mov edi, dword [ebp - 0x104c]
test eax, eax
je 0x48f292
push 2
push 0xc
lea ecx, [ebp - 0x102c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x48f292
mov eax, dword [ebp - 0x102c]
sub eax, 1
mov dword [ebp - 0x102c], eax
js 0x48f260
lea esp, [esp]
lea ecx, [ebp - 0x1050]
push ecx
push eax
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x48f24f
mov eax, dword [ebp - 0x1050]
cmp byte [eax], 1
jne 0x48f24f
test byte [eax + 4], 2
je 0x48f24f
push dword [ebp - 0x102c]
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x48f286
mov eax, dword [ebp - 0x102c]
sub eax, 1
mov dword [ebp - 0x102c], eax
jns 0x48f210
push 0
push dword [ebp - 0x1044]
push 0
push 0
push 4
push 4
push dword [ebp - 0x1030]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x48f28c
mov byte [ebp - 4], 0xb
jmp 0x48f296
mov byte [ebp - 4], 0xa
jmp 0x48f296
mov byte [ebp - 4], 0xc
jmp 0x48f296
mov byte [ebp - 4], 0xd
test edi, edi
je 0x48f2a1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x1030]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x1054]
call edi
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithProgids
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049d480
add esp, 0x1c
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48f34f
cmp dword [ebx], 0
je 0x48f342
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48f3bb
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f348
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48f36f
cmp dword [ebx + 4], 0
jne 0x48f34f
mov eax, 1
jmp 0x48f36f
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48f3bb
test esi, esi
je 0x48f37a
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48f3bb
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48f3b1
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049d480
add esp, 0x1c
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48f459
cmp dword [ebx], 0
je 0x48f44c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x48f41a
mov eax, 1
jmp 0x48f49a
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f452
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48f479
cmp dword [ebx + 4], 0
jne 0x48f459
mov eax, 1
jmp 0x48f479
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48f49a
test esi, esi
je 0x48f484
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x48f54d
push 0x208
push eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x1030], 0x206
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48f50e
mov eax, dword [ebp - 0x1058]
cmp eax, 1
je 0x48f4fc
cmp eax, 2
jne 0x48f50e
cmp dword [ebp - 0x1030], 0
jne 0x48f50e
xor eax, eax
mov word [ebp - 0xbb8], ax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.0056b422
add esp, 8
test eax, eax
jne 0x48f534
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48f543
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov ecx, dword [ebp - 0x1040]
inc ecx
mov dword [ebp - 0x1040], ecx
cmp ecx, 0x1a
jb 0x48e930
test esi, esi
je 0x48f56a
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret