Function at 0x44247c
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x2c]
push edi
call fcn.0043919c
push str.____1_
mov esi, 0xe77508
lea ecx, [ebp - 0x34]
mov edx, esi
mov ebx, dword [eax]
push ebx
mov dword [ebp - 0x18], ebx
call fcn.005b46e5
push str.___print_to_default___1_
push ebx
mov edx, esi
lea ecx, [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
call fcn.005b46e5
push str.___print_to___2____1_
push ebx
mov edx, esi
lea ecx, [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
call fcn.005b46e5
add esp, 0x18
mov bl, 1
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, 0xe7a988
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.005b47cf
pop ecx
push 0
mov edx, 0xe736e0
lea ecx, [ebp - 0x54]
mov edi, dword [eax]
push edi
call fcn.005b46e5
push 0
mov edx, str.SoftwareClasses_
lea ecx, [ebp - 0x5c]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x10], eax
call fcn.005b46e5
push 0xffffffffffffffff
lea edx, [edi + 2]
lea ecx, [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 4], eax
call fcn.005b4673
add esp, 0x14
mov esi, dword [eax]
mov ecx, esi
mov dword [ebp - 8], ecx
test esi, esi
je 0x442558
movzx eax, word [esi]
test ax, ax
je 0x442555
push eax
call fcn.0070a3dd
mov word [esi], ax
inc esi
pop ecx
add esi, 1
jne 0x44253d
mov ecx, dword [ebp - 8]
xor esi, esi
mov edx, ecx
push esi
push str._File
lea ecx, [ebp - 0x6c]
call fcn.005b46e5
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push dword [eax]
push esi
call fcn.005b6876
push esi
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x74]
push 0xe73f6c
mov edx, esi
and bl, al
call fcn.005b46e5
add esp, 0x18
mov edx, 0xe7abf0
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp - 8], eax
call fcn.005b21dd
test al, al
je 0x4425bd
push 0
push 0xe7abfc
mov edx, esi
lea ecx, [ebp - 0x7c]
call fcn.005b46e5
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov edx, 0xe7ac04
mov ecx, edi
call fcn.005b21dd
test al, al
jne 0x4425fd
mov edx, 0xe7ac10
mov ecx, edi
call fcn.005b21dd
test al, al
jne 0x4425fd
mov edx, 0xe7ac1c
mov ecx, edi
call fcn.005b21dd
test al, al
jne 0x4425fd
mov edx, 0xe7ac28
mov ecx, edi
call fcn.005b21dd
test al, al
je 0x442618
push 0
push 0xe7ac34
mov edx, esi
lea ecx, [ebp - 0x84]
call fcn.005b46e5
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x8c]
push 0
push 0xe7ac3c
call fcn.005b46e5
mov ecx, dword [ebp - 0xc]
push 0xe7a808
push str.ApplicationCompany
mov esi, dword [eax]
mov edx, esi
call fcn.005b6876
mov edx, esi
and bl, al
mov esi, dword [ebp - 0xc]
mov ecx, esi
push 0xe736e0
push str.ApplicationName
call fcn.005b6876
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x94]
push 0
push str.DefaultIcon
and bl, al
call fcn.005b46e5
push dword [ebp - 8]
mov ecx, esi
push 0
mov edx, dword [eax]
call fcn.005b6876
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x9c]
push 0
push str._shellopen
and bl, al
call fcn.005b46e5
push dword [ebp - 8]
mov ecx, esi
push str.Icon
mov edx, dword [eax]
call fcn.005b6876
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xa4]
push 0
push str._shellopencommand
and bl, al
call fcn.005b46e5
add esp, 0x40
mov ecx, esi
mov edx, dword [eax]
push dword [ebp - 0x1c]
push 0
call fcn.005b6876
pop ecx
pop ecx
mov edx, 0xe7a2a4
mov ecx, edi
and bl, al
call fcn.005b21dd
test al, al
je 0x442731
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xac]
push 0
push str._shellPrintcommand
call fcn.005b46e5
push dword [ebp - 0x20]
mov ecx, esi
push 0
mov edx, dword [eax]
call fcn.005b6876
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xb4]
push 0
push str._shellPrintTocommand
and bl, al
call fcn.005b46e5
push dword [ebp - 0x24]
mov ecx, esi
push 0
mov edx, dword [eax]
call fcn.005b6876
add esp, 0x20
and bl, al
push str.OpenWithProgids
push edi
mov edx, str.SoftwareClasses_
lea ecx, [ebp - 0xbc]
call fcn.005b46e5
pop ecx
pop ecx
mov esi, dword [eax]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x10]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0xc]
mov edi, eax
push edi
push dword [ebp - 0x10]
push esi
call fcn.005b6956
push eax
push str.LoggedWriteRegNone__s___s___s_____d_n
call fcn.005b3a54
xor ecx, ecx
movzx eax, bl
add esp, 0x14
lea edx, [ebp - 0x10]
test edi, edi
cmove ecx, eax
and dword [ebp - 0x10], 0
mov bl, cl
lea ecx, [ebp - 0x14]
call fcn.005b1962
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4424e9
pop edi
pop esi
mov al, bl
pop ebx
leave
ret