Function at 0x4c7493
Capabilities:
Delete registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
push ebx
push esi
push edi
mov dword [ebp - 0x850], 0
jmp 0x4c74b3
push 0x105
lea eax, [ebp - 0x848]
push eax
mov eax, dword [0x533640]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x848]
push eax
call fcn.0052344e
add esp, 0x14
push 0x532b60
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7599
push 0x532b70
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532b78
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c75e8
push 0x532ba0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7649
push 0x532bb0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.654C2A40_71B6_11CE_A850_444553540000
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c76aa
push 0x532be0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532be8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c76f9
push 0x532c10
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c775a
push 0x532c1c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532c20
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c7771
call fcn.004c584f
jmp 0x4c7bde
push 0x532c24
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532c34
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7bde
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c7bde
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0052344e
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4c7bde
push 0x532c54
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532c64
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c78e2
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532c84
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532c94
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c79a1
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532ca8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532cac
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._shellprintcommand
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7a60
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532cd4
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532cdc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532ce4
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.LocalServer
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7b1f
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532d1c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532d24
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.DefaultIcon
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7bde
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x850], 0
push 0x532d5c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.protocolStdFileEditing_server
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7f07
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c7d35
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0052344e
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4c7d35
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7d2b
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x850], 1
cmp dword [ebp - 0x850], 0
je 0x4c7e13
push 0x532d8c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._shellopencommand
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7e13
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532db0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__p__1
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532dbc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.NotInsertable
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c7f07
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c7f07
mov byte [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c7ef4
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push str.Clsid_
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.00041943_0000_0000_C000_000000000046
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8018
push str.AutoConvertTo
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8018
push 0x532e1c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c8005
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532e44
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c8262
lea eax, [ebp - 0x420]
push eax
push 0x825
call fcn.004e3fc4
add esp, 8
lea eax, [ebp - 0x84c]
push eax
push 0x532e50
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8105
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c80f2
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532e5c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532e68
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c81b1
push 0x532e70
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x532e80
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c819e
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532e90
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532e9c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c825d
push 0x532ea4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x532ecc
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c824a
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
jmp 0x4c840d
push 0x532ef4
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532f00
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x52c], 0x105
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c840d
push 0x532f08
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c82f7
push 0x532f18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4c840d
push 0x532f28
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.CurVer
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8382
push 0x532f3c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x532f4c
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push str.OrgChart
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Clsid
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c840d
push 0x532f70
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.E4C18D40_1CD5_101C_B325_00AA001F3168
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
push 0x532fc0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532fc4
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8516
push 0x532fc8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c8498
push str.MSOrgChart.1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4c8511
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c8511
push 0x532fe8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x532ff8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x533008
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
jmp 0x4c859c
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x4c859c
push 0x533018
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x533028
push 1
push 0
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x4c8589
push str.OrgPlusWOPX.4
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], eax
pop edi
pop esi
pop ebx
leave
ret