Function at 0x48dd80
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0690
mov eax, dword fs:[0]
push eax
mov eax, 0x104c
call fcn.00558750
mov eax, dword [0x63434c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x1020], str..MP4
xor ebx, ebx
mov dword [ebp - 0x101c], str..AVI
mov dword [ebp - 0x1018], str..MOV
mov dword [ebp - 0x1014], str..MPEG
mov dword [ebp - 0x1010], str..WMV
mov dword [ebp - 0x100c], str..3GP
mov dword [ebp - 0x1008], str..ASF
mov dword [ebp - 0x1004], str..MPG
mov dword [ebp - 0x1000], 0x5c1d98
mov dword [ebp - 0xffc], str..MTS
mov dword [ebp - 0xff8], str..MKV
mov dword [ebp - 0xff4], str..WEBM
mov dword [ebp - 0xff0], str..FLV
mov dword [ebp - 0xfec], str..M4V
mov dword [ebp - 0xfe8], str..VOB
mov dword [ebp - 0xfe4], str..MXF
mov dword [ebp - 0xfe0], str..SWF
mov dword [ebp - 0xfdc], str..RMVB
mov dword [ebp - 0xfd8], str..F4V
mov dword [ebp - 0xfd4], str..MP3
mov dword [ebp - 0xfd0], str..AAC
mov dword [ebp - 0xfcc], str..FLAC
mov dword [ebp - 0xfc8], str..WAV
mov dword [ebp - 0xfc4], str..M4A
mov dword [ebp - 0xfc0], str..WMA
mov dword [ebp - 0xfbc], str..OGG
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], esi
mov dword [ebp - 0x1034], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x1044], ebx
push eax
push 0x2001f
push ebx
push 0x5b3734
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x48df43
mov eax, dword [ebp - 0x1044]
lea ecx, [ebp - 0x103c]
push str.WPSVideoPlayer
mov dword [ebp - 0x103c], eax
mov dword [ebp - 0x1038], ebx
call fcn.0043a160
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48df33
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor ecx, ecx
mov dword [ebp - 0x1040], ecx
jmp 0x48df50
push dword [ebp + ecx*4 - 0x1020]
lea eax, [ebp - 0x218]
push str.WPSVideoPlayer_s
push 0x1800
push 0
push 0
push 0x104
push eax
call fcn.0049cb20
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareClassesWPSVideoPlayer_s
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049cb20
add esp, 0x38
mov byte [ebp - 4], 2
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48e00e
cmp dword [ebx], 0
je 0x48e001
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e098
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e007
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48e02e
cmp dword [ebx + 4], 0
jne 0x48e00e
mov eax, 1
jmp 0x48e02e
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e098
test esi, esi
je 0x48e039
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48e098
push str.DefaultIcon
lea ecx, [ebp - 0x103c]
call fcn.0043a160
push str.shell
lea ecx, [ebp - 0x103c]
call fcn.0043a160
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48e088
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48e10a
cmp dword [ebx], edi
je 0x48e0fe
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Advapi32.dll
call edi
test eax, eax
je 0x48e1d7
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e0f1
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000001
call eax
jmp 0x48e128
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48e12e
cmp dword [ebx + 4], edi
jne 0x48e10a
mov eax, 1
jmp 0x48e12e
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48e1d1
test esi, esi
je 0x48e147
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48e1d1
mov byte [ebp - 4], 4
test ebx, ebx
je 0x48e23e
cmp dword [ebx], eax
je 0x48e1a0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e1b4
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e1b4
push 0
push dword [ebx]
lea ecx, [ebp - 0x218]
push 0
push 0
push ecx
push edi
call eax
jmp 0x48e1b4
cmp dword [ebx + 4], 0
je 0x48e1b4
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test edi, edi
je 0x48e1c7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 5
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48e2ab
cmp dword [ebx], 0
je 0x48e29e
push str.Advapi32.dll
call edi
test eax, eax
je 0x48e33b
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e2a4
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000002
call eax
jmp 0x48e2cb
cmp byte [0x63ca24], 0
jne 0x48e27e
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e270
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x63ca20], eax
mov byte [0x63ca24], 1
jmp 0x48e283
mov eax, dword [0x63ca20]
mov byte [0x63ca24], 1
jmp 0x48e283
mov eax, dword [0x63ca20]
test eax, eax
je 0x48e1a6
