Function at 0x4364f8
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
call fcn.0042be4e
mov ebx, eax
push str.____1_
push ebx
mov dword [ebp - 0x18], ebx
call fcn.0046265e
mov esi, 0x4f31a4
mov ecx, eax
mov edx, esi
call fcn.0045f798
pop ecx
pop ecx
push str.___print_to_default___1_
push ebx
mov dword [ebp - 0x1c], eax
call fcn.0046265e
mov edx, esi
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
push str.___print_to___2____1_
push ebx
mov dword [ebp - 0x20], eax
call fcn.0046265e
mov edx, esi
mov ecx, eax
call fcn.0045f798
pop ecx
mov ebx, 0x4fab38
mov dword [ebp - 0x24], eax
pop ecx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], 1
push 0
push ebx
call fcn.0046265e
mov edx, 0x4f3608
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
push 0
push eax
mov dword [ebp - 0x28], eax
call fcn.0046265e
mov edx, str.SoftwareClasses_
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
push 0xffffffffffffffff
mov dword [ebp - 8], eax
call fcn.0046265e
lea edx, [ebx + 1]
mov ecx, eax
call fcn.0045f484
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jmp 0x4365cc
mov al, byte [esi]
test al, al
je 0x4365cf
movsx eax, al
push eax
call fcn.004c60ac
mov byte [esi], al
add esi, 1
pop ecx
jne 0x4365b8
push 0
push str._File
call fcn.0046265e
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.0045f798
mov edx, dword [ebp - 8]
mov ecx, edi
push eax
push 0
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x10
mov edx, 0x4fae58
mov ecx, ebx
call fcn.0045f4ee
test al, al
je 0x43660f
mov esi, 0x4fae60
jmp 0x436659
mov edx, 0x4fae64
mov ecx, ebx
call fcn.0045f4ee
test al, al
jne 0x436654
mov edx, 0x4fae6c
mov ecx, ebx
call fcn.0045f4ee
test al, al
jne 0x436654
mov edx, 0x4fae74
mov ecx, ebx
call fcn.0045f4ee
test al, al
jne 0x436654
mov edx, 0x4fae7c
mov ecx, ebx
call fcn.0045f4ee
mov esi, 0x4fae88
test al, al
je 0x436659
mov esi, 0x4fae84
call fcn.0046265e
push esi
push dword [ebp - 0x18]
mov edx, 0x4f31a4
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
push 0
push 0x4fae8c
mov edi, eax
call fcn.0046265e
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.0045f798
mov ecx, dword [ebp - 0xc]
mov esi, eax
push 0x4fac78
push str.ApplicationCompany
mov edx, esi
call fcn.004645fd
and byte [ebp - 1], al
mov edx, esi
mov esi, dword [ebp - 0xc]
mov ecx, esi
push 0x4f3608
push str.ApplicationName
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x18
push 0
push str.DefaultIcon
call fcn.0046265e
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.0045f798
push edi
push 0
mov edx, eax
mov ecx, esi
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x10
push 0
push str._shellopen
call fcn.0046265e
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.0045f798
push edi
push str.Icon
mov edx, eax
mov ecx, esi
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x10
push 0
push str._shellopencommand
call fcn.0046265e
mov edi, dword [ebp - 8]
mov ecx, eax
mov edx, edi
call fcn.0045f798
push dword [ebp - 0x1c]
mov edx, eax
mov ecx, esi
push 0
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x10
mov edx, 0x4f72c0
mov ecx, ebx
call fcn.0045f4ee
test al, al
je 0x43679e
push 0
push str._shellPrintcommand
call fcn.0046265e
mov edx, edi
mov ecx, eax
call fcn.0045f798
push dword [ebp - 0x20]
mov edx, eax
mov ecx, esi
push 0
call fcn.004645fd
and byte [ebp - 1], al
add esp, 0x10
push 0
push str._shellPrintTocommand
call fcn.0046265e
mov edx, edi
mov ecx, eax
call fcn.0045f798
push dword [ebp - 0x24]
mov edx, eax
mov ecx, esi
push 0
call fcn.004645fd
add esp, 0x10
and byte [ebp - 1], al
push str.OpenWithProgids
push ebx
call fcn.0046265e
mov edx, str.SoftwareClasses_
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
mov edi, eax
or edx, 0xffffffff
mov ecx, edi
call fcn.00462840
mov ebx, dword [ebp - 0x28]
or edx, 0xffffffff
mov ecx, ebx
mov esi, eax
call fcn.00462840
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
push dword [ebp - 0xc]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
push esi
push ebx
push edi
mov edi, dword [ebp - 0xc]
mov ecx, edi
call fcn.00464724
push eax
push str.LoggedWriteRegNone__s___s___s_____d_n
call fcn.004620b3
movzx eax, byte [ebp - 1]
lea edx, [ebp - 0x28]
xor ecx, ecx
add esp, 0x14
test esi, esi
cmove ecx, eax
and dword [ebp - 0x28], 0
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x10]
call fcn.0046010e
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0x43656c
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret