Function at 0x4865d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov esi, ecx
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolExt
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.SoftwareBillP_StudiosWinPatrolClass
lea ecx, [ebp - 0x314]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
push 0x104
push esi
push str.SoftwareBillP_StudiosWinPatrolExtType
lea ecx, [ebp - 0x41c]
mov edx, 0x80000001
call fcn.0048e050
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
cmp eax, 4
ja case.default.0x486654
jmp dword [eax*4 + 0x486cf4]
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolExt
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je case.default.0x486654
push str.SoftwareClasses_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x4866b1
inc eax
dec edx
jne 0x4866a6
jmp 0x4866d5
test edx, edx
je 0x4866d5
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x10c]
push 0x4b17de
push ecx
lea ecx, [ebp - 0x20c]
mov edx, 0x80000002
call fcn.0048e390
push 0x104
push esi
push str.SoftwareBillP_StudiosWinPatrolClass
lea ecx, [ebp - 0x314]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0x14
test eax, eax
je case.default.0x486654
push str.SoftwareClasses_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
lea esp, [esp]
cmp byte [eax], 0
je 0x48674b
inc eax
dec edx
jne 0x486740
jmp 0x486775
test edx, edx
je 0x486775
mov ecx, 0xff
sub ecx, edx
lea edx, [ebp - 0x20c]
mov eax, 0xff
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x4867a0
inc eax
dec edx
jne 0x486780
push 0x4b17de
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x314]
jmp 0x486cd3
test edx, edx
je 0x4867c8
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str._shellopencommand
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
push 0x4b17de
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x314]
jmp 0x486cd3
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolExtApp
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je case.default.0x486654
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x48683b
inc eax
dec edx
jne 0x486830
jmp 0x48685f
test edx, edx
je 0x48685f
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x10c]
push str.Application
push ecx
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e390
push 0x104
push esi
push str.SoftwareBillP_StudiosWinPatrolClass
lea ecx, [ebp - 0x314]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0x14
test eax, eax
je 0x486958
push str.Applications_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x4868d1
inc eax
dec edx
jne 0x4868c6
jmp 0x4868fb
test edx, edx
je 0x4868fb
mov ecx, 0xff
sub ecx, edx
lea edx, [ebp - 0x20c]
mov eax, 0xff
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x486911
inc eax
dec edx
jne 0x486906
jmp 0x486939
test edx, edx
je 0x486939
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str._shellopencommand
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x10c]
push 0x4b17de
push eax
lea ecx, [ebp - 0x314]
mov edx, 0x80000000
call fcn.0048e390
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolExtApp
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je case.default.0x486654
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x4869c3
inc eax
dec edx
jne 0x4869b8
jmp 0x4869e7
test edx, edx
je 0x4869e7
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x10c]
push str.ProgID
push ecx
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e390
push 0x104
push esi
push str.SoftwareBillP_StudiosWinPatrolClass
lea ecx, [ebp - 0x314]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0x14
test eax, eax
je 0x486958
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x486a3f
inc eax
dec edx
jne 0x486a34
jmp 0x486a69
test edx, edx
je 0x486a69
mov ecx, 0xff
sub ecx, edx
lea edx, [ebp - 0x20c]
mov eax, 0xff
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x486911
inc eax
dec edx
jne 0x486a74
jmp 0x486939
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolUserChoiceProgID
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
lea esp, [esp]
cmp byte [eax], 0
je 0x486adb
inc eax
dec edx
jne 0x486ad0
jmp 0x486aff
test edx, edx
je 0x486aff
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x486b1b
inc eax
dec edx
jne 0x486b10
jmp 0x486b43
test edx, edx
je 0x486b43
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push str.UserChoice
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
push 0x104
lea ecx, [ebp - 0x10c]
push str.Hash
push ecx
lea ecx, [ebp - 0x524]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x486be6
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.Set_Associations
push 0
call edi
mov esi, eax
test esi, esi
je 0x486bb4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x486bb4
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push str._windir__system32control.exe__name_Microsoft.DefaultPrograms__page_pagefileassoc
call fcn.004a1dc3
add esp, 4
push str.Set_Associations
push str.CabinetWClass
call edi
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x20c], 0
je case.default.0x486654
lea edx, [ebp - 0x10c]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 0x10c]
push str.Progid
push eax
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e390
add esp, 8
test eax, eax
je case.default.0x486654
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push 0x100
push esi
push str.SoftwareBillP_StudiosWinPatrolExtRoot
lea ecx, [ebp - 0x20c]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
push str.SoftwareClasses_
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x10c]
call fcn.00401000
mov edx, 0xff
lea eax, [ebp - 0x10c]
cmp byte [eax], 0
je 0x486c9d
inc eax
dec edx
jne 0x486c92
jmp 0x486cc1
test edx, edx
je 0x486cc1
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x10c]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x10c]
push 0x4b17de
push ecx
lea ecx, [ebp - 0x20c]
mov edx, 0x80000002
call fcn.0048e390
add esp, 8
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret