Function at 0x415180
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b980
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5ca104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
call fcn.00406e20
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4151ce
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4151e3
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4151e5
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [eax - 0xc], 0
je 0x41524c
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x4152b4
cmp dword [ecx + 0xc], 0
jl 0x41523e
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x41523e
push dword [ebp - 0x28]
call fcn.00405650
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov esi, eax
call fcn.00407070
add esi, 0x10
mov dword [ebp - 0x14], esi
jmp 0x4152b4
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.00405730
jmp 0x4152b1
lea ecx, [ebp - 0x28]
call fcn.0040c540
push str.MasterPDF
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push str._s_s.exe
push eax
call fcn.00420660
mov byte [ebp - 4], 2
add esp, 0x10
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4152b1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4152ad
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4152ad
push 0
push dword [edx + 4]
call ebx
jmp 0x4152b1
mov ecx, edx
call esi
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4152c7
mov dword [ebp - 0x28], eax
jmp 0x4158cf
push str.MasterPDF
lea ecx, [ebp - 0x34]
call fcn.00404e80
push str._2d3d
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.0041c840
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
mov edx, str.SoftwareClasses_
lea ecx, [ebp - 0x20]
call fcn.0041c750
add esp, 8
push str.2D_3D_Document
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00404e80
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x30]
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x415320
sub edx, ebx
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x415360
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov ebx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415375
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x415379
mov ecx, edx
call ebx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 8
push str._s_2
push eax
call fcn.00420660
push str.DefaultIcon
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041c840
mov ebx, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, ebx
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4153b2
sub ecx, dword [ebp - 0x28]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41542a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415425
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41541e
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41542a
mov ecx, edx
call dword [ebp - 0x28]
jmp 0x41542a
mov ecx, edx
call dword [ebp - 0x28]
push str._shell
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041c840
add esp, 4
push 8
push str.open
push 1
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415494
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415490
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415490
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x415494
mov ecx, edx
call edi
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4154b0
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov edi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4154c5
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x4154c9
mov ecx, edx
call edi
add eax, 0x10
mov dword [ebp - 0x28], eax
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push str.__s___2d3d____1____
push eax
call fcn.00420660
push str._shellopencommand
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
call fcn.0041c840
mov edi, dword [ebp - 0x28]
add esp, 0x10
mov ecx, edi
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415502
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x3c]
test eax, eax
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415581
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41557c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x28]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415575
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x415581
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x415581
mov ecx, edx
call dword [ebp - 0x38]
cmp byte [ebp - 0xd], 0
jne 0x415593
mov dword [ebp - 0x28], 0
jmp 0x4156ce
lea eax, [ebp + 8]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c750
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4155b6
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x5a5180
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.0041c840
add esp, 4
push 0
push 0x5a0e3c
push 1
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x3c]
call fcn.00404e00
cmp dword [ebp - 0x18], 0x80000001
jne 0x4156bf
lea eax, [ebp + 8]
mov edx, str.ExplorerFileExts_
push eax
lea ecx, [ebp - 0x18]
call fcn.0041c750
add esp, 4
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x415640
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push str.Progid
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.Application
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.UserChoice
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x38]
call fcn.0041c840
add esp, 4
mov ecx, SysReAllocStringLen
mov eax, dword [eax]
mov edx, eax
mov dword [ebp - 0x3c], eax
call fcn.00412480
push dword [ebp - 0x3c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.00404e00
lea ecx, [ebp - 0x18]
call fcn.00404e00
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 1
call fcn.00404e00
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415727
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415722
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41571b
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x415727
mov ecx, edx
call dword [ebp - 0x3c]
jmp 0x415727
mov ecx, edx
call dword [ebp - 0x3c]
mov byte [ebp - 4], 7
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x415769
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415767
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415767
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call ebx
jmp 0x41576f
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 6
mov eax, edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4157c7
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4157c1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4157ba
push 0
push dword [edx + 4]
call ebx
jmp 0x4157c7
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x4157c7
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 5
mov eax, edi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41581f
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415819
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415812
push 0
push dword [edx + 4]
call ebx
jmp 0x41581f
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x41581f
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 4
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415877
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415871
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41586a
push 0
push dword [edx + 4]
call ebx
jmp 0x415877
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x415877
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4158cf
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4158c9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4158c2
push 0
push dword [edx + 4]
call ebx
jmp 0x4158cf
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x4158cf
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41590b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415909
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415909
push 0
push dword [ecx + 4]
call ebx
jmp 0x41590b
call edx
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41594c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415948
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415948
push 0
push dword [edx + 4]
call ebx
jmp 0x41594c
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x41598e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41598a
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41598a
push 0
push dword [edx + 4]
call ebx
jmp 0x41598e
mov ecx, edx
call esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret