Function at 0x546479
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
push esi
push edi
call fcn.00545427
neg al
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push str.SoftwareNCH_SoftwarePicoPDFCapabilitiesFileTypes
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebx, ebx
test eax, eax
mov esi, 0x104
jne 0x546578
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x634]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x18]
mov word [ebp - 0x634], bx
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0xc]
cmp eax, ebx
jne 0x54656f
cmp word [ebp - 0x224], bx
je 0x5464bc
cmp dword [ebp - 0x10], ebx
jbe 0x5464bc
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_sOpenWithProgIds
mov eax, esi
lea edi, [ebp - 0x42c]
call fcn.005383cd
pop ecx
pop ecx
lea eax, [ebp - 0x224]
push eax
lea edi, [ebp - 0x83c]
call fcn.00545e8a
mov eax, edi
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 4]
call fcn.004cb815
cmp word [ebp - 0x42c], bx
je 0x54655e
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
lea eax, [ebp - 0x224]
push eax
call fcn.00546cf1
jmp 0x5464bc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push str.SoftwareClasses
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x5466af
push esi
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 0x10], ebx
push ebx
jmp 0x546695
cmp word [ebp - 0x224], 0x2e
jne 0x546687
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_sOpenWithProgIds
mov eax, esi
lea edi, [ebp - 0x634]
call fcn.005383cd
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
push eax
push dword [ebp - 4]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x546687
lea eax, [ebp - 0x224]
push eax
push str.NCH.PicoPDF_s
mov eax, esi
lea edi, [ebp - 0x42c]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 0x14]
mov byte [ebp - 5], 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x546642
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x54663c
inc edi
cmp edi, ebx
seta byte [ebp - 5]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 5], bl
jne 0x546687
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x224]
push eax
push str.SoftwareClasses_s
mov eax, esi
lea edi, [ebp - 0x83c]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
inc dword [ebp - 0x10]
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x5465a6
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x631ae0
push str.SoftwareRegisteredApplications
push dword [ebp - 4]
call fcn.004cb815
push dword [ebp - 4]
mov eax, str.SoftwareClassesApplicationspicopdf.exe
call fcn.0053888e
lea eax, [ebp - 0x18]
push eax
push str.SoftwareNCH_SoftwarePicoPDFCapabilitiesFileAssociations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x546763
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x18]
mov word [ebp - 0x42c], bx
mov dword [ebp - 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x10]
cmp eax, ebx
jne 0x54675a
cmp word [ebp - 0x42c], bx
je 0x5466e7
cmp dword [ebp - 0xc], ebx
jbe 0x5466e7
lea eax, [ebp - 0x42c]
push eax
push str.SoftwareClasses_s
mov eax, esi
lea edi, [ebp - 0x83c]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x5466e7
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret