Function at 0x631fbecb
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
call fcn.631fa762
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.URL:_CoD4_Connect_Handler
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jle 0x631fc140
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareClassescod4
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x631fbf3d
mov dword [esp + 4], str.Couldnt_update_the_registry_with_protocol_cod4
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc141
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d6ef8
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_0
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x81c]
mov dword [esp], eax
call fcn.631e0da0
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareClassescod4DefaultIcon
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x631fc02d
mov dword [esp + 4], str.Couldnt_update_the_registry_with_protocol_cod4
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc141
lea eax, [ebp - 0x81c]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x81c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareClassescod4_shellopencommand
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x631fc0c3
mov dword [esp + 4], str.Couldnt_update_the_registry_with_protocol_cod4
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc141
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__s__openurl____1_
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call fcn.631e0da0
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x41c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x631fc141
nop
leave
ret