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push edi
call eax
jmp 0x48e1b4
cmp dword [ebx + 4], 0
jne 0x48e2ab
mov eax, 1
jmp 0x48e2cb
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e33b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x48e2dc
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48e33b
push str.DefaultIcon
lea ecx, [ebp - 0x103c]
call fcn.0043a160
push str.shell
lea ecx, [ebp - 0x103c]
call fcn.0043a160
mov esi, dword [ebp - 0x103c]
test esi, esi
je 0x48e32b
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov ebx, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 6
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48e3a9
cmp dword [ebx], edi
je 0x48e39d
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e470
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e390
push edi
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push edi
push str.SoftwareClasses
push 0x80000002
call eax
jmp 0x48e3c7
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48e3cd
cmp dword [ebx + 4], edi
jne 0x48e3a9
mov eax, 1
jmp 0x48e3cd
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
push str.SoftwareClasses
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48e470
test esi, esi
je 0x48e3e6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48e470
mov byte [ebp - 4], 7
test ebx, ebx
je 0x48e4dc
cmp dword [ebx], eax
je 0x48e43f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e453
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e453
push 0
push dword [ebx]
lea ecx, [ebp - 0x218]
push 0
push 0
push ecx
push edi
call eax
jmp 0x48e453
cmp dword [ebx + 4], 0
je 0x48e453
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test edi, edi
je 0x48e466
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
xor edi, edi
mov byte [ebp - 4], 8
mov dword [ebp - 0x1030], edi
test ebx, ebx
je 0x48e555
cmp dword [ebx], edi
je 0x48e549
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e65d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e53c
push edi
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
mov ecx, dword [ebp - 0x1040]
push 0x2001f
push edi
push dword [ebp + ecx*4 - 0x1020]
push 0x80000000
call eax
jmp 0x48e57b
cmp byte [0x63ca24], 0
jne 0x48e51c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e50e
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x63ca20], eax
mov byte [0x63ca24], 1
jmp 0x48e521
mov eax, dword [0x63ca20]
mov byte [0x63ca24], 1
jmp 0x48e521
mov eax, dword [0x63ca20]
test eax, eax
je 0x48e445
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push edi
call eax
jmp 0x48e453
mov edi, dword [ebp - 0x1030]
mov eax, 1
jmp 0x48e581
cmp dword [ebx + 4], edi
jne 0x48e555
mov eax, 1
jmp 0x48e581
lea eax, [ebp - 0x1030]
push eax
mov eax, dword [ebp - 0x1040]
push 0x2001f
push 0
push dword [ebp + eax*4 - 0x1020]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x1030]
test eax, eax
jne 0x48e65d
test esi, esi
je 0x48e59a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], 0
mov esi, edi
mov dword [ebp - 0x103c], esi
test eax, eax
jne 0x48e65d
push 0x208
push eax
lea eax, [ebp - 0x9b0]
push eax
call fcn.0055c530
add esp, 0xc
mov dword [ebp - 0x1030], 0x206
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0x5b3734
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e61c
mov eax, dword [ebp - 0x1048]
cmp eax, 1
je 0x48e60a
cmp eax, 2
jne 0x48e61c
cmp dword [ebp - 0x1030], 0
jne 0x48e61c
xor eax, eax
mov word [ebp - 0x9b0], ax
lea eax, [ebp - 0x9b0]
push str.WPSVideoPlayer
push eax
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x48e640
push 0x5b3734
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x48e653
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x1040]
mov edi, dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x7a8]
push edi
push str._sOpenWithProgids
push 0x1800
push 0
push 0
push 0xc8
push eax
call fcn.0049cb20
add esp, 0x1c
mov byte [ebp - 4], 9
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48e6fc
cmp dword [ebx], 0
je 0x48e6ef
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x48e6bd
mov eax, 1
jmp 0x48e741
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e6f5
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x7a8]
push ecx
push 0x80000000
call eax
jmp 0x48e71c
cmp dword [ebx + 4], 0
jne 0x48e6fc
mov eax, 1
jmp 0x48e71c
