Function at 0x402fc0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x51a930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0x120], 0
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x120], 1
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov byte [esp + 0x120], 2
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov byte [esp + 0x120], 3
call fcn.005157bf
mov eax, dword [eax + 8]
push 0x104
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403070
sub eax, ecx
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0xc]
call fcn.00401ff0
push 0x52b0a0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], 4
call fcn.004023f0
mov eax, dword [esp]
add eax, 0xfffffff0
mov byte [esp + 0x120], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4030d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x52b09c
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 5
call fcn.004023f0
mov eax, dword [esp]
add eax, 0xfffffff0
mov byte [esp + 0x120], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403124
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp], eax
push 0xb
mov byte [esp + 0x124], 6
call fcn.004fc27e
test eax, eax
je 0x403155
push 0xb
push eax
lea ecx, [esp + 8]
call fcn.00401f20
lea eax, [esp]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], 7
call fcn.004023f0
mov eax, dword [esp]
add eax, 0xfffffff0
mov byte [esp + 0x120], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40318f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x52b08c
push 0x80000000
call ebx
test eax, eax
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.kernel32.dll_lstrlen]
jne 0x4031e7
mov ebx, dword [esp + 0x1c]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52b070
push 0x80000000
call ebx
test eax, eax
jne 0x403223
mov ebx, dword [esp + 0x18]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52b04c
push 0x80000000
call ebx
test eax, eax
jne 0x40325f
mov ebx, dword [esp + 0x20]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52b044
push 0x80000000
call ebx
test eax, eax
jne 0x403299
push 0x52b08c
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push 0x52b08c
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
push 0x52b038
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x134], 8
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4032e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x52b034
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 9
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403337
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push 0xc
mov byte [esp + 0x134], 0xa
call fcn.004fc27e
test eax, eax
je 0x403369
push 0xc
push eax
lea ecx, [esp + 0x18]
call fcn.00401f20
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x134], 0xb
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4033a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x10]
push eax
push 0x52b028
push 0x80000000
call ebx
test eax, eax
jne 0x4033e1
mov ebx, dword [esp + 0x1c]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52b010
push 0x80000000
call ebx
test eax, eax
jne 0x40341d
mov ebx, dword [esp + 0x18]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52aff0
push 0x80000000
call ebx
test eax, eax
jne 0x403459
mov ebx, dword [esp + 0x20]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52afe8
push 0x80000000
call ebx
test eax, eax
jne 0x403493
push 0x52b028
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push 0x52b028
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
push 0x52b038
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x134], 0xc
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4034e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x52afe4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 0xd
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.004fc30b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push 0xd
mov byte [esp + 0x134], 0xe
call fcn.004fc27e
test eax, eax
je 0x403563
push 0xd
push eax
lea ecx, [esp + 0x18]
call fcn.00401f20
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x134], 0xf
call fcn.004023f0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x130], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40359f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x10]
push eax
push 0x52afd4
push 0x80000000
call ebx
test eax, eax
jne 0x4035db
mov ebx, dword [esp + 0x1c]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52afb8
push 0x80000000
call ebx
test eax, eax
jne 0x403617
mov ebx, dword [esp + 0x18]
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 0x52af98
push 0x80000000
call ebx
test eax, eax
mov ebx, dword [esp + 0x20]
jne 0x40364d
push ebx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x10]
push eax
push 0x52af90
push 0x80000000
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
jne 0x40368b
push 0x52afd4
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
push 0x52afd4
push 1
push 0
push 0x52a984
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x130], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4036b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x130], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4036d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebx - 0x10]
mov byte [esp + 0x130], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x4036fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x120], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403726
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
add esp, 0x124
ret