Function at 0x4261f0
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1640
call fcn.00437c60
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x162c], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x1ec]
mov ecx, 0x1e
mov dword [ebp - 0x1634], eax
mov eax, dword [ebp + 0x10]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1630], eax
mov eax, dword [ebp + 0x14]
push 0x4e
mov dword [ebp - 0x1638], eax
lea eax, [ebp - 0x172]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004bf1c0
push 0xc8
lea eax, [ebp - 0x3bc]
push 0
push eax
call fcn.004bf1c0
push 0xc8
lea eax, [ebp - 0x2f4]
push 0
push eax
call fcn.004bf1c0
push 0xc8
lea eax, [ebp - 0x484]
push 0
push eax
call fcn.004bf1c0
push 0x190
lea eax, [ebp - 0x81c]
push 0
push eax
call fcn.004bf1c0
push 0x190
lea eax, [ebp - 0xb3c]
push 0
push eax
call fcn.004bf1c0
add esp, 0x48
lea eax, [ebp - 0x1514]
push 0x7d0
push 0
push eax
call fcn.004bf1c0
push 0x190
lea eax, [ebp - 0x9ac]
push 0
push eax
call fcn.004bf1c0
push 0x100
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004bf1c0
mov esi, dword [ebp - 0x162c]
lea eax, [ebp - 0x124]
push esi
push dword [ebp - 0x1634]
push 0x573dcc
push eax
call fcn.0041ee30
add esp, 0x34
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x1ec]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x3be], ax
test ax, ax
jne 0x426312
mov edx, esi
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x426330
lea edi, [ebp - 0x3bc]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426346
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3bc]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426370
mov ecx, 8
mov esi, str.OpenWithProgids
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsw word es:[edi], word [esi]
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1ec]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x2f6], ax
test ax, ax
jne 0x426390
mov edx, dword [ebp - 0x162c]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4263b0
lea edi, [ebp - 0x2f4]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4263c6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2f4]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4263f0
mov eax, dword [str.UserChoice]
mov dword [ecx], eax
mov eax, dword [0x573f14]
mov dword [ecx + 4], eax
mov eax, dword [0x573f18]
mov dword [ecx + 8], eax
mov eax, dword [0x573f1c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x573f20]
mov dword [ecx + 0x10], eax
mov eax, dword [0x573f24]
mov dword [ecx + 0x14], eax
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1ec]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x486], ax
test ax, ax
jne 0x426430
mov edx, dword [ebp - 0x162c]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x426450
lea edi, [ebp - 0x484]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426466
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x484]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426490
mov edx, dword [ebp - 0x162c]
mov ecx, 7
mov esi, str.OpenWithList
rep movsd dword es:[edi], dword [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4264b0
lea edi, [ebp - 0x1ec]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4264c6
mov ecx, edx
mov ebx, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x81c]
and ecx, 3
sub edx, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4264f0
lea edi, [ebp - 0x81c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426510
mov ecx, 9
mov edx, dword [ebp - 0x162c]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x426532
lea edi, [ebp - 0x81c]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426550
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x81c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xb3e], ax
test ax, ax
jne 0x426570
lea edi, [ebp - 0xb3c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426591
mov ecx, 8
lea edx, [ebp - 0x1514]
mov esi, str.OpenWithProgids
sub edx, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsw word es:[edi], word [esi]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4265b5
lea edi, [ebp - 0x1514]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4265d0
mov ecx, 9
lea edx, [ebp - 0x124]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4265f2
lea edi, [ebp - 0x1514]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426610
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1514]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426633
mov ecx, 6
mov esi, str.DefaultIcon
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x9ac]
sub ecx, ebx
movsw word es:[edi], word [esi]
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x426655
lea edi, [ebp - 0x9ac]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426670
mov ecx, 9
lea edx, [ebp - 0x124]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x426692
lea edi, [ebp - 0x9ac]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4266b0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9ac]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4266d3
lea eax, [ebp - 0x2f4]
mov ecx, 0xa
mov esi, str._shellopencommand
push eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x3bc]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x484]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x1ec]
push eax
push reloc.WS2_32.dll_accept
call esi
cmp dword [ebp + 0x20], 0
lea eax, [ebp - 0x1ec]
push eax
push reloc.WS2_32.dll_accept
je 0x426b99
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ebx, dword [ebp - 0x162c]
lea eax, [ebp - 0x163c]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
push 0
lea eax, [ebp - 0x1640]
mov dword [ebp - 0x1640], 1
push eax
push 0x571908
push ebx
push SysReAllocString
mov dword [ebp - 0x163c], 0
call edi
test eax, eax
jne 0x426d3e
push dword [ebp - 0x163c]
call fcn.004c67d4
push dword [ebp - 0x163c]
mov esi, eax
push 0
push esi
call fcn.004bf1c0
add esp, 0x10
mov dword [ebp - 0x1640], 1