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x7a8]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e741
test esi, esi
je 0x48e72b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x48e772
push str.WPSVideoPlayer
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48e768
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
push edi
push str..SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_s
push 0x1800
push 0
push 0
lea eax, [ebp - 0xfb8]
push 0x200
push eax
call fcn.0049cb20
push 0
lea eax, [ebp - 0xfb8]
push 0x2001b
push eax
call fcn.00556b90
push 0
push 0x60000
push str.UserChoice
push eax
mov dword [ebp - 0x1054], eax
call fcn.00556d10
add esp, 0x38
mov dword [ebp - 0x1030], eax
lea ecx, [ebp - 0x104c]
push ecx
push 0
lea ecx, [ebp - 0x1044]
push ecx
push 0
push 0
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x48e8c1
mov eax, dword [ebp - 0x1044]
mov edi, dword [ebp - 0x104c]
test eax, eax
je 0x48e8b2
push 2
push 0xc
lea ecx, [ebp - 0x102c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x48e8b2
mov eax, dword [ebp - 0x102c]
sub eax, 1
mov dword [ebp - 0x102c], eax
js 0x48e880
lea esp, [esp]
lea ecx, [ebp - 0x1050]
push ecx
push eax
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x48e86f
mov eax, dword [ebp - 0x1050]
cmp byte [eax], 1
jne 0x48e86f
test byte [eax + 4], 2
je 0x48e86f
push dword [ebp - 0x102c]
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x48e8a6
mov eax, dword [ebp - 0x102c]
sub eax, 1
mov dword [ebp - 0x102c], eax
jns 0x48e830
push 0
push dword [ebp - 0x1044]
push 0
push 0
push 4
push 4
push dword [ebp - 0x1030]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x48e8ac
mov byte [ebp - 4], 0xb
jmp 0x48e8b6
mov byte [ebp - 4], 0xa
jmp 0x48e8b6
mov byte [ebp - 4], 0xc
jmp 0x48e8b6
mov byte [ebp - 4], 0xd
test edi, edi
je 0x48e8c1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x1030]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x1054]
call edi
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithProgids
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049cb20
add esp, 0x1c
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48e96f
cmp dword [ebx], 0
je 0x48e962
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48e9db
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e968
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48e98f
cmp dword [ebx + 4], 0
jne 0x48e96f
mov eax, 1
jmp 0x48e98f
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e9db
test esi, esi
je 0x48e99a
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
test eax, eax
jne 0x48e9db
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48e9d1
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x1040]
push dword [ebp + eax*4 - 0x1020]
lea eax, [ebp - 0x618]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push 0x1800
push 0
push 0
push 0x200
push eax
call fcn.0049cb20
add esp, 0x1c
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1030], 0
test ebx, ebx
je 0x48ea79
cmp dword [ebx], 0
je 0x48ea6c
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x48ea3a
mov eax, 1
jmp 0x48eaba
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ea72
push 0
push dword [ebx]
lea ecx, [ebp - 0x1030]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0x80000001
call eax
jmp 0x48ea99
cmp dword [ebx + 4], 0
jne 0x48ea79
mov eax, 1
jmp 0x48ea99
lea eax, [ebp - 0x1030]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x618]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48eaba
test esi, esi
je 0x48eaa4
push esi
call edi
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x48eb6d
push 0x208
push eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.0055c530
add esp, 0xc
mov dword [ebp - 0x1030], 0x206
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48eb2e
mov eax, dword [ebp - 0x1058]
cmp eax, 1
je 0x48eb1c
cmp eax, 2
jne 0x48eb2e
cmp dword [ebp - 0x1030], 0
jne 0x48eb2e
xor eax, eax
mov word [ebp - 0xbb8], ax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.00566ed2
add esp, 8
test eax, eax
jne 0x48eb54
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x48eb63
push esi
call edi
xor esi, esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1038], 0
mov ecx, dword [ebp - 0x1040]
inc ecx
mov dword [ebp - 0x1040], ecx
cmp ecx, 0x1a
jb 0x48df50
test esi, esi
je 0x48eb8a
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00557e89
mov esp, ebp
pop ebp
ret