Function at 0x425e0d
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x218], ecx
push esi
mov esi, ebx
push edi
mov edi, dword [ebp + 8]
lea edx, [esi + 2]
jmp 0x425e3d
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x425e3d
sub esi, edx
sar esi, 1
lea eax, [esi + 0x14]
cmp eax, 0x104
jbe 0x425e6f
push 0
push 0x400023db
call fcn.00414802
add esp, 8
mov eax, 1
jmp 0x42609a
mov esi, 0x104
lea ecx, [ebp - 0x20c]
push ebx
mov edx, esi
call fcn.00410820
mov ecx, esi
lea eax, [ebp - 0x20c]
lea ecx, [ecx]
cmp word [eax], 0
je 0x425e9b
add eax, 2
sub ecx, 1
jne 0x425e8d
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
test ecx, ecx
je 0x425eb5
mov edx, esi
sub edx, ecx
jmp 0x425eb7
xor edx, edx
test eax, eax
js 0x425f0a
lea eax, [ebp - 0x20c]
lea eax, [eax + edx*2]
sub esi, edx
je 0x425f02
lea ecx, [edx + 0x7ffffefa]
mov edx, 0x4038b4
add ecx, esi
sub edx, eax
mov dword [ebp - 0x214], edx
test ecx, ecx
je 0x425efe
movzx edx, word [edx + eax]
test dx, dx
je 0x425efe
mov word [eax], dx
dec ecx
mov edx, dword [ebp - 0x214]
add eax, 2
sub esi, 1
jne 0x425edd
jmp 0x425f02
test esi, esi
jne 0x425f05
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x210]
push eax
push 0x2000000
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x425ff7
test edi, edi
je 0x425fe2
cmp word [edi], 0
je 0x425fe2
lea esi, [ebp - 0x20c]
cmp word [esi], 0
je 0x425f62
cmp word [esi], 0x5c
je 0x425f62
add esi, 2
cmp word [esi], 0
jne 0x425f53
movzx eax, word [esi]
mov dword [ebp - 0x214], eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x2000000
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x425fc7
mov eax, dword [ebp - 0x214]
test ax, ax
je 0x425ff7
push dword [ebp - 0x210]
mov word [esi], ax
add esi, 2
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x425f4d
push ebx
push 1
push 0x400023a5
call fcn.00414802
mov eax, dword [ebp - 0x21c]
add esp, 0xc
jmp 0x42609a
push ebx
push 1
push 0x400023a5
call fcn.00414802
add esp, 0xc
jmp 0x426098
test edi, edi
je 0x426068
cmp word [edi], 0
je 0x426068
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42600d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 2
push 0
push 0x40263c
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x42604e
push edi
push ebx
push 0x4037dc
call fcn.0040c37c
jmp 0x426089
push 0
push esi
call fcn.00414802
push ebx
push 1
push 0x235d
call fcn.00414802
add esp, 0x14
jmp 0x42608c
push 0
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x42608c
push ebx
push 1
push 0x400023a5
call fcn.00414802
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret 4