lea eax, [ebp - 0x163c]
push eax
push esi
lea eax, [ebp - 0x1640]
push eax
push 0x571908
push ebx
push SysReAllocString
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test esi, esi
je 0x42688a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4267e1
sub ecx, edx
sar ecx, 1
je 0x42688a
lea ecx, [ebp - 0x124]
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426826
test dx, dx
je 0x426822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426826
add eax, 4
add ecx, 4
test dx, dx
jne 0x426800
xor eax, eax
jmp 0x42682b
sbb eax, eax
or eax, 1
test eax, eax
je 0x42688a
push 0x208
lea eax, [ebp - 0x68c]
push 0
push eax
call fcn.004bf1c0
push dword [ebp - 0x1634]
lea eax, [ebp - 0x68c]
push str._sBackup
push eax
call fcn.0041ee30
mov ecx, esi
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426861
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
lea eax, [ebp - 0x68c]
push eax
push ebx
push SysReAllocString
call edi
lea ecx, [ebp - 0x124]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426893
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x124]
push eax
push 1
push 0x571908
lea eax, [ebp - 0x81c]
push eax
push reloc.WS2_32.dll_closesocket
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0xb3c]
push eax
push reloc.WS2_32.dll_closesocket
call edi
mov ecx, dword [ebp - 0x1638]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4268f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x1638]
lea eax, [ebp - 0x1514]
push 1
push 0x571908
push eax
push reloc.WS2_32.dll_closesocket
call edi
mov ecx, dword [ebp - 0x1630]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426930
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x1630]
lea eax, [ebp - 0x9ac]
push 1
push 0x571908
push eax
push reloc.WS2_32.dll_closesocket
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x3bc]
push eax
push reloc.WS2_32.dll_accept
call edi
lea ecx, [ebp - 0x124]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426986
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x124]
push eax
push 1
push str.ProgId
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
call edi
push 0x110
lea eax, [ebp - 0x1624]
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x1628], 0x114
lea eax, [ebp - 0x1628]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1624], 6
jb 0x426b58
cmp dword [ebp - 0x1620], 2
jb 0x426d31
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x22c]
movq qword [ebp - 0x13], xmm0
push 0
push eax
movups xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0xd44]
push 0
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x68c]
push 0
push eax
call fcn.004bf1c0
add esp, 0x24
lea eax, [ebp - 0x68c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x68c]
push 0x5c
push eax
call fcn.004bf40d
xor ecx, ecx
push str.PDZipAssohash.dll
mov word [eax + 2], cx
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xd44]
push 0x573dcc
push eax
call fcn.0041ee30
add esp, 0x18
lea eax, [ebp - 0xd44]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x426add
push str.HashAssociation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426ad6
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x124]
push ecx
push ebx
call eax
add esp, 0xc
jmp 0x426aea
push str.file_exts_registration_load_hash_association_dll_function_failed.
jmp 0x426ae2
push str.file_exts_registration_load_hash_association_dll_failed.
call fcn.004b7492
add esp, 4
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426af0
sub ecx, edx
je 0x426d31
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004b34fe
lea ecx, [ebp - 0x124]
add esp, 8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426b20
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x22c]
push eax
push 1
push str.Hash
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
call edi
jmp 0x426d31
lea ecx, [ebp - 0x124]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426b61
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x124]
push eax
push 1
push 0x571908
lea eax, [ebp - 0x1ec]
push eax
push reloc.WS2_32.dll_closesocket
call edi
jmp 0x426d31
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call esi
lea eax, [ebp - 0x124]
push eax
push SysReAllocString
call esi
push 0x208
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x1638], 1
push 0
push eax
mov dword [ebp - 0x1630], 0
call fcn.004bf1c0
push dword [ebp - 0x1634]
lea eax, [ebp - 0x68c]
push str._sBackup
push eax
call fcn.0041ee30
mov ebx, dword [ebp - 0x162c]
lea eax, [ebp - 0x1630]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0x18
push eax
push 0
lea eax, [ebp - 0x1638]
push eax
lea eax, [ebp - 0x68c]
push eax
push ebx
push SysReAllocString
call edi
test eax, eax
jne 0x426d3e
push dword [ebp - 0x1630]
call fcn.004c67d4
push dword [ebp - 0x1630]
mov esi, eax
push 0
push esi
call fcn.004bf1c0
add esp, 0x10
mov dword [ebp - 0x1638], 1
lea eax, [ebp - 0x1630]
push eax
push esi
lea eax, [ebp - 0x1638]
push eax
lea eax, [ebp - 0x68c]
push eax
push ebx
push SysReAllocString
call edi
test esi, esi
je 0x426d3e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426c76
sub ecx, edx
sar ecx, 1
je 0x426d31
lea ecx, [ebp - 0x124]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426cb9
test dx, dx
je 0x426cb5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426cb9
add eax, 4
add ecx, 4
test dx, dx
jne 0x426c93
xor eax, eax
jmp 0x426cbe
sbb eax, eax
or eax, 1
test eax, eax
je 0x426d1e
lea eax, [ebp - 0x1634]
push eax
push 0xf003f
push 0
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426d35
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426ce5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push 0x571908
push dword [ebp - 0x1634]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x68c]
push eax
push ebx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test esi, esi
je 0x426d3e
push esi
call fcn.004c67cf
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 0x1c