Function at 0x401630
Capabilities:
Delete registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2688
call fcn.004267e0
mov eax, dword [0x438478]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov byte [ebp - 0x215], 0
mov byte [ebp - 0x421], 0
push 0x114
push 0
lea eax, [ebp - 0x560]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x560], 0x114
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x554], 0x1db1
jbe 0x4017c7
xor edx, edx
mov word [ebp - 0xb78], dx
push 0x206
push 0
lea eax, [ebp - 0xb76]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x42b6a8
lea edx, [ebp - 0xb78]
push edx
call fcn.00402ab0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x768], ax
push 0x206
push 0
lea ecx, [ebp - 0x766]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x42b758
lea eax, [ebp - 0x768]
push eax
call fcn.00402ab0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xd80], cx
push 0x206
push 0
lea edx, [ebp - 0xd7e]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x42b7f0
lea ecx, [ebp - 0xd80]
push ecx
call fcn.00402ab0
add esp, 0xc
lea edx, [ebp - 0xb78]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x768]
push eax
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0xd80]
push ecx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edx, edx
mov word [ebp - 0x970], dx
push 0x206
push 0
lea eax, [ebp - 0x96e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._sOpenWithProgids
lea edx, [ebp - 0x970]
push edx
call fcn.00402ab0
add esp, 0xc
lea eax, [ebp - 0x970]
push eax
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 8]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push str._sShellOpenCommand
lea edx, [ebp - 0x210]
push edx
call fcn.00402ab0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401827
mov byte [ebp - 0x215], 1
movzx edx, byte [ebp - 0x215]
test edx, edx
je 0x401861
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xd84], eax
cmp dword [ebp - 0xd84], 0
je 0x401861
xor al, al
jmp 0x40222c
xor edx, edx
mov word [ebp - 0xf90], dx
push 0x206
push 0
lea eax, [ebp - 0xf8e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push str.__s_____1_
lea edx, [ebp - 0xf90]
push edx
call fcn.00402ab0
add esp, 0xc
mov dword [ebp - 0xf94], 0x104
mov dword [ebp - 0xd88], 1
xor eax, eax
mov word [ebp - 0x11a8], ax
push 0x208
push 0
lea ecx, [ebp - 0x11a6]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0xf94]
push edx
lea eax, [ebp - 0x11a8]
push eax
lea ecx, [ebp - 0xd88]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xf90]
push eax
lea ecx, [ebp - 0x11a8]
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401957
mov edx, dword [ebp - 4]
push edx
push str.RegQueryValueEx_return__d_n
call sub.OSUtil.dll_Ordinal_4_1
add esp, 8
mov byte [ebp - 0x421], 1
lea eax, [ebp - 0xf90]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 1]
push ecx
lea edx, [ebp - 0xf90]
push edx
push 1
push 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
call fcn.00401560
add esp, 4
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x11b0], 0x104
mov dword [ebp - 0x11ac], 1
xor edx, edx
mov word [ebp - 0x13c0], dx
push 0x208
push 0
lea eax, [ebp - 0x13be]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x11b0]
push ecx
lea edx, [ebp - 0x13c0]
push edx
lea eax, [ebp - 0x11ac]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x13c0]
push eax
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401a34
mov byte [ebp - 0x421], 1
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea edx, [eax + eax + 1]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
call fcn.00401560
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401560
add esp, 4
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x13c8], 0x104
mov dword [ebp - 0x13c4], 1
xor ecx, ecx
mov word [ebp - 0x15d8], cx
push 0x208
push 0
lea edx, [ebp - 0x15d6]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13c8]
push eax
lea ecx, [ebp - 0x15d8]
push ecx
lea edx, [ebp - 0x13c4]
push edx
push 0
push 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x15d8]
push edx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401b20
mov byte [ebp - 0x421], 1
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 1]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 1
push 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 6
mov esi, str.DefaultIcon
lea edi, [ebp - 0x444]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edx, edx
mov dword [ebp - 0x42a], edx
lea eax, [ebp - 0x444]
push eax
push 0x1e
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
mov byte [ebp - 0x215], 0
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401b92
mov byte [ebp - 0x215], 1
movzx ecx, byte [ebp - 0x215]
test ecx, ecx
je 0x401bcc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x15dc], eax
cmp dword [ebp - 0x15dc], 0
je 0x401bcc
xor al, al
jmp 0x40222c
xor ecx, ecx
mov word [ebp - 0x17f0], cx
push 0x206
push 0
lea edx, [ebp - 0x17ee]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x17f0]
push ecx
call fcn.00402b20
add esp, 8
push 0x42b8ec
lea edx, [ebp - 0x17f0]
