Function at 0x413e90
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576a80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 3
call fcn.00406e20
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x413ee1
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x413ef6
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x413ef8
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
or edi, 0xffffffff
mov eax, dword [ebp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [eax - 0xc], 0
je 0x413f5f
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x413fc7
cmp dword [ecx + 0xc], 0
jl 0x413f51
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x413f51
push dword [ebp - 0x28]
call fcn.00405650
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov esi, eax
call fcn.00407070
add esi, 0x10
mov dword [ebp - 0x14], esi
jmp 0x413fc7
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.00405730
jmp 0x413fc4
lea ecx, [ebp - 0x28]
call fcn.0040c530
push str.MasterPDF
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x14]
push str._s_s.exe
push eax
call fcn.0041f560
mov byte [ebp - 4], 4
add esp, 0x10
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x413fc4
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x413fc0
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x413fc0
push 0
push dword [edx + 4]
call ebx
jmp 0x413fc4
mov ecx, edx
call esi
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413fda
mov dword [ebp - 0x28], eax
jmp 0x4145f7
push str.MasterPDF
lea ecx, [ebp - 0x30]
call fcn.00404e80
push 0x59f20c
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0041bc20
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004048b0
add esp, 0x10
mov byte [ebp - 4], 9
mov eax, edi
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414068
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414062
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x28]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41405b
push 0
push dword [edx + 4]
call ebx
jmp 0x414068
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414068
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x20]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 0x10]
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414090
sub edx, ebx
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4140d0
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov ebx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4140e5
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x4140e9
mov ecx, edx
call ebx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x1c]
push dword [ebp - 0x38]
push esi
push str._s__d
push eax
call fcn.0041f560
push str.DefaultIcon
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x28]
call fcn.0041bc20
mov ebx, dword [ebp - 0x1c]
add esp, 0x14
mov ecx, ebx
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414125
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41419d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414198
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414191
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41419d
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x41419d
mov ecx, edx
call dword [ebp - 0x38]
push str._shell
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041bc20
add esp, 4
push 8
push str.open
push 1
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414207
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414203
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414203
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414207
mov ecx, edx
call edi
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414223
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov edi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414238
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x41423c
mov ecx, edx
call edi
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push esi
push str.__s____s____1____
push eax
call fcn.0041f560
push str._shellopencommand
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
call fcn.0041bc20
mov edi, dword [ebp - 0x28]
add esp, 0x14
mov ecx, edi
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414280
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x3c]
test eax, eax
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4142ff
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4142fa
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x28]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4142f3
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4142ff
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x4142ff
mov ecx, edx
call dword [ebp - 0x38]
cmp byte [ebp - 0xd], 0
jne 0x414311
mov dword [ebp - 0x28], 0
jmp 0x41444e
lea eax, [ebp + 8]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414334
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x59f210
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.0041bc20
add esp, 4
push 0
push 0x59af0c
push 1
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x3c]
call fcn.00404e00
cmp dword [ebp - 0x18], 0x80000001
jne 0x41443f
lea eax, [ebp + 8]
mov edx, str.ExplorerFileExts_
push eax
lea ecx, [ebp - 0x18]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4143c0
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push str.Progid
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.Application
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.UserChoice
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x38]
call fcn.0041bc20
add esp, 4
mov ecx, SysReAllocStringLen
mov eax, dword [eax]
mov edx, eax
mov dword [ebp - 0x3c], eax
call fcn.00411a50
push dword [ebp - 0x3c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.00404e00
lea ecx, [ebp - 0x18]
call fcn.00404e00
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 1
call fcn.00404e00
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0xb
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4144a7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4144a2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41449b
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4144a7
mov ecx, edx
call dword [ebp - 0x3c]
jmp 0x4144a7
mov ecx, edx
call dword [ebp - 0x3c]
mov byte [ebp - 4], 0xa
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4144e9
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4144e7
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4144e7
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call ebx
jmp 0x4144ef
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 9
mov eax, edi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414547
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414541
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41453a
push 0
push dword [edx + 4]
call ebx
jmp 0x414547
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414547
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 6
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41459f
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x34], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414599
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414592
push 0
push dword [edx + 4]
call ebx
jmp 0x41459f
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x41459f
push ecx
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 4
mov eax, edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4145f7
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x34], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4145f1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4145ea
push 0
push dword [edx + 4]
call ebx
jmp 0x4145f7
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x4145f7
push ecx
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414633
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414631
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414631
push 0
push dword [ecx + 4]
call ebx
jmp 0x414633
call edx
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414674
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414670
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414670
push 0
push dword [edx + 4]
call ebx
jmp 0x414674
mov ecx, edx
call esi
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4146b5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4146b1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4146b1
push 0
push dword [edx + 4]
call ebx
jmp 0x4146b5
mov ecx, edx
call esi
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4146f6
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4146f2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4146f2
push 0
push dword [edx + 4]
call ebx
jmp 0x4146f6
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x414738
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414734
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414734
push 0
push dword [edx + 4]
call ebx
jmp 0x414738
mov ecx, edx
call esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret