Function at 0x546768
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0060f180
push ebx
push esi
push edi
push dword [ebp + 8]
lea edi, [ebp - 0x82c]
call fcn.00545e8a
call fcn.00545427
test al, al
mov eax, edi
push eax
push dword [ebp + 8]
push str.CapabilitiesFileAssociations
je 0x5467b5
call fcn.00531e66
push 0x63b6c4
push str.ApplicationDescription
push str.Capabilities
call fcn.00531e66
jmp 0x5467ce
call fcn.00531ef6
push 0x63b6c4
push str.ApplicationDescription
push str.Capabilities
call fcn.00531ef6
call fcn.00545427
neg al
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 4], eax
call fcn.004012d6
test al, al
je 0x546801
push str.SoftwareNCH_SoftwarePicoPDFCapabilities
push 0x631ae0
push str.SoftwareRegisteredApplications
push dword [ebp - 4]
call fcn.004011af
lea eax, [ebp - 0x82c]
push eax
mov ebx, str.SoftwareClasses_s
mov esi, 0x104
push ebx
mov eax, esi
lea edi, [ebp - 0x624]
call fcn.005383cd
push dword [ebp + 8]
lea eax, [ebp - 0xc3c]
push ebx
push eax
call fcn.00401000
add esp, 0x14
push 0x631a7c
xor ebx, ebx
push ebx
lea eax, [ebp - 0xc3c]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xa34]
call fcn.00401162
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
jne 0x5468b8
cmp word [ebp - 0xa34], bx
jne 0x54687c
mov eax, dword [ebp + 8]
add eax, 2
push eax
push str._sfile
mov eax, esi
lea edi, [ebp - 0xa34]
call fcn.005383cd
pop ecx
pop ecx
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xe44]
push str.SoftwareClasses_s
push eax
call fcn.00401000
add esp, 0xc
push 0x631a7c
push ebx
lea eax, [ebp - 0xe44]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x104c]
call fcn.00401162
lea eax, [ebp - 0x104c]
push eax
push ebx
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 4]
call fcn.004011af
lea eax, [ebp - 0x624]
push eax
push str._sDefaultIcon
mov eax, esi
lea edi, [ebp - 0x214]
call fcn.005383cd
push dword [ebp + 0x14]
mov eax, esi
push dword [ebp + 0x10]
lea edi, [ebp - 0x41c]
push str._s__d
call fcn.005383cd
add esp, 0x14
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.004011af
lea eax, [ebp - 0x624]
push eax
push str._s_shell
mov eax, esi
lea edi, [ebp - 0x214]
call fcn.005383cd
pop ecx
pop ecx
push 0x63c7ec
push ebx
mov eax, edi
push eax
push dword [ebp - 4]
call fcn.004011af
lea eax, [ebp - 0x624]
push eax
push str._s_shellopencommand
mov eax, esi
call fcn.005383cd
push dword [ebp + 0x10]
mov eax, esi
push str.__s_____L_
lea edi, [ebp - 0x41c]
call fcn.005383cd
add esp, 0x10
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.004011af
mov eax, edi
push eax
push ebx
push str.SoftwareClassesApplicationspicopdf.exe_shellopencommand
push dword [ebp - 4]
call fcn.004011af
push 0x63c7ec
push ebx
push str.SoftwareClassesApplicationspicopdf.exe_shell
push dword [ebp - 4]
call fcn.004011af
push dword [ebp + 0x14]
mov eax, esi
push dword [ebp + 0x10]
push str._s__d
call fcn.005383cd
add esp, 0xc
mov eax, edi
push eax
push ebx
push str.SoftwareClassesApplicationspicopdf.exeDefaultIcon
push dword [ebp - 4]
call fcn.004011af
push 0x63b6c4
push ebx
push str.SoftwareClassesApplicationspicopdf.exe
push dword [ebp - 4]
call fcn.004011af
push dword [ebp + 8]
mov eax, esi
push str.SoftwareClasses_sOpenWithProgIds
lea edi, [ebp - 0x214]
call fcn.005383cd
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x546a29
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x82c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x10