push edx
call fcn.00402b20
add esp, 8
mov dword [ebp - 0x15e4], 0x104
mov dword [ebp - 0x15e0], 1
xor eax, eax
mov word [ebp - 0x1a00], ax
push 0x208
push 0
lea ecx, [ebp - 0x19fe]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x15e4]
push edx
lea eax, [ebp - 0x1a00]
push eax
lea ecx, [ebp - 0x15e0]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x17f0]
push eax
lea ecx, [ebp - 0x1a00]
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401cc0
mov byte [ebp - 0x421], 1
lea edx, [ebp - 0x17f0]
push edx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 1]
push eax
lea ecx, [ebp - 0x17f0]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], eax
mov byte [ebp - 0x215], 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov word [ebp - 0x420], cx
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
lea ecx, [ebp - 0x420]
push ecx
call fcn.00402ab0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00402b40
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401d4a
mov byte [ebp - 0x215], 1
movzx eax, byte [ebp - 0x215]
test eax, eax
je 0x401d84
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x1a04], eax
cmp dword [ebp - 0x1a04], 0
je 0x401d84
xor al, al
jmp 0x40222c
mov dword [ebp - 0x1a0c], 0x104
mov dword [ebp - 0x1a08], 1
xor eax, eax
mov word [ebp - 0x1c20], ax
push 0x208
push 0
lea ecx, [ebp - 0x1c1e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1a0c]
push edx
lea eax, [ebp - 0x1c20]
push eax
lea ecx, [ebp - 0x1a08]
push ecx
push 0
push 0x42b98c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c20]
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401e31
mov byte [ebp - 0x421], 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 1]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
push str.Progid
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov byte [ebp - 0x215], 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
lea edx, [ebp - 0x210]
push edx
call fcn.00402ab0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401e86
mov byte [ebp - 0x215], 1
movzx edx, byte [ebp - 0x215]
test edx, edx
je 0x401ec0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x1c24], eax
cmp dword [ebp - 0x1c24], 0
je 0x401ec0
xor al, al
jmp 0x40222c
xor edx, edx
mov word [ebp - 0x1e38], dx
push 0x206
push 0
lea eax, [ebp - 0x1e36]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x1e38]
push edx
call fcn.004015c0
add esp, 8
mov dword [ebp - 0x1c2c], 0x104
mov dword [ebp - 0x1c28], 1
xor eax, eax
mov word [ebp - 0x2048], ax
push 0x208
push 0
lea ecx, [ebp - 0x2046]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1c2c]
push edx
lea eax, [ebp - 0x2048]
push eax
lea ecx, [ebp - 0x1c28]
push ecx
push 0
push 0x42ba48
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e38]
push eax
lea ecx, [ebp - 0x2048]
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401fc8
mov byte [ebp - 0x421], 1
lea edx, [ebp - 0x1e38]
push edx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 1]
push eax
lea ecx, [ebp - 0x1e38]
push ecx
push 1
push 0
push 0x42ba4c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
push 2
push 0x42ba50
push 1
push 0
push 0x42ba54
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov byte [ebp - 0x215], 0
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithProgids
lea eax, [ebp - 0x210]
push eax
call fcn.00402ab0
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40201d
mov byte [ebp - 0x215], 1
movzx eax, byte [ebp - 0x215]
test eax, eax
je 0x402057
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x204c], eax
cmp dword [ebp - 0x204c], 0
je 0x402057
xor al, al
jmp 0x40222c
xor eax, eax
mov word [ebp - 0x2260], ax
push 0x206
push 0
lea ecx, [ebp - 0x225e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x2260]
push eax
call fcn.00402b20
add esp, 8
push 0x42bb10
lea ecx, [ebp - 0x2260]
push ecx
call fcn.00402b20
add esp, 8
mov dword [ebp - 0x2054], 0x104
mov dword [ebp - 0x2050], 1
xor edx, edx
mov word [ebp - 0x2470], dx
push 0x208
push 0
lea eax, [ebp - 0x246e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2054]
push ecx
lea edx, [ebp - 0x2470]
push edx
lea eax, [ebp - 0x2050]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402124
mov byte [ebp - 0x421], 1
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
call fcn.00401560
add esp, 4
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push reloc.OSUtil.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2478], 0x104
mov dword [ebp - 0x2474], 1
xor eax, eax
mov word [ebp - 0x2688], ax
push 0x208
push 0
lea ecx, [ebp - 0x2686]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x2478]
push edx
lea eax, [ebp - 0x2688]
push eax
lea ecx, [ebp - 0x2474]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2688]
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x402201
mov byte [ebp - 0x421], 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 1]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, byte [ebp - 0x421]
test ecx, ecx
je 0x40222a
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042673a
mov esp, ebp
pop ebp
ret